Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Eset Online Scanner findet ava/Exploit.Agent.OEX Trojaner (https://www.trojaner-board.de/134775-eset-online-scanner-findet-ava-exploit-agent-oex-trojaner.html)

Scott1980 10.05.2013 21:34
Eset Online Scanner findet ava/Exploit.Agent.OEX Trojaner
 
Hallo an das Team,

bei meinen wöchentlichen Scan wurde folgendes vom Eeset Online Scanner entdeckt:

Code:
Java/Exploit.Agent.OEX Trojaner" ac=I fn="C:\Users\Internet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\4466300b-62398cfe
Würd gern wissen, um was für einen "Boesewicht" es sich handelt.

Anliegend folgende Logs:

Eset:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=471619c17111ad47be237c36fc6cbc08
# engine=13663
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-04-21 07:53:15
# local_time=2013-04-21 09:53:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 5486 118203845 0 0
# scanned=171460
# found=0
# cleaned=0
# scan_time=2780
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=471619c17111ad47be237c36fc6cbc08
# engine=13665
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-04-21 08:58:44
# local_time=2013-04-21 10:58:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 9415 118207774 0 0
# scanned=163
# found=0
# cleaned=0
# scan_time=3
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=471619c17111ad47be237c36fc6cbc08
# engine=13679
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-04-23 07:06:08
# local_time=2013-04-23 09:06:08 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 14262 118373818 0 0
# scanned=172768
# found=0
# cleaned=0
# scan_time=5454
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=471619c17111ad47be237c36fc6cbc08
# engine=13751
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-04 07:43:44
# local_time=2013-05-04 09:43:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 571799 119283274 0 0
# scanned=118013
# found=0
# cleaned=0
# scan_time=3252
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=471619c17111ad47be237c36fc6cbc08
# engine=13803
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-10 07:09:56
# local_time=2013-05-10 09:09:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 1131371 119842846 0 0
# scanned=118228
# found=1
# cleaned=0
# scan_time=3369
sh=DE9C2C1E07BA0AAD1C535F958C0540C774102069 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.OEX Trojaner" ac=I fn="C:\Users\Internet\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\4466300b-62398cfe"

MBAM:

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.10.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16540
Martin :: MARTIN-PC [Administrator]

10.05.2013 21:16:21
mbam-log-2013-05-10 (21-16-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 342450
Laufzeit: 35 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

OTL:

Code:
OTL logfile created on: 10.05.2013 22:04:41 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Internet\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,97 Gb Total Physical Memory | 2,58 Gb Available Physical Memory | 65,00% Memory free
7,93 Gb Paging File | 6,05 Gb Available in Paging File | 76,24% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 224,04 Gb Total Space | 186,69 Gb Free Space | 83,33% Space Free | Partition Type: NTFS
Drive D: | 224,04 Gb Total Space | 216,20 Gb Free Space | 96,50% Space Free | Partition Type: NTFS
Drive E: | 1,06 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: MARTIN-PC | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.05.10 22:03:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Internet\Desktop\OTL.exe
PRC - [2013.04.21 18:30:27 | 001,855,880 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe
PRC - [2013.04.10 08:56:41 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013.03.04 11:09:17 | 001,956,304 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
PRC - [2013.02.27 10:32:11 | 001,942,480 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\TotalProtection\AVKBackup\AVKBackupService.exe
PRC - [2013.02.25 14:59:46 | 000,696,808 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
PRC - [2013.02.25 05:01:04 | 001,444,304 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\TotalProtection\AVKTray\AVKTray.exe
PRC - [2013.02.25 04:52:49 | 001,854,416 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFirewallTray.exe
PRC - [2013.02.25 04:15:25 | 000,635,344 | ---- | M] (G Data Software AG) -- C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKService.exe
PRC - [2013.02.07 14:31:22 | 001,223,704 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe
PRC - [2013.02.07 14:31:18 | 000,575,000 | ---- | M] (Secunia) -- C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
PRC - [2010.08.04 14:40:12 | 000,611,872 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
PRC - [2010.06.29 19:26:30 | 000,124,136 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe
PRC - [2010.05.27 04:41:24 | 000,349,552 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
PRC - [2010.03.11 07:11:56 | 000,407,920 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
PRC - [2010.03.11 07:11:42 | 000,201,584 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009.06.05 04:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.04.21 18:30:26 | 016,032,648 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
MOD - [2013.04.10 08:56:55 | 003,133,336 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2010.08.04 14:40:12 | 000,611,872 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
MOD - [2010.08.04 11:47:32 | 000,144,896 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.04.10 08:56:49 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.03.04 11:09:17 | 001,956,304 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)
SRV - [2013.02.27 10:32:11 | 001,942,480 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\TotalProtection\AVKBackup\AVKBackupService.exe -- (GDBackupSvc)
SRV - [2013.02.25 15:00:02 | 000,257,512 | ---- | M] (G Data Software) [On_Demand | Stopped] -- C:\Program Files (x86)\G Data\TotalProtection\TSNxG\TSNxGService.exe -- (TSNxGService)
SRV - [2013.02.25 14:59:46 | 000,696,808 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan)
SRV - [2013.02.25 05:06:17 | 001,711,568 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- C:\Program Files (x86)\G Data\TotalProtection\AVKTuner\AVKTunerService.exe -- (GDTunerSvc)
SRV - [2013.02.25 04:48:22 | 002,656,800 | ---- | M] (G Data Software AG) [On_Demand | Running] -- C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFwSvcx64.exe -- (GDFwSvc)
SRV - [2013.02.25 04:41:37 | 002,249,944 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKWCtlx64.exe -- (AVKWCtl)
SRV - [2013.02.25 04:15:25 | 000,635,344 | ---- | M] (G Data Software AG) [Auto | Running] -- C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKService.exe -- (AVKService)
SRV - [2013.02.07 14:31:22 | 001,223,704 | ---- | M] (Secunia) [Auto | Running] -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent)
SRV - [2013.02.07 14:31:20 | 000,660,504 | ---- | M] (Secunia) [Auto | Stopped] -- C:\Program Files (x86)\Secunia\PSI\sua.exe -- (Secunia Update Agent)
SRV - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.04.21 17:28:57 | 000,107,128 | ---- | M] (G Data Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD)
DRV:64bit: - [2013.04.21 17:22:59 | 000,062,808 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt)
DRV:64bit: - [2013.04.21 17:22:48 | 000,098,760 | ---- | M] (G Data Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TS4nt.sys -- (TS4NT)
DRV:64bit: - [2013.04.21 17:22:48 | 000,077,656 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\gddcd64.sys -- (gddcd)
DRV:64bit: - [2013.04.21 17:22:48 | 000,058,712 | ---- | M] (G Data Software AG) [File_System | System | Running] -- C:\Windows\SysNative\drivers\gddcv64.sys -- (gddcv)
DRV:64bit: - [2013.04.21 17:22:41 | 000,064,856 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd)
DRV:64bit: - [2013.04.21 17:22:37 | 000,133,976 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt)
DRV:64bit: - [2013.04.21 17:22:37 | 000,064,856 | ---- | M] (G Data Software AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre)
DRV:64bit: - [2013.04.21 17:22:37 | 000,060,248 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave)
DRV:64bit: - [2013.02.07 14:15:22 | 000,018,456 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\psi_mf_amd64.sys -- (PSI)
DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.11 19:16:38 | 010,628,640 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.12.09 11:39:52 | 000,537,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:35:02 | 000,281,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1y60x64.sys -- (e1yexpress)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.25 22:13:10 | 000,138,752 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.web.de"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.04.21 17:18:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2013.04.21 03:40:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Extensions
[2013.04.21 18:33:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\fgf08hpx.default\extensions
[2013.04.21 18:33:15 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Martin\AppData\Roaming\mozilla\Firefox\Profiles\fgf08hpx.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2013.04.21 18:33:15 | 000,532,430 | ---- | M] () (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\firefox\profiles\fgf08hpx.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.04.21 18:32:42 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Martin\AppData\Roaming\mozilla\firefox\profiles\fgf08hpx.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.04.21 03:39:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.04.10 08:57:39 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.04.10 10:18:46 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.04.10 10:18:46 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.04.10 10:18:46 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.04.10 10:18:46 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.04.10 10:18:46 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.04.10 10:18:46 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [ArcadeMovieService] C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [G Data AntiVirus Tray] C:\Program Files (x86)\G Data\TotalProtection\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [MDS_Menu] C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKCU..\Run: [FileHippo.com] "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 192.168.0.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CC3F24BF-1A41-49F0-9FAC-2AD2D6ADB981}: DhcpNameServer = 192.168.0.1 192.168.0.2
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (c:\program files (x86)\g data\totalprotection\avkkid\avkcks.exe) - c:\program files (x86)\g data\totalprotection\avkkid\avkcks.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.07.14 16:32:06 | 000,000,026 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.04 08:47:57 | 000,000,000 | ---D | C] -- C:\Program Files\Tracker Software
[2013.04.21 22:44:19 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2013.04.21 22:44:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.04.21 22:44:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.04.21 22:43:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.04.21 19:43:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2013.04.21 18:45:18 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Malwarebytes
[2013.04.21 18:45:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.04.21 18:45:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.04.21 18:45:10 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.04.21 18:45:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.04.21 18:44:56 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Programs
[2013.04.21 18:40:08 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Martin\Desktop\esetsmartinstaller_enu.exe
[2013.04.21 18:31:36 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Macromedia
[2013.04.21 18:30:25 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2013.04.21 18:20:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileHippo.com
[2013.04.21 17:28:58 | 000,016,944 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys
[2013.04.21 17:28:57 | 000,107,128 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys
[2013.04.21 17:22:59 | 000,062,808 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys
[2013.04.21 17:22:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data TotalProtection 2014
[2013.04.21 17:22:48 | 000,098,760 | ---- | C] (G Data Software) -- C:\Windows\SysNative\drivers\TS4nt.sys
[2013.04.21 17:22:48 | 000,077,656 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gddcd64.sys
[2013.04.21 17:22:48 | 000,058,712 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gddcv64.sys
[2013.04.21 17:22:41 | 000,064,856 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys
[2013.04.21 17:22:37 | 000,133,976 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys
[2013.04.21 17:22:37 | 000,064,856 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys
[2013.04.21 17:22:37 | 000,060,248 | ---- | C] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys
[2013.04.21 17:21:41 | 000,000,000 | ---D | C] -- C:\ProgramData\G DATA Software
[2013.04.21 17:21:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\G Data
[2013.04.21 17:21:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\G Data
[2013.04.21 17:20:49 | 000,000,000 | ---D | C] -- C:\ProgramData\G Data
[2013.04.21 12:41:27 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2013.04.21 12:40:49 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2013.04.21 12:28:25 | 000,000,000 | ---D | C] -- C:\Windows\de-DE
[2013.04.21 12:28:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer
[2013.04.21 12:28:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE
[2013.04.21 12:28:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de
[2013.04.21 12:28:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407
[2013.04.21 12:28:23 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE
[2013.04.21 12:28:23 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407
[2013.04.21 12:28:22 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de
[2013.04.21 12:27:46 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2013.04.21 12:27:46 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2013.04.21 12:27:44 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2013.04.21 12:27:44 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2013.04.21 12:25:15 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysNative\fms.dll
[2013.04.21 12:25:01 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\Windows\SysWow64\fms.dll
[2013.04.21 12:23:56 | 000,000,000 | ---D | C] -- C:\Windows\NAPP_Dism_Log
[2013.04.21 11:48:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013.04.21 11:23:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2013.04.21 04:27:07 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Secunia PSI
[2013.04.21 04:27:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Secunia
[2013.04.21 04:05:24 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\WindowsUpdate
[2013.04.21 03:47:00 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Adobe
[2013.04.21 03:40:01 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Mozilla
[2013.04.21 03:40:01 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Mozilla
[2013.04.21 03:39:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013.04.21 03:39:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.04.21 03:39:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.04.21 03:33:09 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Adobe
[2013.04.21 03:26:37 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Diagnostics
[2013.04.21 03:24:34 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\OEM
[2013.04.21 03:24:32 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Macromedia
[2013.04.21 03:24:32 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\EgisTec IPS
[2013.04.21 03:24:22 | 000,000,000 | R--D | C] -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.04.21 03:24:22 | 000,000,000 | R--D | C] -- C:\Users\Martin\Searches
[2013.04.21 03:24:22 | 000,000,000 | R--D | C] -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.04.21 03:24:14 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Identities
[2013.04.21 03:24:12 | 000,000,000 | R--D | C] -- C:\Users\Martin\Contacts
[2013.04.21 03:24:10 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\VirtualStore
[2013.04.21 03:22:56 | 000,000,000 | ---D | C] -- C:\Program Files\Acer Accessory Store
[2013.04.21 03:22:35 | 000,000,000 | --SD | C] -- C:\Users\Martin\AppData\Roaming\Microsoft
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Videos
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Saved Games
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Pictures
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Music
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Links
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Favorites
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Downloads
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Documents
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\Desktop
[2013.04.21 03:22:35 | 000,000,000 | R--D | C] -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Vorlagen
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\AppData\Local\Verlauf
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\AppData\Local\Temporary Internet Files
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Startmenü
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\SendTo
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Recent
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Netzwerkumgebung
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Lokale Einstellungen
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Documents\Eigene Videos
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Documents\Eigene Musik
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Eigene Dateien
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Documents\Eigene Bilder
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Druckumgebung
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Cookies
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\AppData\Local\Anwendungsdaten
[2013.04.21 03:22:35 | 000,000,000 | -HSD | C] -- C:\Users\Martin\Anwendungsdaten
[2013.04.21 03:22:35 | 000,000,000 | -H-D | C] -- C:\Users\Martin\AppData
[2013.04.21 03:22:35 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Temp
[2013.04.21 03:22:35 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Local\Microsoft
[2013.04.21 03:22:35 | 000,000,000 | ---D | C] -- C:\Users\Martin\AppData\Roaming\Media Center Programs
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.04.21 03:22:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.04.21 03:05:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2013.04.21 03:03:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
[2013.04.21 03:01:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2013.04.21 02:59:46 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Arcade Deluxe
[2013.04.21 02:58:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cyberlink
[2013.04.21 02:58:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Acer Arcade Deluxe
[2013.04.21 02:58:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2013.04.21 02:58:09 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2013.04.21 02:57:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2013.04.21 02:41:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AcerSystem
[2013.04.21 02:41:13 | 000,000,000 | ---D | C] -- C:\book
[2013.04.21 02:35:32 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.04.21 02:34:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\x64
[2013.04.21 02:34:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Lang
[2013.04.21 02:32:30 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.10 22:00:00 | 000,000,388 | ---- | M] () -- C:\Windows\tasks\Acer Registration - Reminder Recall task.job
[2013.05.10 20:35:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.10 20:18:21 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.10 20:18:21 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.10 20:11:03 | 3193,835,520 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.04 08:48:05 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\PDF-Viewer.lnk
[2013.04.27 18:50:02 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.04.27 18:50:02 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.04.27 18:50:02 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.04.27 18:50:02 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.04.27 18:50:02 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.04.21 18:45:11 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.04.21 18:40:08 | 002,347,384 | ---- | M] (ESET) -- C:\Users\Martin\Desktop\esetsmartinstaller_enu.exe
[2013.04.21 18:21:54 | 000,001,114 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.04.21 18:20:24 | 000,001,977 | ---- | M] () -- C:\Users\Martin\Desktop\Update Checker.lnk
[2013.04.21 17:30:42 | 000,000,000 | ---- | M] () -- C:\Windows\topsecret.INI
[2013.04.21 17:28:58 | 000,016,944 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GdPhyMem.sys
[2013.04.21 17:28:57 | 000,107,128 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\GRD.sys
[2013.04.21 17:22:59 | 000,062,808 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\PktIcpt.sys
[2013.04.21 17:22:52 | 000,002,051 | ---- | M] () -- C:\Users\Public\Desktop\G Data TotalProtection 2014.lnk
[2013.04.21 17:22:48 | 000,098,760 | ---- | M] (G Data Software) -- C:\Windows\SysNative\drivers\TS4nt.sys
[2013.04.21 17:22:48 | 000,077,656 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gddcd64.sys
[2013.04.21 17:22:48 | 000,058,712 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gddcv64.sys
[2013.04.21 17:22:48 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_gddcd64_01007.Wdf
[2013.04.21 17:22:41 | 000,064,856 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys
[2013.04.21 17:22:37 | 000,133,976 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\MiniIcpt.sys
[2013.04.21 17:22:37 | 000,064,856 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\HookCentre.sys
[2013.04.21 17:22:37 | 000,060,248 | ---- | M] (G Data Software AG) -- C:\Windows\SysNative\drivers\GDBehave.sys
[2013.04.21 17:03:46 | 000,275,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.04.21 16:51:11 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.04.21 16:51:11 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.04.21 12:28:15 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat
[2013.04.21 12:28:15 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat
[2013.04.21 12:27:46 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2013.04.21 12:27:46 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2013.04.21 12:27:44 | 000,004,096 | ---- | M] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2013.04.21 12:27:44 | 000,002,560 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2013.04.21 12:23:56 | 000,011,453 | ---- | M] () -- C:\Windows\ChangeLang_Done.tag
[2013.04.21 03:39:58 | 000,001,155 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.04.21 03:22:56 | 000,001,970 | ---- | M] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk
[2013.04.21 03:21:26 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013.04.21 03:21:26 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2013.04.21 03:01:17 | 000,001,870 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.04.21 02:40:57 | 000,015,072 | ---- | M] () -- C:\Windows\SysNative\results.xml
[2013.04.21 02:39:21 | 000,000,003 | ---- | M] () -- C:\Windows\SysNative\PLD_Framework.cmd
 
========== Files Created - No Company Name ==========
 
[2013.05.04 08:48:05 | 000,001,022 | ---- | C] () -- C:\Users\Public\Desktop\PDF-Viewer.lnk
[2013.04.21 18:45:11 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.04.21 18:21:54 | 000,001,114 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013.04.21 18:21:54 | 000,001,077 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
[2013.04.21 18:20:24 | 000,001,977 | ---- | C] () -- C:\Users\Martin\Desktop\Update Checker.lnk
[2013.04.21 17:30:42 | 000,000,000 | ---- | C] () -- C:\Windows\topsecret.INI
[2013.04.21 17:22:52 | 000,002,051 | ---- | C] () -- C:\Users\Public\Desktop\G Data TotalProtection 2014.lnk
[2013.04.21 17:22:48 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_gddcd64_01007.Wdf
[2013.04.21 16:51:11 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.04.21 16:51:11 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.04.21 12:31:07 | 000,011,453 | ---- | C] () -- C:\Windows\ChangeLang_Done.tag
[2013.04.21 12:28:42 | 000,653,928 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat
[2013.04.21 12:28:42 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat
[2013.04.21 12:28:42 | 000,129,800 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat
[2013.04.21 12:28:42 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat
[2013.04.21 12:25:55 | 000,347,904 | ---- | C] () -- C:\Windows\SysNative\systemsf.ebd
[2013.04.21 12:24:45 | 000,010,429 | ---- | C] () -- C:\Windows\SysNative\ScavengeSpace.xml
[2013.04.21 12:24:39 | 000,105,559 | ---- | C] () -- C:\Windows\SysWow64\RacRules.xml
[2013.04.21 12:24:39 | 000,105,559 | ---- | C] () -- C:\Windows\SysNative\RacRules.xml
[2013.04.21 12:24:06 | 000,001,041 | ---- | C] () -- C:\Windows\SysWow64\tcpbidi.xml
[2013.04.21 11:39:45 | 000,000,388 | ---- | C] () -- C:\Windows\tasks\Acer Registration - Reminder Recall task.job
[2013.04.21 05:13:53 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.04.21 04:55:49 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.04.21 03:39:58 | 000,001,155 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013.04.21 03:24:23 | 000,001,417 | ---- | C] () -- C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.04.21 03:22:56 | 000,001,970 | ---- | C] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk
[2013.04.21 02:40:57 | 000,015,072 | ---- | C] () -- C:\Windows\SysNative\results.xml
[2013.04.21 02:39:21 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\PLD_Framework.cmd
[2013.04.21 02:32:30 | 3193,835,520 | -HS- | C] () -- C:\hiberfil.sys
[2010.08.28 06:23:14 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.04.21 03:24:34 | 000,000,000 | ---D | M] -- C:\Users\Martin\AppData\Roaming\OEM
 
========== Purity Check ==========
 
 

< End of report >

OTL Extra:

Code:
OTL Extras logfile created on: 10.05.2013 22:04:41 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Internet\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,97 Gb Total Physical Memory | 2,58 Gb Available Physical Memory | 65,00% Memory free
7,93 Gb Paging File | 6,05 Gb Available in Paging File | 76,24% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 224,04 Gb Total Space | 186,69 Gb Free Space | 83,33% Space Free | Partition Type: NTFS
Drive D: | 224,04 Gb Total Space | 216,20 Gb Free Space | 96,50% Space Free | Partition Type: NTFS
Drive E: | 1,06 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: MARTIN-PC | User Name: Martin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{019A2060-02E0-4128-807F-37E7BAAFCB7D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{03277C73-6852-4BC5-BCED-5B945A1AB744}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{148F8980-10BC-4F52-9FE8-2753DCF21CE8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1B33E476-F654-4B48-987C-383500A8CFCC}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1C2BCB95-08CC-4B27-AB74-4AAD39173FF6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{228A4579-E80B-4BF7-8188-0DE006389AEF}" = rport=137 | protocol=17 | dir=out | app=system |
"{265C07B7-D653-4E3D-91FF-3D50A10EA7EB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2C61C3B5-5A92-47D3-BB21-D64A219D3BC4}" = lport=137 | protocol=17 | dir=in | app=system |
"{49F09E00-548A-4BB6-A4B2-93EAB4A316B7}" = rport=139 | protocol=6 | dir=out | app=system |
"{59A3A510-43E5-4A1A-891F-D33B144DFF5F}" = rport=138 | protocol=17 | dir=out | app=system |
"{6B0A24CA-7670-496F-8306-C104F2AC566D}" = rport=445 | protocol=6 | dir=out | app=system |
"{7BD18FC9-4253-466A-A583-28C9C4EBABA0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7DEA0333-938A-42C4-8F62-17A1B83DCB03}" = lport=10243 | protocol=6 | dir=in | app=system |
"{93395AA6-94CA-4536-AD5E-214D4EBA3A19}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BDAD63F7-BC4E-411D-871C-39EB79B853DE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C249E02E-36B1-4054-9787-DB1AB8467147}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{C2E1B2E7-3DBF-4A2D-B014-27ABDB26D878}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C60CC74D-07C9-4674-9438-48A49933EEB4}" = lport=445 | protocol=6 | dir=in | app=system |
"{DB641C6B-A873-4BCF-8355-1A0092A63135}" = lport=139 | protocol=6 | dir=in | app=system |
"{EE98BD63-3C4F-4D71-BA93-A541CE2BA6DA}" = lport=138 | protocol=17 | dir=in | app=system |
"{F2987DE0-713C-4974-B3E8-C05CD22B99E8}" = rport=10243 | protocol=6 | dir=out | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2327B0A5-5F9A-4FB7-9F74-CEF154C2A8D7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{2E842335-7AE0-4AFB-ABE1-53D9C626FBB1}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\arcade movie\touchmovieservice.exe |
"{34689E09-D6EF-4BD2-B3E8-9C331ED565EC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3A48BAA2-E684-4333-BF77-3B3282A2E4F9}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3D856D4A-9034-4886-9B2F-AA22BB678685}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{43F4EA1F-17C6-491B-BCC7-B72729D5A782}" = protocol=58 | dir=in | app=system |
"{47C838AA-885C-4469-8393-A626FCA0258E}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5B152E52-E840-4857-827F-714491339A2D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{61607445-372A-44FA-8827-10396502A70F}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{62E1F38F-9A59-4D62-8FE1-067E49171444}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{64C116D8-C1FB-4F87-95E7-55F55D6012F3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6FB26C2A-9E09-4F38-B8A1-4333A93D11B0}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\acer arcade deluxe\clmlsvc.exe |
"{776A121E-78E4-40E1-B2B8-C019EE519ED1}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{7ED87DF8-C32D-4560-BEF4-DF014DDE894F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{87A1EBA2-47C4-4EB2-A724-42CF14841D77}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8B41C3EA-876A-4CA3-B035-75FCD27AD1B7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8F90F2A9-5F2D-45DC-BA44-D4C764501F13}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9E06CFD5-E241-4591-943B-7D9B3C9BF763}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{A669EF70-41AC-4B06-860C-3A633D95C002}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A9CEBD7B-B7A1-4323-991C-DB73688855D7}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\homemedia\homemedia.exe |
"{BA69BE19-5144-41CD-9770-57B73A0CDC73}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BD01FFD6-8136-4C7A-9F06-20648D5AFDAB}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\arcade movie\touchmovie.exe |
"{BDE83D4D-A455-49FE-B012-95B1E6C745D0}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{CBF888E0-2FCC-47F5-A4C3-E5592372E582}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D984E455-D375-458F-808B-940BEB7841B1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DF363D15-C8AD-4AFC-A486-C000216442F5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E117F83F-2EE2-47D5-9F7E-1B726C3BBDEB}" = protocol=6 | dir=out | app=system |
"{E2ADB75A-1DED-46E4-95A7-CF52DEF98014}" = dir=in | app=c:\program files (x86)\acer arcade deluxe\acer arcade deluxe\arcadedeluxeagent.exe |
"{E65CAE7F-5C50-4B6E-9949-5D44FEFF5773}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{4968622A-4D3F-489E-9ACE-5FEC4CC0BDE3}" = MediaShow Espresso
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{63DEADD1-C032-4F1F-AF76-26B166D6AC30}" = G Data TotalProtection 2014
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{B906C11A-D193-4143-9FA7-E2EE8A5A8F21}" = Acer Arcade Movie
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ESET Online Scanner" = ESET Online Scanner v3
"FileHippo.com" = FileHippo.com Update Checker
"Hotkey Utility" = Hotkey Utility
"Identity Card" = Identity Card
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Secunia PSI" = Secunia PSI (3.0.0.6005)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.04.2013 07:10:01 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:07 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:08 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:08 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:08 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:08 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:08 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:08 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:08 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
Error - 21.04.2013 07:10:10 | Computer Name = Martin-PC | Source = .NET Runtime Optimization Service | ID = 1101
Description =
 
[ System Events ]
Error - 24.04.2013 17:32:53 | Computer Name = Martin-PC | Source = DCOM | ID = 10010
Description =
 
Error - 27.04.2013 12:50:57 | Computer Name = Martin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597
 (Definition 1.149.649.0)
 
Error - 27.04.2013 14:05:13 | Computer Name = Martin-PC | Source = DCOM | ID = 10010
Description =
 
Error - 27.04.2013 16:50:49 | Computer Name = Martin-PC | Source = DCOM | ID = 10010
Description =
 
Error - 28.04.2013 15:26:22 | Computer Name = Martin-PC | Source = Microsoft-Windows-BitLocker-Driver | ID = 24620
Description = Überprüfung des verschlüsselten Volumes: Die Volumeinformationen auf
 "G:" können nicht gelesen werden.
 
Error - 29.04.2013 11:21:20 | Computer Name = Martin-PC | Source = Microsoft-Windows-BitLocker-Driver | ID = 24620
Description = Überprüfung des verschlüsselten Volumes: Die Volumeinformationen auf
 "G:" können nicht gelesen werden.
 
Error - 29.04.2013 13:50:01 | Computer Name = Martin-PC | Source = DCOM | ID = 10010
Description =
 
Error - 29.04.2013 13:50:56 | Computer Name = Martin-PC | Source = DCOM | ID = 10010
Description =
 
Error - 30.04.2013 14:39:08 | Computer Name = Martin-PC | Source = DCOM | ID = 10010
Description =
 
Error - 30.04.2013 14:39:27 | Computer Name = Martin-PC | Source = Microsoft-Windows-BitLocker-Driver | ID = 24620
Description = Überprüfung des verschlüsselten Volumes: Die Volumeinformationen auf
 "G:" können nicht gelesen werden.
 
 
< End of report >
Vielen dank im Voraus für die Hilfe

t'john 11.05.2013 11:21
:hallo:

dieser Fund ist harmlos.

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

Scott1980 11.05.2013 13:57
Hallo t`john,

als erstes vielen Dank für deine Hilfe.


Code:
dieser Fund ist harmlos.
Das hört sich doch schon mal gut an:singsing:


Hier das gewünsche Log:

Code:
Results of screen317's Security Check version 0.99.63 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````
G Data TotalProtection 2014 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Secunia PSI (3.0.0.6005) 
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 Java 7 Update 21 
 Adobe Flash Player 11.7.700.169 
 Mozilla Firefox (20.0.1)
````````Process Check: objlist.exe by Laurent```````` 
 G Data TotalProtection Firewall GDFwSvcx64.exe
 G Data TotalProtection Firewall GDFirewallTray.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

Gruß Scott1980

t'john 12.05.2013 11:48
Alles Bestens :)

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
http://www.trojaner-board.de/109844-...ren-seite.html
PC wird immer langsamer - was tun?

Scott1980 12.05.2013 17:08
Hallo t´john.

kann ich die Datei einfach löschen?

Gruß

Scott1980

t'john 12.05.2013 20:11
ja, oder mit Temp File Cleaner - Download - Filepony den temp-Speicher loeschen lassen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:20 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19