Trojaner-Board - Onlinebanking Attacke...Trojan.Zbot.FV

Hier nun die log. Files:

OTL
OTL Logfile:

Code:

OTL logfile created on: 04.06.2013 09:27:48 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Darek\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,37 Gb Available Physical Memory | 68,50% Memory free

4,00 Gb Paging File | 2,99 Gb Available in Paging File | 74,77% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 111,79 Gb Total Space | 50,42 Gb Free Space | 45,10% Space Free | Partition Type: NTFS

 

Computer Name: DAREK-PC | User Name: Darek | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.06.04 09:26:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Darek\Desktop\OTL.exe

PRC - [2013.05.25 02:47:30 | 027,776,968 | ---- | M] (Dropbox, Inc.) -- C:\Users\Darek\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2013.05.16 10:56:34 | 001,033,688 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe

PRC - [2013.05.16 10:56:30 | 001,817,560 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe

PRC - [2013.05.15 13:21:32 | 000,171,928 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe

PRC - [2012.11.30 04:55:25 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2012.11.23 04:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2012.04.26 02:42:36 | 007,773,184 | R--- | M] (cv cryptovision GmbH) -- C:\Programme\cv cryptovision\cv act sc interface\RegisterTool.exe

PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.04.01 05:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe

PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe

PRC - [2010.10.08 07:18:42 | 000,726,288 | ---- | M] () -- C:\Programme\ShrewSoft\VPN Client\iked.exe

PRC - [2010.10.08 07:18:42 | 000,541,968 | ---- | M] () -- C:\Programme\ShrewSoft\VPN Client\ipsecd.exe

PRC - [2010.10.08 07:18:42 | 000,054,544 | ---- | M] () -- C:\Programme\ShrewSoft\VPN Client\dtpd.exe

PRC - [2007.09.15 02:29:10 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPStart.exe

PRC - [2007.02.06 11:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Dropbox\bin\libcef.dll

MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

 

 
 ========== Services (SafeList) ==========

 

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDWSCService)

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService)

SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService)

SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2013.02.10 16:08:00 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.04.01 05:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)

SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2010.10.08 07:18:42 | 000,726,288 | ---- | M] () [Auto | Running] -- C:\Programme\ShrewSoft\VPN Client\iked.exe -- (iked)

SRV - [2010.10.08 07:18:42 | 000,541,968 | ---- | M] () [Auto | Running] -- C:\Programme\ShrewSoft\VPN Client\ipsecd.exe -- (ipsecd)

SRV - [2010.10.08 07:18:42 | 000,054,544 | ---- | M] () [Auto | Running] -- C:\Programme\ShrewSoft\VPN Client\dtpd.exe -- (dtpd)

SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.02.06 11:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)

SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012.08.30 09:52:28 | 000,969,192 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)

DRV - [2012.08.23 16:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV - [2012.08.23 16:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2011.11.22 15:36:37 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2011.09.07 10:18:26 | 000,059,776 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SCR3XX2K.sys -- (SCR3XX2K)

DRV - [2011.07.21 12:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.07.21 12:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.05.13 18:57:42 | 000,025,656 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)

DRV - [2011.05.13 18:57:20 | 000,035,896 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)

DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.11.10 04:49:50 | 004,323,040 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)

DRV - [2010.11.10 04:48:12 | 000,283,744 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)

DRV - [2010.09.02 09:18:48 | 000,017,920 | ---- | M] (Shrew Soft Inc) [Kernel | System | Running] -- C:\Windows\System32\drivers\vfilter.sys -- (vflt)

DRV - [2010.09.02 09:18:48 | 000,013,824 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\virtualnet.sys -- (vnet)

DRV - [2010.02.25 00:02:30 | 000,015,544 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBTTN.sys -- (HBtnKey)

DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.07.14 01:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)

DRV - [2009.07.14 00:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32)

DRV - [2009.04.29 07:46:54 | 000,015,872 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)

DRV - [2007.12.14 09:21:56 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)

DRV - [2007.05.09 13:27:00 | 000,097,280 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\gtipci21.sys -- (GTIPCI21)

DRV - [2007.04.25 13:32:42 | 000,031,232 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirda.sys -- (SMSCIRDA)

DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2005.09.23 23:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.00000&barid={4C5DD3C3-5828-11E2-9AFC-001A6B1F5AEC}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E6 BC 3F F5 44 71 CC 01  [binary data]

IE - HKCU\..\URLSearchHook:  - No CLSID value found

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:21320

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.selectedEngine: "SweetIM Search"

FF - prefs.js..browser.startup.homepage: "hxxp://home.sweetim.com/?crg=3.1010000.00000&barid={4C5DD3C3-5828-11E2-9AFC-001A6B1F5AEC}"

FF - prefs.js..extensions.enabledAddons: %7BEEE6C361-6118-11DC-9C72-001320C79847%7D:1.9.0.0

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1

FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?barid={4C5DD3C3-5828-11E2-9AFC-001A6B1F5AEC}&src=2&crg=3.1010000.00000&q="

FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""

FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll ()

FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Darek\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\ [2012.12.03 16:39:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.10 16:08:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.10 16:08:00 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

 

[2012.08.10 16:22:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darek\AppData\Roaming\mozilla\Extensions

[2013.02.10 15:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darek\AppData\Roaming\mozilla\Firefox\Profiles\b9z6hqum.default\extensions

[2013.02.10 15:37:17 | 000,190,000 | ---- | M] () (No name found) -- C:\Users\Darek\AppData\Roaming\mozilla\firefox\profiles\b9z6hqum.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

[2013.02.10 16:07:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2013.02.10 16:08:00 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2013.05.05 10:52:35 | 000,001,400 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2013.05.05 10:52:35 | 000,001,679 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2013.05.05 10:52:35 | 000,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2013.05.05 10:52:35 | 000,006,818 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2013.01.06 19:41:08 | 000,001,280 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2013.05.05 10:52:35 | 000,000,903 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)

O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)

O4 - Startup: C:\Users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Darek\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O8 - Extra context menu item: Free YouTube Download - C:\Users\Darek\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Darek\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O13 - gopher Prefix: missing

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{621C173D-EF55-4C2E-959F-C9E377AA2086}: NameServer = 134.147.32.40,134.147.222.4

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BD5806D1-464E-48E7-B20D-396EBB500733}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found

O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{6dfd70ec-143d-11e1-af92-001a6b1f5aec}\Shell - "" = AutoRun

O33 - MountPoints2\{6dfd70ec-143d-11e1-af92-001a6b1f5aec}\Shell\AutoRun\command - "" = F:\setup.exe

O33 - MountPoints2\{871ed10e-9e68-11e1-a066-001a6b1f5aec}\Shell - "" = AutoRun

O33 - MountPoints2\{871ed10e-9e68-11e1-a066-001a6b1f5aec}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\start.html

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.06.04 09:26:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Darek\Desktop\OTL.exe

[2013.06.03 19:46:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2013.06.03 19:46:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2

[2013.06.03 19:45:53 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\Windows\System32\sdnclean.exe

[2013.06.03 19:45:38 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2

[2013.06.03 17:05:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.06.03 17:05:41 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2013.06.03 17:05:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2013.06.03 17:05:17 | 036,271,144 | ---- | C] (Safer-Networking Ltd.                                       ) -- C:\Users\Darek\Desktop\spybot-2.1.exe

[2013.06.02 13:41:55 | 000,000,000 | ---D | C] -- C:\Users\Darek\Desktop\sd karte

[2013.06.02 13:11:29 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Maampa

[2013.06.02 13:11:29 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Emxe

[2013.06.02 13:11:29 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Caegx

[2013.05.23 15:59:32 | 000,000,000 | -HSD | C] -- C:\Users\Darek\AppData\Local\ms-drivers

[2013.05.23 15:59:25 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Local\MetaGeek,_LLC

[2013.05.23 15:58:52 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MetaGeek

[2013.05.23 15:58:52 | 000,000,000 | ---D | C] -- C:\Program Files\MetaGeek

[2013.05.23 11:29:52 | 000,000,000 | ---D | C] -- C:\Users\Darek\Desktop\vpn

[2013.05.23 11:00:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client

[2013.05.23 10:59:09 | 000,000,000 | ---D | C] -- C:\Users\Darek\Documents\Shrew Soft VPN

[2013.05.23 10:59:07 | 000,000,000 | ---D | C] -- C:\Program Files\ShrewSoft

[2013.05.22 16:43:11 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco Systems

[2013.05.17 17:01:44 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Local\Unity

[2013.05.07 14:53:09 | 000,000,000 | ---D | C] -- C:\Users\Darek\Documents\barcelona

[2013.05.05 10:52:34 | 000,000,000 | ---D | C] -- C:\Windows\System32\IO

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[1 C:\Users\Darek\*.tmp files -> C:\Users\Darek\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.06.04 09:26:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Darek\Desktop\OTL.exe

[2013.06.04 09:24:27 | 000,000,000 | ---- | M] () -- C:\Users\Darek\defogger_reenable

[2013.06.04 09:23:55 | 000,050,477 | ---- | M] () -- C:\Users\Darek\Desktop\Defogger.exe

[2013.06.04 09:19:36 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.06.04 09:19:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.06.03 19:51:43 | 000,014,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.06.03 19:51:43 | 000,014,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.06.03 19:44:09 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.06.03 19:43:00 | 1610,162,176 | -HS- | M] () -- C:\hiberfil.sys

[2013.06.03 17:06:02 | 036,271,144 | ---- | M] (Safer-Networking Ltd.                                       ) -- C:\Users\Darek\Desktop\spybot-2.1.exe

[2013.06.03 17:05:47 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.06.03 15:36:02 | 000,654,400 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2013.06.03 15:36:02 | 000,616,242 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2013.06.03 15:36:02 | 000,130,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2013.06.03 15:36:02 | 000,106,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2013.06.02 16:36:44 | 000,001,049 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2013.05.23 15:59:32 | 000,000,037 | -HS- | M] () -- C:\Users\Darek\AppData\Local\70149b02515b3bb20dd492.47983420

[2013.05.23 10:58:41 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF

[2013.05.23 10:41:06 | 000,001,594 | ---- | M] () -- C:\Windows\VPNInstall.MIF

[2013.05.16 10:39:57 | 000,407,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2013.05.13 22:16:24 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[1 C:\Users\Darek\*.tmp files -> C:\Users\Darek\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.06.04 09:24:27 | 000,000,000 | ---- | C] () -- C:\Users\Darek\defogger_reenable

[2013.06.04 09:23:55 | 000,050,477 | ---- | C] () -- C:\Users\Darek\Desktop\Defogger.exe

[2013.06.03 19:53:24 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys

[2013.06.03 19:46:00 | 000,002,135 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk

[2013.06.03 17:05:47 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.05.23 15:59:32 | 000,000,037 | -HS- | C] () -- C:\Users\Darek\AppData\Local\70149b02515b3bb20dd492.47983420

[2013.05.23 10:35:34 | 000,001,594 | ---- | C] () -- C:\Windows\VPNUnInstall.MIF

[2013.05.22 16:42:44 | 000,001,594 | ---- | C] () -- C:\Windows\VPNInstall.MIF

[2013.01.29 14:28:59 | 000,023,934 | ---- | C] () -- C:\Users\Darek\.recently-used.xbel

[2013.01.01 22:24:00 | 000,047,104 | ---- | C] () -- C:\Windows\System32\KMVIDC32.DLL

[2011.11.15 23:28:34 | 000,001,471 | ---- | C] () -- C:\Users\Darek\AppData\Local\RecConfig.xml

[2011.09.22 23:38:02 | 000,011,264 | ---- | C] () -- C:\Users\Darek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.09.22 23:31:32 | 000,000,000 | ---- | C] () -- C:\Windows\Graffiti5.2Pin.ini

[2011.09.22 23:31:31 | 000,237,568 | R--- | C] () -- C:\Windows\System32\qtmlClient.dll

[2011.09.22 23:25:18 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll

[2011.09.22 23:23:11 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll

[2011.09.21 12:29:45 | 000,000,017 | ---- | C] () -- C:\Users\Darek\AppData\Local\resmon.resmoncfg

[2011.09.19 10:24:01 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2013.06.03 19:42:56 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Caegx

[2012.06.14 16:15:05 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Canon

[2011.11.22 15:37:58 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DAEMON Tools Lite

[2012.07.02 10:39:35 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DelinvFile

[2013.01.06 19:41:05 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DesktopIconForAmazon

[2013.06.03 19:48:11 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Dropbox

[2012.12.03 16:40:02 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DVDVideoSoft

[2012.12.03 16:13:34 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DVDVideoSoftIEHelpers

[2013.06.03 17:44:54 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Emxe

[2013.01.29 14:28:59 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\gtk-2.0

[2011.09.15 14:29:35 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Leadertech

[2013.06.02 13:11:29 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Maampa

[2013.01.06 19:41:02 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\OCS

[2013.01.06 19:41:09 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Opera

[2012.06.14 16:19:32 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\PanoramaStudio2Pro

[2011.09.22 23:31:42 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\proDAD

[2011.09.22 23:36:45 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\XMedia Recode

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

EXTRASOTL Logfile:

Code:

OTL Extras logfile created on: 04.06.2013 09:27:48 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Darek\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,37 Gb Available Physical Memory | 68,50% Memory free

4,00 Gb Paging File | 2,99 Gb Available in Paging File | 74,77% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 111,79 Gb Total Space | 50,42 Gb Free Space | 45,10% Space Free | Partition Type: NTFS

 

Computer Name: DAREK-PC | User Name: Darek | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)

"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)

"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)

"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0722BCA5-763B-4993-A91A-C4CE5E7246FC}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{0A0D217B-C15C-42AF-B902-07E6EE7BDE1F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{1EB6AF37-31B2-466B-BAE5-ACCADF32BEE1}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{2F28F502-2370-4C5E-8607-2B429ED934BC}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{39147099-85B0-4682-ABD8-DC0A545FC391}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{4B50D8EF-4C2B-4E14-851F-9851299CDE93}" = rport=138 | protocol=17 | dir=out | app=system | 

"{4BFB77CB-97B0-4DFE-A92B-20ACF94DC7F4}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{4CFF60B2-BD99-48BE-996E-DE930D7A152D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{50AD7090-5DD1-4E55-B39B-D152E7B636D0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{5DCB6D03-80F3-4474-B3E8-9F547D96683C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{60B23E9B-71C9-4D34-9549-F771FB752C68}" = rport=137 | protocol=17 | dir=out | app=system | 

"{62181CDA-E3E0-4F30-AFB3-988E3D622741}" = lport=445 | protocol=6 | dir=in | app=system | 

"{63CDBE36-5CDC-42BA-9312-FCE401AE5987}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

"{6F3880EB-F640-4759-9F2E-E354A69EF7F3}" = rport=139 | protocol=6 | dir=out | app=system | 

"{7014E76B-B98F-4894-99BF-A1A185A7DAAB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{75554D5C-9276-45EB-940C-1783A5EC120E}" = rport=445 | protocol=6 | dir=out | app=system | 

"{8EC81F29-91CE-4AC3-929E-791150C82325}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{8FC36885-905D-48D8-B026-0AC1D74B6AC1}" = rport=2869 | protocol=6 | dir=out | app=system | 

"{A583DE59-EE25-48FD-9F14-8EEAA4C94B2E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{A5D4E555-5DA8-469F-9B1D-C307D98D7217}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{ACBEBE94-850B-458B-A051-58B653659450}" = lport=139 | protocol=6 | dir=in | app=system | 

"{BFEE12CA-0B81-45AA-B46A-A657EA55E89C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{C13EA0D6-E414-424C-A7A0-5E29BF1B6E9B}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{C3793A94-E390-4AB1-A3B4-E666D55CE477}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{C5A99A85-8E94-4290-8E46-7D4F13BFA107}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{C60A0179-B476-4C33-B29D-4CE0F0213B18}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{D0DEA240-4770-42BF-96A7-8F63BA27F79D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{DC42213E-F01C-4078-AE2C-6CEE9DE7C163}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{DE29565A-F191-49FB-A88A-29A2C3930503}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{DF9060D5-BEE3-48A7-ABFB-9B4E87B1C746}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{E159CBF8-3D21-42F1-9375-F93A1E8FF803}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{E38FC8A9-AACC-4BF7-A26E-09205B0CDE1C}" = lport=137 | protocol=17 | dir=in | app=system | 

"{ED7D9C53-A108-4F05-B5CA-66348E738052}" = lport=138 | protocol=17 | dir=in | app=system | 

"{F05077A8-14A0-441C-A1B8-C0EC214F4A7D}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{F148F63C-F3E7-4BA1-9033-0ABEC58E16D7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{F570F6C9-6EF3-47A7-83BA-A83FE826600D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{F5DF18D6-A833-498F-913C-55E688FD71A0}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{F841264B-2CDD-4E8C-B982-4633E8F7021A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{FA46007E-678E-4E8A-A39A-AD0340558175}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{FAF92E1A-4E85-490C-AC34-470B9E4E7EE0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

"{FB8D31BF-172B-4A23-8406-764DE19B2AA9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{011B9467-6DE8-4E83-9F29-709D46E35FB9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{06C48407-753C-4E94-87B1-AF336679E5F1}" = protocol=6 | dir=in | app=c:\program files\veetle\player\veetlenet.exe | 

"{0818DE50-D15A-44F1-BBFF-79848A630A1A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{1FD1F680-32AC-40D0-B971-E74DB01E8FB3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{221EC729-873C-4A1D-AFA7-F4422A276D60}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{27BCB666-64DF-49B6-A916-59786F744898}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{29EBF177-33A9-4E30-98D6-2A9FD61F217C}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe | 

"{3752F5ED-8757-4703-AF5D-6A6CA269C63B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{3AE100B7-CCC6-42EA-A19A-E4C7EB33FCB5}" = protocol=17 | dir=in | app=c:\program files\pinnacle\studio 12\programs\studio.exe | 

"{46B01B7E-B260-4CF4-AF5F-161FBC0F7240}" = protocol=6 | dir=out | app=system | 

"{48A04795-8967-436E-B5AC-09865114F222}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{48A79566-789A-43AB-970E-D4211E9D535B}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | 

"{4EB8ABB0-9FAF-4691-83B4-8711C230BEEC}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe | 

"{5360CE5E-84D4-499F-AF34-D7FB89C48E64}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{549B7A8C-7426-4F1B-8466-9ACEA4FAC005}" = protocol=17 | dir=in | app=c:\program files\pinnacle\studio 12\programs\umi.exe | 

"{559A1B1F-19BC-4E39-94FA-DA980C1204A7}" = protocol=17 | dir=in | app=c:\program files\pinnacle\studio 12\programs\rm.exe | 

"{65ABF1D4-75D2-40F8-9244-0B74DA2B71C5}" = protocol=6 | dir=in | app=c:\users\darek\appdata\roaming\dropbox\bin\dropbox.exe | 

"{67084780-CF44-425B-B019-1D8A1E88E486}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 

"{720B91D8-FAE6-4A17-BC99-00C95CE5EEF1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{781D0720-1E24-44CD-AFCD-83E5B65E88C6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{7AF35E94-5DA8-4EA2-B5A7-47BB5467F035}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{8785D7E8-6880-4BB1-84B6-7AEF1B11F3EF}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 

"{A2A630F0-5027-46F1-8844-3C6B49A58309}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{A47D4B54-0158-4A09-B033-39E02A8576E5}" = protocol=6 | dir=in | app=c:\program files\pinnacle\studio 12\programs\rm.exe | 

"{A647A064-203D-46FE-9C31-B783488CB2B8}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe | 

"{AABCFF44-0C7F-4AA6-8153-098DFEBBD89F}" = protocol=6 | dir=in | app=c:\program files\pinnacle\studio 12\programs\umi.exe | 

"{ADBB50E5-A42F-4F88-BD25-EDFA18AA6A8F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{C51E4467-8AAC-470A-8BB5-0076E046F7E7}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 

"{CCCC2261-B1B4-4BEB-BBBD-84EB02053D72}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{E06C76E5-E3A2-437D-A883-C06B39DCF0FA}" = protocol=6 | dir=in | app=c:\program files\pinnacle\studio 12\programs\studio.exe | 

"{E8AA90BA-E381-47AF-8549-848C00F881A0}" = protocol=17 | dir=in | app=c:\users\darek\appdata\roaming\dropbox\bin\dropbox.exe | 

"{EA1911E2-99F6-4BCD-9197-CA7AF9A96F47}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{ECBFD245-EA70-4F92-BA73-E3DF47445F93}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{F00F4FF1-7489-4067-BB00-816E7A31A206}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{F5E928CD-B430-4CF3-9037-240981A1731E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"TCP Query User{803943E3-FF87-4EBC-AF90-7E16B98A1FFF}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"TCP Query User{82B6CB58-CF09-4EDA-B640-A07FAA82C32F}C:\team17\worms2\frontend.exe" = protocol=6 | dir=in | app=c:\team17\worms2\frontend.exe | 

"TCP Query User{F2C7E2ED-3F41-44CB-B500-498B1AD08694}C:\users\darek\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\darek\appdata\roaming\dropbox\bin\dropbox.exe | 

"TCP Query User{FBF4834A-B747-40E5-884F-AAC02693396D}C:\program files\icq7.6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe | 

"UDP Query User{619C1EA3-1945-4F86-9A1C-EF20D9279FB5}C:\users\darek\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\darek\appdata\roaming\dropbox\bin\dropbox.exe | 

"UDP Query User{73614E05-77EA-4952-AF9B-FDAAD4FC542D}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"UDP Query User{B4ACD768-6E37-4A54-B9BB-F5B2D28B829D}C:\team17\worms2\frontend.exe" = protocol=17 | dir=in | app=c:\team17\worms2\frontend.exe | 

"UDP Query User{CB65368B-584E-472E-B54E-816B31508E3B}C:\program files\icq7.6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi

"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main

"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter

"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin

"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}" = PDF-XChange Viewer

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT

"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{52D327DE-65B5-48A4-9503-F65B047F5B85}" = cv act sc/interface - User Edition

"{5EB90C06-964F-4195-B83E-BD7E55C88415}" = Pinnacle Video Treiber

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection

"{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = TIPCI

"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 5.4.0

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher

"{859D6A3D-EF79-44DA-9A3B-332B5D872964}" = cv act sc/interface 5.0.4 - user edition

"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AE59E1E9-3392-4E17-A7EC-CCACFBBFFDB8}" = RuckZuck

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}" = Internet Explorer Toolbar 4.6 by SweetPacks

"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant

"{CDF246AE-C6E3-438F-AA76-21700DCC15F6}" = inSSIDer 3

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{D041EB9E-890A-4098-8F94-51DA194AC72A}" = Pinnacle Studio 12

"{D1860E6E-520E-4380-8433-E58E8F88B473}" = Pinnacle Studio 12 Ultimate Plugins

"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{E6C44758-FF49-47D1-8182-65E3818ACE23}" = AuthenTec TrueSuite

"{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}" = Update Manager for SweetPacks 1.1

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10

"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F1D7AC58-554A-4A58-B784-B61558B1449A}" = QLBCASL

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook

"7-Zip" = 7-Zip 9.20

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"Brutal Chess" = Brutal Chess

"DAEMON Tools Lite" = DAEMON Tools Lite

"DelinvFile_is1" = DelinvFile - 4.04

"DesktopIconAmazon" = Desktop Icon für Amazon

"ENTERPRISE" = Microsoft Office Enterprise 2007

"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20

"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1

"Free YouTube Download_is1" = Free YouTube Download version 3.1.41.1201

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.36.1201

"InstallShield_{767B964C-D9B4-422D-802B-F7ACBE2D310A}" = Texas Instruments PCIxx21/x515/xx12 drivers.

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"PhotoStitch" = Canon Utilities PhotoStitch

"proDAD-Vitascene-1.0" = proDAD Vitascene 1.0

"RuckZuck 4.0" = RuckZuck 4.0

"Shrew Soft VPN Client" = Shrew Soft VPN Client

"ST6UNST #1" = FEMBEAM 1.43

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"Veetle TV" = Veetle TV

"VLC media player" = VLC media player 1.1.11

"WinGimp-2.0_is1" = GIMP 2.6.11

"WinLiveSuite" = Windows Live Essentials

"Worms2" = Worms2

"XMedia Recode" = XMedia Recode 3.0.2.5

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)

"UnityWebPlayer" = Unity Web Player

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 13.05.2013 16:39:34 | Computer Name = Darek-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: Studio.exe, Version: 12.0.0.6163,

 Zeitstempel: 0x4829e7cd  Name des fehlerhaften Moduls: IMGEngine.dll, Version: 1.0.143.0,

 Zeitstempel: 0x4807d615  Ausnahmecode: 0xc0000090  Fehleroffset: 0x0002a29e  ID des fehlerhaften

 Prozesses: 0x3c38  Startzeit der fehlerhaften Anwendung: 0x01ce5016baa29cc9  Pfad der

 fehlerhaften Anwendung: C:\Program Files\Pinnacle\Studio 12\Programs\Studio.exe

Pfad

 des fehlerhaften Moduls: C:\Program Files\Pinnacle\Studio 12\Programs\IMGEngine.dll

Berichtskennung:

 37c19cb6-bc0d-11e2-bdc8-001a6b1f5aec

 

Error - 15.05.2013 17:27:53 | Computer Name = Darek-PC | Source = Application Hang | ID = 1002

Description = Programm iexplore.exe, Version 10.0.9200.16537 kann nicht mehr unter

 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 

in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem

 zu suchen.    Prozess-ID: 3588    Startzeit: 01ce51afd78446f2    Endzeit: 30    Anwendungspfad:

 C:\Program Files\Internet Explorer\iexplore.exe    Berichts-ID:   

 

Error - 22.05.2013 09:07:58 | Computer Name = Darek-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: jusched.exe, Version: 2.1.9.0, Zeitstempel:

 0x4ff31820  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:

 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00650628  ID des fehlerhaften Prozesses:

 0xf10  Startzeit der fehlerhaften Anwendung: 0x01ce5211226d932c  Pfad der fehlerhaften

 Anwendung: C:\Program Files\Common Files\Java\Java Update\jusched.exe  Pfad des fehlerhaften

 Moduls: unknown  Berichtskennung: 9f3f8ffa-c2e0-11e2-a5b2-001a6b1f5aec

 

Error - 23.05.2013 04:32:45 | Computer Name = Darek-PC | Source = MsiInstaller | ID = 1013

Description = 

 

Error - 23.05.2013 04:35:45 | Computer Name = Darek-PC | Source = MsiInstaller | ID = 1013

Description = 

 

Error - 23.05.2013 09:59:34 | Computer Name = Darek-PC | Source = .NET Runtime | ID = 1026

Description = 

 

Error - 23.05.2013 09:59:36 | Computer Name = Darek-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: inSSIDer.exe, Version: 3.0.6.42, 

Zeitstempel: 0x517a50eb  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015,

 Zeitstempel: 0x50b83b16  Ausnahmecode: 0xe0434352  Fehleroffset: 0x0000812f  ID des fehlerhaften

 Prozesses: 0x1030  Startzeit der fehlerhaften Anwendung: 0x01ce57bdbcf48f90  Pfad der

 fehlerhaften Anwendung: C:\Program Files\MetaGeek\inSSIDer 3\inSSIDer.exe  Pfad des

 fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll  Berichtskennung: 00628e3a-c3b1-11e2-95ee-001a6b1f5aec

 

Error - 27.05.2013 07:16:01 | Computer Name = Darek-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 10.0.9200.16576,

 Zeitstempel: 0x515e30fe  Name des fehlerhaften Moduls: Flash32_11_7_700_202.ocx, 

Version: 11.7.700.202, Zeitstempel: 0x51801f91  Ausnahmecode: 0xc0000005  Fehleroffset:

 0x00609d44  ID des fehlerhaften Prozesses: 0x1a7c  Startzeit der fehlerhaften Anwendung:

 0x01ce5acb3fca8308  Pfad der fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe

Pfad

 des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\Flash32_11_7_700_202.ocx

Berichtskennung:

 cfdad0f6-c6be-11e2-95ee-001a6b1f5aec

 

Error - 02.06.2013 07:40:56 | Computer Name = Darek-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: taskhost.exe, Version: 6.1.7601.18010,

 Zeitstempel: 0x50aee407  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,

 Zeitstempel: 0x4ec49b60  Ausnahmecode: 0xc0000374  Fehleroffset: 0x000c380b  ID des fehlerhaften

 Prozesses: 0x88c  Startzeit der fehlerhaften Anwendung: 0x01ce5f85e62763c6  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\taskhost.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: 491410cf-cb79-11e2-93c4-001a6b1f5aec

 

Error - 03.06.2013 09:29:31 | Computer Name = Darek-PC | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: taskhost.exe, Version: 6.1.7601.18010,

 Zeitstempel: 0x50aee407  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,

 Zeitstempel: 0x4ec49b60  Ausnahmecode: 0xc0000374  Fehleroffset: 0x000c380b  ID des fehlerhaften

 Prozesses: 0x900  Startzeit der fehlerhaften Anwendung: 0x01ce605e49b4adaa  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\taskhost.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: 9ed3b623-cc51-11e2-8ea8-001a6b1f5aec

 

[ System Events ]

Error - 02.06.2013 07:34:31 | Computer Name = Darek-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR6 gefunden.

 

Error - 02.06.2013 07:34:31 | Computer Name = Darek-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR6 gefunden.

 

Error - 02.06.2013 07:34:31 | Computer Name = Darek-PC | Source = Disk | ID = 262155

Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR6 gefunden.

 

Error - 03.06.2013 09:28:15 | Computer Name = Darek-PC | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?03.?06.?2013 um 15:27:06 unerwartet heruntergefahren.

 

Error - 03.06.2013 09:37:26 | Computer Name = Darek-PC | Source = Schannel | ID = 36874

Description = Eine SSL 3.0-Verbindungsanforderung wurde von einer Remoteclientanwendung

 übermittelt, jedoch werden keine der Verschlüsselungssammlungen, die von der Clientanwendung

 unterstützt werden, vom Server unterstützt. Fehler bei der SSL-Verbindungsanforderung.

 

Error - 03.06.2013 09:37:26 | Computer Name = Darek-PC | Source = Schannel | ID = 36888

Description = Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus

 lautet: 107.

 

Error - 03.06.2013 11:02:08 | Computer Name = Darek-PC | Source = ipnathlp | ID = 31004

Description = 

 

Error - 03.06.2013 13:47:35 | Computer Name = Darek-PC | Source = ipnathlp | ID = 31004

Description = 

 

Error - 04.06.2013 03:19:04 | Computer Name = Darek-PC | Source = ipnathlp | ID = 31004

Description = 

 

Error - 04.06.2013 03:20:42 | Computer Name = Darek-PC | Source = ipnathlp | ID = 31004

Description = 

 

 

< End of report >

--- --- ---

GMER

GMER Logfile:

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-06-04 10:31:16

Windows 6.1.7601 Service Pack 1 

Running: gmer_2.1.19163.exe; Driver: C:\Users\Darek\AppData\Local\Temp\ugloapow.sys
 
 

---- Registry - GMER 2.1 ----
 

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b1f5aec                                         

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b1f5aec@2cd2e7fb15a8                            0x14 0x3E 0x2C 0x73 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b1f5aec@68ebaef23f93                            0xA9 0x85 0xFC 0xEE ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b1f5aec@5c57c892fdf1                            0xF5 0xDF 0xCA 0xEE ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b1f5aec@9c4a7b72c181                            0x61 0x49 0x7F 0x50 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b1f5aec@fcc7343d5d11                            0x7C 0x2A 0x8A 0xB2 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b1f5aec@b0358d20967b                            0x31 0xA0 0x6E 0xD8 ...

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b1f5aec (not active ControlSet)                     

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b1f5aec@2cd2e7fb15a8                                0x14 0x3E 0x2C 0x73 ...

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b1f5aec@68ebaef23f93                                0xA9 0x85 0xFC 0xEE ...

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b1f5aec@5c57c892fdf1                                0xF5 0xDF 0xCA 0xEE ...

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b1f5aec@9c4a7b72c181                                0x61 0x49 0x7F 0x50 ...

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b1f5aec@fcc7343d5d11                                0x7C 0x2A 0x8A 0xB2 ...

Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b1f5aec@b0358d20967b                                0x31 0xA0 0x6E 0xD8 ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xC8 0x28 0x51 0xAF ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x46 0x47 0x15 0xB0 ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0x25 0xDA 0xEC 0x7E ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x86 0x8C 0x21 0x01 ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xF5 0x1D 0x4D 0x73 ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xDF 0x20 0x58 0x62 ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0x97 0x20 0x4E 0x9A ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0x01 0x3A 0x48 0xFC ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0xF6 0x0F 0x4E 0x58 ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0xB1 0xCD 0x45 0x5A ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0xE3 0x0E 0x66 0xD5 ...

Reg  HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                   

Reg  HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment

Reg  HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\Windows\system32\OLE32.DLL

Reg  HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0x6C 0x43 0x2D 0x1E ...
 

---- EOF - GMER 2.1 ----

--- --- ---

AdwCleaner Logfile:

Code:

# AdwCleaner v2.301 - Datei am 04/06/2013 um 15:06:56 erstellt

# Aktualisiert am 16/05/2013 von Xplode

# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)

# Benutzer : Darek - DAREK-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Darek\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\b9z6hqum.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

Ordner Gelöscht : C:\Program Files\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\Program Files\ICQ6Toolbar

Ordner Gelöscht : C:\Program Files\SweetIM

Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar

Ordner Gelöscht : C:\ProgramData\SweetIM

Ordner Gelöscht : C:\Users\Darek\AppData\Local\Temp\OCS

Ordner Gelöscht : C:\Users\Darek\AppData\Roaming\DesktopIconForAmazon

Ordner Gelöscht : C:\Users\Darek\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\b9z6hqum.default\SweetPacksToolbarData

Ordner Gelöscht : C:\Users\Darek\AppData\Roaming\OCS

Ordner Gelöscht : C:\Windows\Installer\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\9EE58E3C298524145B73CBBED3CAC4D3

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\EB6AF8AEEB922FA4392548F13812E50B

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\9EE58E3C298524145B73CBBED3CAC4D3

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\EB6AF8AEEB922FA4392548F13812E50B

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Babylon Client

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SweetPacks Communicator

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12BF94BD06C95F343A77631402B9556A

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2124D8A8CF720FD44866190AF560228E

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27A325ACED8CA4743A30127638591ADB

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\350D17402BD84234EAF7D32F08172D7C

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EE8C5F419057E1478A654868CEE60B5

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4735D908D66E1BA46B6C2D7185A12B2B

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\76D8378E2DDAED3428720A631F6E3BF0

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A001B259DB7D694E818BE29B973992C

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BAE2EC163C6A68A48921573E0E7E199D

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C06C6662FA5B04646829E4A460857770

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CEEB3E14ABE8270419B0FD762E18F7C6

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED1B5E9A3BDB51349BF96E842C062D98

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FECBC2BC14DA6CD459BD59A041709836

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9EE58E3C298524145B73CBBED3CAC4D3

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\EB6AF8AEEB922FA4392548F13812E50B

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16576
 

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com
 

-\\ Mozilla Firefox v15.0.1 (de)
 

Datei : C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\b9z6hqum.default\prefs.js
 

Gelöscht : user_pref("browser.newtab.url", "hxxp://home.sweetim.com/?src=97&barid={4C5DD3C3-5828-11E2-9AFC-001A[...]

Gelöscht : user_pref("browser.search.defaultenginename", "SweetIM Search");

Gelöscht : user_pref("browser.search.selectedEngine", "SweetIM Search");

Gelöscht : user_pref("browser.startup.homepage", "hxxp://home.sweetim.com/?crg=3.1010000.00000&barid={4C5DD3C3-[...]

Gelöscht : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?barid={4C5DD3C3-5828-11E2-9AFC-001A6B[...]

Gelöscht : user_pref("sweetim.toolbar.RevertDialog.enable", "false");

Gelöscht : user_pref("sweetim.toolbar.UserSelectedSaveSettings", "true");

Gelöscht : user_pref("sweetim.toolbar.Visibility.VisibilityGuardLastUnHide", "0");

Gelöscht : user_pref("sweetim.toolbar.Visibility.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.Visibility.intervaldays", "7");

Gelöscht : user_pref("sweetim.toolbar.cargo", "3.1010000.00000");

Gelöscht : user_pref("sweetim.toolbar.cda.DisableOveride.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.cda.HideOveride.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.cda.RemoveOveride.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.dialogs.0.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.dialogs.0.handler", "chrome://sim_toolbar_package/content/optionsdialog-h[...]

Gelöscht : user_pref("sweetim.toolbar.dialogs.0.height", "335");

Gelöscht : user_pref("sweetim.toolbar.dialogs.0.id", "id_options_dialog");

Gelöscht : user_pref("sweetim.toolbar.dialogs.0.title", "$string.config.label;");

Gelöscht : user_pref("sweetim.toolbar.dialogs.0.url", "hxxp://www.sweetim.com/simffbar/options_remote_ff.asp?la[...]

Gelöscht : user_pref("sweetim.toolbar.dialogs.0.width", "761");

Gelöscht : user_pref("sweetim.toolbar.dialogs.1.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.dialogs.1.handler", "chrome://sim_toolbar_package/content/exampledialog-h[...]

Gelöscht : user_pref("sweetim.toolbar.dialogs.1.height", "300");

Gelöscht : user_pref("sweetim.toolbar.dialogs.1.id", "id_example_dialog");

Gelöscht : user_pref("sweetim.toolbar.dialogs.1.title", "Example (unit-test) dialog");

Gelöscht : user_pref("sweetim.toolbar.dialogs.1.url", "chrome://sim_toolbar_package/content/exampledialog.html"[...]

Gelöscht : user_pref("sweetim.toolbar.dialogs.1.width", "500");

Gelöscht : user_pref("sweetim.toolbar.dialogs.2.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.dialogs.2.handler", "chrome://sim_toolbar_package/content/cdadialog-handl[...]

Gelöscht : user_pref("sweetim.toolbar.dialogs.2.height", "150");

Gelöscht : user_pref("sweetim.toolbar.dialogs.2.id", "id_dialog_hide_disable_remove");

Gelöscht : user_pref("sweetim.toolbar.dialogs.2.title", "Option Dialog");

Gelöscht : user_pref("sweetim.toolbar.dialogs.2.url", "hxxp://www.sweetim.com/simffbar/simcdadialog.asp");

Gelöscht : user_pref("sweetim.toolbar.dialogs.2.width", "530");

Gelöscht : user_pref("sweetim.toolbar.dnscatch.domain-blacklist", ".*.sweetim.com/.*|.*.facebook.com/.*|.*.goog[...]

Gelöscht : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");

Gelöscht : user_pref("sweetim.toolbar.keywordUrlGuard.enable", "false");

Gelöscht : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");

Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");

Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");

Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");

Gelöscht : user_pref("sweetim.toolbar.mode.debug", "false");

Gelöscht : user_pref("sweetim.toolbar.newtab.created", "true");

Gelöscht : user_pref("sweetim.toolbar.newtab.enable", "true");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.newtab.url", "about:newtab");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");

Gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "");

Gelöscht : user_pref("sweetim.toolbar.rc.url", "hxxp://www.sweetim.com/simffbar/rc.html?toolbar_version=$ITEM_V[...]

Gelöscht : user_pref("sweetim.toolbar.scripts.0.addcontextdiv", "true");

Gelöscht : user_pref("sweetim.toolbar.scripts.0.callback", "simVerification");

Gelöscht : user_pref("sweetim.toolbar.scripts.0.domain-blacklist", "");

Gelöscht : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");

Gelöscht : user_pref("sweetim.toolbar.scripts.0.elementid", "id_script_sim_fb");

Gelöscht : user_pref("sweetim.toolbar.scripts.0.enable", "false");

Gelöscht : user_pref("sweetim.toolbar.scripts.0.id", "id_script_fb");

Gelöscht : user_pref("sweetim.toolbar.scripts.0.url", "hxxp://sc.sweetim.com/apps/in/fb/infb.js");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.addcontextdiv", "true");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.callback", "simVerification");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.elementid", "id_script_sim_fb");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.enable", "false");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.id", "id_script_fb_hxxpS");

Gelöscht : user_pref("sweetim.toolbar.scripts.1.url", "hxxps://sc.sweetim.com/apps/in/fb/infb.js");

Gelöscht : user_pref("sweetim.toolbar.scripts.2.addcontextdiv", "false");

Gelöscht : user_pref("sweetim.toolbar.scripts.2.callback", "");

Gelöscht : user_pref("sweetim.toolbar.scripts.2.domain-blacklist", ".*.google..*|.*.bing..*|.*.live..*|.*.msn..[...]

Gelöscht : user_pref("sweetim.toolbar.scripts.2.domain-whitelist", "");

Gelöscht : user_pref("sweetim.toolbar.scripts.2.elementid", "id_predict_include_script");

Gelöscht : user_pref("sweetim.toolbar.scripts.2.enable", "false");

Gelöscht : user_pref("sweetim.toolbar.scripts.2.id", "id_script_prad");

Gelöscht : user_pref("sweetim.toolbar.scripts.2.url", "hxxp://cdn1.certified-apps.com/scripts/shared/enable.js?[...]

Gelöscht : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]

Gelöscht : user_pref("sweetim.toolbar.search.history", "titrationskurve%20hcl");

Gelöscht : user_pref("sweetim.toolbar.search.history.capacity", "10");

Gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "false");

Gelöscht : user_pref("sweetim.toolbar.searchguard.initialized_by_rc", "true");

Gelöscht : user_pref("sweetim.toolbar.simapp_id", "{4C5DD3C3-5828-11E2-9AFC-001A6B1F5AEC}");

Gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.1010000.00000&barid={4C5D[...]

Gelöscht : user_pref("sweetim.toolbar.version", "1.9.0.0");
 

*************************
 

AdwCleaner[S1].txt - [333 octets] - [04/06/2013 15:06:31]

AdwCleaner[S2].txt - [17967 octets] - [04/06/2013 15:06:56]
 

########## EOF - C:\AdwCleaner[S2].txt - [18028 octets] ##########

--- --- ---

Combofix Logfile:

Code:

ComboFix 13-06-03.06 - Darek 04.06.2013  15:16:43.1.2 - x86

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2047.1375 [GMT 2:00]

ausgeführt von:: c:\users\Darek\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-05-04 bis 2013-06-04  ))))))))))))))))))))))))))))))

.

.

2013-06-04 13:24 . 2013-06-04 13:25        --------        d-----w-        c:\users\Darek\AppData\Local\temp

2013-06-04 13:24 . 2013-06-04 13:24        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-06-04 13:22 . 2013-06-04 13:22        60872        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{895B2C2C-2A95-4807-A474-3F62D12CBD6F}\offreg.dll

2013-06-04 07:57 . 2013-06-04 07:57        103680        ----a-w-        C:\ugloapow.sys

2013-06-04 07:57 . 2013-05-13 06:19        7016152        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{895B2C2C-2A95-4807-A474-3F62D12CBD6F}\mpengine.dll

2013-06-03 17:53 . 2011-06-21 09:24        32768        ----a-w-        c:\windows\system32\drivers\sp_rsdrv2.sys

2013-06-03 17:46 . 2013-06-03 18:00        --------        d-----w-        c:\programdata\Spybot - Search & Destroy

2013-06-03 17:45 . 2013-06-04 07:48        --------        d-----w-        c:\program files\Spybot - Search & Destroy 2

2013-06-03 15:05 . 2013-06-03 15:05        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2013-06-03 15:05 . 2013-04-04 12:50        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-06-02 11:11 . 2013-06-03 17:42        --------        d-----w-        c:\users\Darek\AppData\Roaming\Caegx

2013-06-02 11:11 . 2013-06-03 15:44        --------        d-----w-        c:\users\Darek\AppData\Roaming\Emxe

2013-06-02 11:11 . 2013-06-02 11:11        --------        d-----w-        c:\users\Darek\AppData\Roaming\Maampa

2013-05-23 13:59 . 2013-05-23 13:59        --------        d-sh--w-        c:\users\Darek\AppData\Local\ms-drivers

2013-05-23 13:59 . 2013-05-23 13:59        --------        d-----w-        c:\users\Darek\AppData\Local\MetaGeek,_LLC

2013-05-23 13:58 . 2013-05-23 13:58        --------        d-----w-        c:\program files\MetaGeek

2013-05-23 08:59 . 2013-05-23 08:59        --------        d-----w-        c:\program files\ShrewSoft

2013-05-23 08:35 . 2013-05-23 08:38        --------        d-----w-        c:\windows\1CE60928832549A88B06633E48DD2B67.TMP

2013-05-23 08:32 . 2013-05-23 08:32        --------        d-----w-        c:\users\Darek\1CE60928832549A88B06633E48DD2B67.TMP

2013-05-22 14:43 . 2013-05-22 14:43        --------        d-----w-        c:\program files\Cisco Systems

2013-05-17 15:01 . 2013-05-17 15:01        --------        d-----w-        c:\users\Darek\AppData\Local\Unity

2013-05-16 07:59 . 2013-04-05 06:02        770608        ----a-w-        c:\program files\Internet Explorer\iexplore.exe

2013-05-16 07:59 . 2013-04-05 05:28        1767424        ----a-w-        c:\windows\system32\wininet.dll

2013-05-15 15:52 . 2013-03-19 04:53        186368        ----a-w-        c:\windows\system32\wwansvc.dll

2013-05-15 15:52 . 2013-03-19 03:33        40960        ----a-w-        c:\windows\system32\wwanprotdim.dll

2013-05-15 15:52 . 2013-04-10 03:14        2347520        ----a-w-        c:\windows\system32\win32k.sys

2013-05-15 15:52 . 2013-04-10 05:18        728424        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2013-05-15 15:52 . 2013-04-10 05:18        218984        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2013-05-15 15:52 . 2013-02-27 05:05        101720        ----a-w-        c:\windows\system32\consent.exe

2013-05-15 15:52 . 2013-02-27 04:49        1796096        ----a-w-        c:\windows\system32\authui.dll

2013-05-15 15:52 . 2013-02-27 04:49        47104        ----a-w-        c:\windows\system32\appinfo.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-22 14:51 . 2011-03-28 16:36        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-05-17 12:58 . 2012-09-20 13:38        692104        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2013-05-17 12:58 . 2011-09-12 12:27        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-02 00:06 . 2011-09-12 12:23        238872        ------w-        c:\windows\system32\MpSigStub.exe

2013-04-13 04:45 . 2013-05-15 15:52        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-15 15:52        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll

2013-04-12 13:45 . 2013-04-23 18:56        1211752        ----a-w-        c:\windows\system32\drivers\ntfs.sys

2013-03-23 11:00 . 2013-03-23 11:00        745472        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-03-23 11:00 . 2013-03-23 11:00        523264        ----a-w-        c:\windows\system32\vbscript.dll

2013-03-23 11:00 . 2013-03-23 11:00        38400        ----a-w-        c:\windows\system32\imgutil.dll

2013-03-23 11:00 . 2013-03-23 11:00        185344        ----a-w-        c:\windows\system32\elshyph.dll

2013-03-23 11:00 . 2013-03-23 11:00        158720        ----a-w-        c:\windows\system32\msls31.dll

2013-03-23 11:00 . 2013-03-23 11:00        150528        ----a-w-        c:\windows\system32\iexpress.exe

2013-03-23 11:00 . 2013-03-23 11:00        138752        ----a-w-        c:\windows\system32\wextract.exe

2013-03-23 11:00 . 2013-03-23 11:00        137216        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-03-23 11:00 . 2013-03-23 11:00        12800        ----a-w-        c:\windows\system32\mshta.exe

2013-03-23 11:00 . 2013-03-23 11:00        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-03-23 11:00 . 2013-03-23 11:00        73728        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-03-23 11:00 . 2013-03-23 11:00        61952        ----a-w-        c:\windows\system32\tdc.ocx

2013-03-23 11:00 . 2013-03-23 11:00        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-03-23 11:00 . 2013-03-23 11:00        361984        ----a-w-        c:\windows\system32\html.iec

2013-03-23 11:00 . 2013-03-23 11:00        719360        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-03-23 11:00 . 2013-03-23 11:00        23040        ----a-w-        c:\windows\system32\licmgr10.dll

2013-03-23 11:00 . 2013-03-23 11:00        1441280        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-03-23 10:59 . 2013-03-23 10:59        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        417792        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-03-23 10:59 . 2013-03-23 10:59        4096        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        364544        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2013-03-23 10:59 . 2013-03-23 10:59        3584        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        2560        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        2284544        ----a-w-        c:\windows\system32\msmpeg2vdec.dll

2013-03-23 10:59 . 2013-03-23 10:59        1158144        ----a-w-        c:\windows\system32\XpsPrint.dll

2013-03-23 10:59 . 2013-03-23 10:59        10752        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-03-23 10:59 . 2013-03-23 10:59        906240        ----a-w-        c:\windows\system32\FntCache.dll

2013-03-23 10:59 . 2013-03-23 10:59        604160        ----a-w-        c:\windows\system32\d3d10level9.dll

2013-03-23 10:59 . 2013-03-23 10:59        3419136        ----a-w-        c:\windows\system32\d2d1.dll

2013-03-23 10:59 . 2013-03-23 10:59        293376        ----a-w-        c:\windows\system32\dxgi.dll

2013-03-23 10:59 . 2013-03-23 10:59        249856        ----a-w-        c:\windows\system32\d3d10_1core.dll

2013-03-23 10:59 . 2013-03-23 10:59        220160        ----a-w-        c:\windows\system32\d3d10core.dll

2013-03-23 10:59 . 2013-03-23 10:59        207872        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2013-03-23 10:59 . 2013-03-23 10:59        1988096        ----a-w-        c:\windows\system32\d3d10warp.dll

2013-03-23 10:59 . 2013-03-23 10:59        187392        ----a-w-        c:\windows\system32\UIAnimation.dll

2013-03-23 10:59 . 2013-03-23 10:59        161792        ----a-w-        c:\windows\system32\d3d10_1.dll

2013-03-23 10:59 . 2013-03-23 10:59        1504768        ----a-w-        c:\windows\system32\d3d11.dll

2013-03-23 10:59 . 2013-03-23 10:59        1247744        ----a-w-        c:\windows\system32\DWrite.dll

2013-03-23 10:59 . 2013-03-23 10:59        1230336        ----a-w-        c:\windows\system32\WindowsCodecs.dll

2013-03-23 10:59 . 2013-03-23 10:59        1080832        ----a-w-        c:\windows\system32\d3d10.dll

2013-03-21 08:51 . 2013-03-21 08:51        94112        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll

2013-03-21 08:50 . 2012-10-08 08:48        861088        ----a-w-        c:\windows\system32\npDeployJava1.dll

2013-03-21 08:50 . 2012-10-08 08:48        782240        ----a-w-        c:\windows\system32\deployJava1.dll

2013-03-19 05:04 . 2013-04-11 05:28        3968856        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2013-03-19 05:04 . 2013-04-11 05:28        3913560        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-03-19 04:48 . 2013-04-11 05:28        38912        ----a-w-        c:\windows\system32\csrsrv.dll

2013-03-19 02:49 . 2013-04-11 05:28        69632        ----a-w-        c:\windows\system32\smss.exe

2013-02-10 14:08 . 2013-02-10 14:07        262112        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

2006-05-03 10:06        163328        --sha-r-        c:\windows\System32\flvDX.dll

2007-02-21 11:47        31232        --sha-r-        c:\windows\System32\msfDX.dll

2008-03-16 13:30        216064        --sha-r-        c:\windows\System32\nbDX.dll

2010-01-06 22:00        107520        --sha-r-        c:\windows\System32\TAKDSDecoder.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Darek\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Darek\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-05-25 00:36        130736        ----a-w-        c:\users\Darek\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Darek\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-5-25 27776968]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

cv act sc interface RegisterTool.lnk - c:\program files\cv cryptovision\cv act sc interface\RegisterTool.exe [2012-4-26 7773184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0\0sdnclean.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\startupfolder\C:^Users^Darek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]

path=c:\users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

backup=c:\windows\pss\Dropbox.lnk.Startup

backupExtension=.Startup

.

[HKLM\~\startupfolder\C:^Users^Darek^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk]

path=c:\users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk

backup=c:\windows\pss\Logitech . Produktregistrierung.lnk.Startup

backupExtension=.Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2011-11-10 09:17        3514176        ----a-w-        c:\program files\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]

2010-05-07 16:35        165208        ----a-w-        c:\program files\Logitech\LWS\Webcam Software\LWS.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]

2013-03-20 12:38        162856        ----a-w-        c:\program files\PDF24\pdf24.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]

2009-11-11 13:11        287800        ----a-r-        c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2012-07-13 11:33        17418928        ----a-r-        c:\program files\Skype\Phone\Skype.exe

.

R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2012-07-03 160944]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]

R3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\DRIVERS\SCR3XX2K.sys [2011-09-07 59776]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]

R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [2010-09-02 13824]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-11-22 239168]

S1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [2010-09-02 17920]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]

S2 dtpd;ShrewSoft DNS Proxy Daemon;c:\program files\ShrewSoft\VPN Client\dtpd.exe [2010-10-08 54544]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-13 26168]

S2 iked;ShrewSoft IKE Daemon;c:\program files\ShrewSoft\VPN Client\iked.exe [2010-10-08 726288]

S2 ipsecd;ShrewSoft IPSEC Daemon;c:\program files\ShrewSoft\VPN Client\ipsecd.exe [2010-10-08 541968]

S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-04-01 428640]

S3 ATSwpWDF;AuthenTec TruePrint WBF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [2012-08-30 969192]

S3 GTIPCI21;GTIPCI21;c:\windows\system32\DRIVERS\gtipci21.sys [2007-05-09 97280]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]

S3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\DRIVERS\SMSCirda.sys [2007-04-25 31232]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-19 16:58]

.

2013-06-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-06-19 16:58]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: Free YouTube Download - c:\users\Darek\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - c:\users\Darek\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: Interfaces\{621C173D-EF55-4C2E-959F-C9E377AA2086}: NameServer = 134.147.32.40,134.147.222.4

FF - ProfilePath - c:\users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\b9z6hqum.default\

FF - prefs.js: browser.search.defaulturl - 

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-svñhîst - c:\users\Darek\wgsdgsdgdsgsd.exe

AddRemove-RuckZuck 4.0 - c:\windows\IsUn0407.exe

AddRemove-Worms2 - c:\windows\IsUn0407.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-06-04  15:27:10

ComboFix-quarantined-files.txt  2013-06-04 13:27

.

Vor Suchlauf: 12 Verzeichnis(se), 55.567.593.472 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 55.538.073.600 Bytes frei

.

- - End Of File - - F8B8C523CB4700FB53739556CF6F76C3

OTL Logfile:

--- --- ---

Code:

OTL logfile created on: 04.06.2013 15:31:33 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Darek\Desktop

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 65,29% Memory free

4,00 Gb Paging File | 3,31 Gb Available in Paging File | 82,76% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 111,79 Gb Total Space | 51,80 Gb Free Space | 46,34% Space Free | Partition Type: NTFS

 

Computer Name: DAREK-PC | User Name: Darek | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.06.04 09:26:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Darek\Desktop\OTL.exe

PRC - [2013.05.25 02:47:30 | 027,776,968 | ---- | M] (Dropbox, Inc.) -- C:\Users\Darek\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2012.11.30 04:55:25 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2012.11.23 04:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) -- C:\Programme\Skype\Updater\Updater.exe

PRC - [2012.04.26 02:42:36 | 007,773,184 | R--- | M] (cv cryptovision GmbH) -- C:\Programme\cv cryptovision\cv act sc interface\RegisterTool.exe

PRC - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.04.21 07:53:10 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe

PRC - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe

PRC - [2011.04.21 07:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe

PRC - [2011.04.01 05:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe

PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.10.08 07:18:42 | 000,726,288 | ---- | M] () -- C:\Programme\ShrewSoft\VPN Client\iked.exe

PRC - [2010.10.08 07:18:42 | 000,541,968 | ---- | M] () -- C:\Programme\ShrewSoft\VPN Client\ipsecd.exe

PRC - [2010.10.08 07:18:42 | 000,054,544 | ---- | M] () -- C:\Programme\ShrewSoft\VPN Client\dtpd.exe

PRC - [2007.09.15 02:29:10 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPStart.exe

PRC - [2007.02.06 11:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Dropbox\bin\libcef.dll

MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

 

 
 ========== Services (SafeList) ==========

 

SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2013.02.10 16:08:00 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.07.03 13:19:28 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2011.07.21 12:08:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)

SRV - [2011.04.21 07:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.04.01 05:11:52 | 000,428,640 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)

SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2010.10.08 07:18:42 | 000,726,288 | ---- | M] () [Auto | Running] -- C:\Programme\ShrewSoft\VPN Client\iked.exe -- (iked)

SRV - [2010.10.08 07:18:42 | 000,541,968 | ---- | M] () [Auto | Running] -- C:\Programme\ShrewSoft\VPN Client\ipsecd.exe -- (ipsecd)

SRV - [2010.10.08 07:18:42 | 000,054,544 | ---- | M] () [Auto | Running] -- C:\Programme\ShrewSoft\VPN Client\dtpd.exe -- (dtpd)

SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007.02.06 11:44:24 | 000,069,632 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)

SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Darek\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012.08.30 09:52:28 | 000,969,192 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATSwpWDF.sys -- (ATSwpWDF)

DRV - [2012.08.23 16:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV - [2012.08.23 16:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2011.11.22 15:36:37 | 000,239,168 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)

DRV - [2011.09.07 10:18:26 | 000,059,776 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SCR3XX2K.sys -- (SCR3XX2K)

DRV - [2011.07.21 12:11:12 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.07.21 12:11:11 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.05.13 18:57:42 | 000,025,656 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)

DRV - [2011.05.13 18:57:20 | 000,035,896 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)

DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.11.10 04:49:50 | 004,323,040 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)

DRV - [2010.11.10 04:48:12 | 000,283,744 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)

DRV - [2010.09.02 09:18:48 | 000,017,920 | ---- | M] (Shrew Soft Inc) [Kernel | System | Running] -- C:\Windows\System32\drivers\vfilter.sys -- (vflt)

DRV - [2010.09.02 09:18:48 | 000,013,824 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\virtualnet.sys -- (vnet)

DRV - [2010.02.25 00:02:30 | 000,015,544 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CPQBTTN.sys -- (HBtnKey)

DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009.07.14 01:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)

DRV - [2009.07.14 00:13:48 | 001,035,776 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32)

DRV - [2009.04.29 07:46:54 | 000,015,872 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)

DRV - [2007.12.14 09:21:56 | 000,290,816 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)

DRV - [2007.05.09 13:27:00 | 000,097,280 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\gtipci21.sys -- (GTIPCI21)

DRV - [2007.04.25 13:32:42 | 000,031,232 | ---- | M] (SMSC) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smscirda.sys -- (SMSCIRDA)

DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2005.09.23 23:18:32 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MarvinBus.sys -- (MarvinBus)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E6 BC 3F F5 44 71 CC 01  [binary data]

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..extensions.enabledAddons: %7BEEE6C361-6118-11DC-9C72-001320C79847%7D:1.9.0.0

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll ()

FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.19: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Darek\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.10 16:08:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.10 16:08:00 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

 

[2012.08.10 16:22:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darek\AppData\Roaming\mozilla\Extensions

[2013.06.04 15:07:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Darek\AppData\Roaming\mozilla\Firefox\Profiles\b9z6hqum.default\extensions

[2013.02.10 16:07:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

File not found (No name found) -- C:\USERS\DAREK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\B9Z6HQUM.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}.XPI

[2013.02.10 16:08:00 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2013.05.05 10:52:35 | 000,001,400 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2013.05.05 10:52:35 | 000,001,679 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2013.05.05 10:52:35 | 000,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2013.05.05 10:52:35 | 000,006,818 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2013.01.06 19:41:08 | 000,001,280 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2013.05.05 10:52:35 | 000,000,903 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2013.06.04 15:24:52 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.)

O4 - Startup: C:\Users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Darek\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3889068002-2973548456-1533490547-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Free YouTube Download - C:\Users\Darek\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm File not found

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Darek\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{621C173D-EF55-4C2E-959F-C9E377AA2086}: NameServer = 134.147.32.40,134.147.222.4

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BD5806D1-464E-48E7-B20D-396EBB500733}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.06.04 15:27:15 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2013.06.04 15:27:12 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2013.06.04 15:27:12 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Local\temp

[2013.06.04 15:12:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2013.06.04 15:12:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2013.06.04 15:12:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2013.06.04 15:12:07 | 000,000,000 | ---D | C] -- C:\Qoobox

[2013.06.04 15:11:45 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2013.06.04 15:04:31 | 005,077,441 | R--- | C] (Swearware) -- C:\Users\Darek\Desktop\ComboFix.exe

[2013.06.04 09:57:06 | 000,103,680 | ---- | C] (GMER) -- C:\ugloapow.sys

[2013.06.04 09:26:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Darek\Desktop\OTL.exe

[2013.06.03 19:46:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy

[2013.06.03 19:45:38 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2

[2013.06.03 17:05:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.06.03 17:05:41 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2013.06.03 17:05:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2013.06.03 17:05:17 | 036,271,144 | ---- | C] (Safer-Networking Ltd.                                       ) -- C:\Users\Darek\Desktop\spybot-2.1.exe

[2013.06.02 13:41:55 | 000,000,000 | ---D | C] -- C:\Users\Darek\Desktop\sd karte

[2013.06.02 13:11:29 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Maampa

[2013.06.02 13:11:29 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Emxe

[2013.06.02 13:11:29 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Caegx

[2013.05.23 15:59:32 | 000,000,000 | -HSD | C] -- C:\Users\Darek\AppData\Local\ms-drivers

[2013.05.23 15:59:25 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Local\MetaGeek,_LLC

[2013.05.23 15:58:52 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MetaGeek

[2013.05.23 15:58:52 | 000,000,000 | ---D | C] -- C:\Program Files\MetaGeek

[2013.05.23 11:29:52 | 000,000,000 | ---D | C] -- C:\Users\Darek\Desktop\vpn

[2013.05.23 11:00:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShrewSoft VPN Client

[2013.05.23 10:59:09 | 000,000,000 | ---D | C] -- C:\Users\Darek\Documents\Shrew Soft VPN

[2013.05.23 10:59:07 | 000,000,000 | ---D | C] -- C:\Program Files\ShrewSoft

[2013.05.22 16:43:11 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco Systems

[2013.05.17 17:01:44 | 000,000,000 | ---D | C] -- C:\Users\Darek\AppData\Local\Unity

[2013.05.07 14:53:09 | 000,000,000 | ---D | C] -- C:\Users\Darek\Documents\barcelona

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[1 C:\Users\Darek\*.tmp files -> C:\Users\Darek\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.06.04 15:30:33 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics

[2013.06.04 15:29:59 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.06.04 15:29:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.06.04 15:29:27 | 1610,162,176 | -HS- | M] () -- C:\hiberfil.sys

[2013.06.04 15:24:52 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2013.06.04 15:17:16 | 000,014,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.06.04 15:17:16 | 000,014,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.06.04 15:04:50 | 005,077,441 | R--- | M] (Swearware) -- C:\Users\Darek\Desktop\ComboFix.exe

[2013.06.04 15:03:49 | 000,632,031 | ---- | M] () -- C:\Users\Darek\Desktop\adwcleaner.exe

[2013.06.04 15:01:44 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.06.04 09:57:06 | 000,103,680 | ---- | M] (GMER) -- C:\ugloapow.sys

[2013.06.04 09:55:48 | 000,377,856 | ---- | M] () -- C:\Users\Darek\Desktop\gmer_2.1.19163.exe

[2013.06.04 09:46:57 | 000,000,079 | ---- | M] () -- C:\Windows\wininit.ini

[2013.06.04 09:26:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Darek\Desktop\OTL.exe

[2013.06.04 09:24:27 | 000,000,000 | ---- | M] () -- C:\Users\Darek\defogger_reenable

[2013.06.04 09:23:55 | 000,050,477 | ---- | M] () -- C:\Users\Darek\Desktop\Defogger.exe

[2013.06.03 17:06:02 | 036,271,144 | ---- | M] (Safer-Networking Ltd.                                       ) -- C:\Users\Darek\Desktop\spybot-2.1.exe

[2013.06.03 17:05:47 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.06.03 15:36:02 | 000,654,400 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2013.06.03 15:36:02 | 000,616,242 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2013.06.03 15:36:02 | 000,130,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2013.06.03 15:36:02 | 000,106,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2013.06.02 16:36:44 | 000,001,049 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2013.05.23 15:59:32 | 000,000,037 | -HS- | M] () -- C:\Users\Darek\AppData\Local\70149b02515b3bb20dd492.47983420

[2013.05.23 10:58:41 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF

[2013.05.23 10:41:06 | 000,001,594 | ---- | M] () -- C:\Windows\VPNInstall.MIF

[2013.05.16 10:39:57 | 000,407,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2013.05.13 22:16:24 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[1 C:\Users\Darek\*.tmp files -> C:\Users\Darek\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.06.04 15:12:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2013.06.04 15:12:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2013.06.04 15:12:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2013.06.04 15:12:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2013.06.04 15:12:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2013.06.04 15:03:48 | 000,632,031 | ---- | C] () -- C:\Users\Darek\Desktop\adwcleaner.exe

[2013.06.04 09:55:48 | 000,377,856 | ---- | C] () -- C:\Users\Darek\Desktop\gmer_2.1.19163.exe

[2013.06.04 09:46:50 | 000,000,079 | ---- | C] () -- C:\Windows\wininit.ini

[2013.06.04 09:24:27 | 000,000,000 | ---- | C] () -- C:\Users\Darek\defogger_reenable

[2013.06.04 09:23:55 | 000,050,477 | ---- | C] () -- C:\Users\Darek\Desktop\Defogger.exe

[2013.06.03 19:53:24 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys

[2013.06.03 17:05:47 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2013.05.23 15:59:32 | 000,000,037 | -HS- | C] () -- C:\Users\Darek\AppData\Local\70149b02515b3bb20dd492.47983420

[2013.05.23 10:35:34 | 000,001,594 | ---- | C] () -- C:\Windows\VPNUnInstall.MIF

[2013.05.22 16:42:44 | 000,001,594 | ---- | C] () -- C:\Windows\VPNInstall.MIF

[2013.01.29 14:28:59 | 000,023,934 | ---- | C] () -- C:\Users\Darek\.recently-used.xbel

[2013.01.01 22:24:00 | 000,047,104 | ---- | C] () -- C:\Windows\System32\KMVIDC32.DLL

[2011.11.15 23:28:34 | 000,001,471 | ---- | C] () -- C:\Users\Darek\AppData\Local\RecConfig.xml

[2011.09.22 23:38:02 | 000,011,264 | ---- | C] () -- C:\Users\Darek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.09.22 23:31:32 | 000,000,000 | ---- | C] () -- C:\Windows\Graffiti5.2Pin.ini

[2011.09.22 23:31:31 | 000,237,568 | R--- | C] () -- C:\Windows\System32\qtmlClient.dll

[2011.09.22 23:25:18 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll

[2011.09.22 23:23:11 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll

[2011.09.21 12:29:45 | 000,000,017 | ---- | C] () -- C:\Users\Darek\AppData\Local\resmon.resmoncfg

[2011.09.19 10:24:01 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2013.06.03 19:42:56 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Caegx

[2012.06.14 16:15:05 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Canon

[2011.11.22 15:37:58 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DAEMON Tools Lite

[2012.07.02 10:39:35 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DelinvFile

[2013.06.04 15:30:45 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Dropbox

[2012.12.03 16:40:02 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\DVDVideoSoft

[2013.06.03 17:44:54 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Emxe

[2013.01.29 14:28:59 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\gtk-2.0

[2011.09.15 14:29:35 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Leadertech

[2013.06.02 13:11:29 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Maampa

[2013.01.06 19:41:09 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\Opera

[2012.06.14 16:19:32 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\PanoramaStudio2Pro

[2011.09.22 23:31:42 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\proDAD

[2011.09.22 23:36:45 | 000,000,000 | ---D | M] -- C:\Users\Darek\AppData\Roaming\XMedia Recode

 
 ========== Purity Check ==========

 

 
 

< End of report >

--- --- ---

Wofür denn eigentlich der Aufwand? Hast du etwas entdeckt oder sind es Vorsorgemaßnahmen?