Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   PC Performer - Virus (https://www.trojaner-board.de/137631-pc-performer-virus.html)

M.L. 03.07.2013 14:43
PC Performer - Virus
 
Guten Tag,

ich vermute, dass ich mir aufgrund eines Downloads bei softonic automatisch PC Performer runtergeladen habe. Dieses öffnet sich nun immer automatisch und fordert zum Kauf auf.

Ich habe auch bereits versucht mich darüber zu informiern, jedoch kenne ich mich mit diesem Themengebiet und der Fachsprache überhaupt nicht aus. :wtf: Außerdem wird hier darauf hingewiesen nichts auf eigene Faust zu unternehmen.

Deswegen hoffe ich, dass mir hier jemand erklären bzw. helfen kann diesen Virus zu entfernen.

Vielen Dank schonmal im Voraus für die Mühe :daumenhoc ,
Grüße M.L.

cosinus 03.07.2013 14:52
Hallo und :hallo:

Finger weg von Softonic!! :pfui:

Softonic ist eine Toolbar- und Adwareschleuder! Finger weg! Software lädt man sich mit oberster Priorität direkt vom Hersteller oder von Filepony aber nicht von solchen Toolbarklitschen wie Softonic!



Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die jemals fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!


Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

M.L. 03.07.2013 15:10
Nein, ich habe noch keine Logs oder Virenscans durchgeführt.

Vielen Dank für die schnelle Antwort!

cosinus 03.07.2013 15:12
Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Die Logs der aufgegebenen Tools wie zB Malwarebytes sind immer zu posten - egal ob ein Fund dabei war oder nicht!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Erstmal eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

M.L. 03.07.2013 16:12
Dies sind die zwei Logfiles:

Der erste Logfile:

OTL Logfile:
Code:
OTL logfile created on: 7/3/2013 4:23:12 PM - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\user\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.85 Gb Total Physical Memory | 2.05 Gb Available Physical Memory | 53.15% Memory free
7.71 Gb Paging File | 5.35 Gb Available in Paging File | 69.43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 179.00 Gb Total Space | 16.27 Gb Free Space | 9.09% Space Free | Partition Type: NTFS
Drive D: | 266.67 Gb Total Space | 133.83 Gb Free Space | 50.19% Space Free | Partition Type: NTFS
 
Computer Name: AP-*** | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\user\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\taxaktuell.exe ()
PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Lidl_Fotos\dd.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
PRC - C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe (Nero AG)
PRC - C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe (Clarus, Inc.)
PRC - C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe (Clarus, Inc.)
PRC - C:\Program Files (x86)\Clarus\Samsung Drive Manager\ABRTMon.exe (Clarus, Inc.)
PRC - C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
PRC - C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe ()
PRC - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
PRC - C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe (SAMSUNG Electronics)
PRC - C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
PRC - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
PRC - C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
PRC - C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (SEC)
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Windows\SysWOW64\Rezip.exe ()
PRC - C:\Program Files (x86)\AAVUpdateManager\aavus.exe ()
PRC - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wkont13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wfabu13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\taxaktuell.exe ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wmain13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wimp13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wfvie13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\rsodbc48.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\rsdcom48.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\whau213.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wwerb13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wbae413.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wbae113.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\whau113.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wbae313.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wbae213.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wgui13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wreli13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wcore13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wsteu13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\rsguiwinapi48.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\rscorewinapi48.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\wauff13.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\clucene-core.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\1505fb78e94fbe5ee73563a5e10ecead\System.Messaging.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\clucene-contribs-lib.dll ()
MOD - C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2013\clucene-shared.dll ()
MOD - C:\Program Files (x86)\Lidl_Fotos\dd.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe ()
MOD - C:\Program Files (x86)\Seagate\DiscWizard\Common\rpc_client.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\SysWOW64\msjetoledb40.dll ()
MOD - C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (NisSrv) -- C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV:64bit: - (MsMpSvc) -- C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (SpyHunter 4 Service) -- C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE (Enigma Software Group USA, LLC.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe (McAfee, Inc.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (PassThru Service) -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
SRV - (HTCMonitorService) -- C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe (Nero AG)
SRV - (SZDrvSvc) -- C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe (Clarus, Inc.)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (SgtSch2Svc) -- C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe (Seagate)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Rezip) -- C:\Windows\SysWOW64\Rezip.exe ()
SRV - (AAV UpdateService) -- C:\Program Files (x86)\AAVUpdateManager\aavus.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (timounter) -- C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:64bit: - (vididr) -- C:\Windows\SysNative\drivers\vididr.sys (Acronis)
DRV:64bit: - (vidsflt53) -- C:\Windows\SysNative\drivers\vsflt53.sys (Acronis)
DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (EsgScanner) -- C:\Windows\SysNative\drivers\EsgScanner.sys ()
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia)
DRV:64bit: - (nmwcdnsux64) -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (nmwcdnsucx64) -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys (Nokia)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys ()
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (htcnprot) -- C:\Windows\SysNative\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)
DRV:64bit: - (SABI) -- C:\Windows\SysNative\drivers\SABI.sys (SAMSUNG ELECTRONICS)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (HTCAND64) -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV - (mvd23) -- C:\Program Files (x86)\Clarus\Samsung Drive Manager\mvd23.sys ()
DRV - (mdf16) -- C:\Program Files (x86)\Clarus\Samsung Drive Manager\mdf16.sys ()
DRV - (rtport) -- C:\Windows\SysWOW64\drivers\rtport.sys (Windows (R) 2003 DDK 3790 provider)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&babsrc=SP_ss_din2g&mntrId=3C5BEE39DF5DA56C&affID=119357&tt=250613_gr5&tsp=4929
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://search.fbdownloader.com/search.php?channel=sfde206&q={searchTerms}
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.fbdownloader.com/search.php?channel=sfde206&q="
FF - prefs.js..browser.search.order.1: "Google"
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: om%40offermosquito.com:0.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\user\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fe_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_9.0 [2012/02/12 18:40:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\K-Meleon\Extensions\\Plugins: C:\Program Files (x86)\K-Meleon\Plugins [2013/04/19 14:58:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\K-Meleon\Extensions\\Components: C:\Program Files (x86)\K-Meleon\Components [2012/12/02 18:10:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/03 15:41:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/07/03 15:41:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_9.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0 [2012/02/12 18:40:33 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/07/03 15:41:21 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/07/03 15:41:22 | 000,000,000 | ---D | M]
 
[2010/11/08 12:20:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Extensions
[2013/07/02 17:35:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\x8m34pgv.default\extensions
[2013/06/04 17:17:50 | 000,059,180 | ---- | M] () (No name found) -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\x8m34pgv.default\extensions\om@offermosquito.com.xpi
[2013/06/30 13:28:50 | 000,006,545 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\x8m34pgv.default\searchplugins\babylon.xml
[2013/06/30 13:29:10 | 000,001,294 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\x8m34pgv.default\searchplugins\delta.xml
[2013/07/03 15:41:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013/07/03 15:41:21 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/07/03 15:41:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013/07/03 15:41:52 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2011/05/24 14:15:34 | 000,599,424 | ---- | M] (3D RealityMaps GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\nprm3d.dll
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - homepage: hxxp://search.fbdownloader.com/?channel=sfde206
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.116\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: 3D RealityMaps Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprm3d.dll
CHR - plugin: CANON iMAGE GATEWAY Album Plugin Utility (Enabled) = C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
CHR - plugin: NPCIG.dll (Enabled) = C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U9 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: YouTube = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google-Suche = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Gmail offline = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk\1.19_0\
CHR - Extension: Google Kalender = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0\
CHR - Extension: OfferMosquito = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbmdkmlcnbapgegninelmjbfibaghdmk\0.4.1_0\
CHR - Extension: Cycling the Alps = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihklobncbkangkiiamccfgnlihbmjhlh\4.9.1.0_0\
CHR - Extension: Google Maps = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh\5.2.7_0\
CHR - Extension: Google Mail = C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Seagate Scheduler2 Service] C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [DiscWizardMonitor.exe] C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe ()
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: []  File not found
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [DataMgr] C:\Users\user\AppData\Roaming\DataMgr\DataMgr.exe (HTTO Group, Ltd.)
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [Device Detection] C:\Program Files (x86)\Lidl_Fotos\dd.exe ()
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [Facebook Update] C:\Users\user\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [GoogleChromeAutoLaunch_4E874A737D5662A34EBBEADB3A9C4A09] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [Intermediate] C:\Users\user\AppData\Roaming\Intermediate\Intermediate.exe ()
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [Samsung Drive Manager] C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe (Clarus, Inc.)
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [SCheck] C:\Users\user\AppData\Roaming\SCheck\SCheck.exe ()
O4 - HKU\S-1-5-21-3457901039-3679683318-3372754741-1000..\Run: [SSync] C:\Users\user\AppData\Roaming\SSync\SSync.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26C1FA6D-C3AD-4D93-8F68-2C2C220F0E10}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/07/02 19:57:55 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{532f21a2-fb3d-11e1-b377-002454b07c8e}\Shell - "" = AutoRun
O33 - MountPoints2\{532f21a2-fb3d-11e1-b377-002454b07c8e}\Shell\AutoRun\command - "" = F:\HTC_Sync_Manager_PC.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/07/03 15:41:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013/07/02 19:57:37 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
[2013/07/02 19:57:33 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2013/07/02 19:57:33 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013/07/02 19:56:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013/07/02 17:17:25 | 002,828,552 | ---- | C] (AVAST Software) -- C:\Users\user\Desktop\avast-browser-cleanup_8.0.1484.29.exe
[2013/07/02 16:59:08 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Bildbearbeitung
[2013/07/01 19:36:05 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013/07/01 19:36:05 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Extensions
[2013/06/30 13:37:27 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Scribus
[2013/06/30 13:29:15 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Video Converter Packages
[2013/06/30 13:29:03 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\BabSolution
[2013/06/30 13:28:39 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\DSite
[2013/06/30 13:28:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoConverter
[2013/06/30 13:28:35 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Babylon
[2013/06/30 13:28:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013/06/29 17:46:32 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\PhotoFiltre 7
[2013/06/29 17:46:30 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PhotoFiltre 7
[2013/06/29 17:46:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoFiltre 7
[2013/06/29 17:40:42 | 000,000,000 | ---D | C] -- C:\HAK-Daten
[2013/06/29 17:40:41 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\B+P Heyer
[2013/06/29 17:40:40 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\B+P Heyer
[2013/06/29 17:40:40 | 000,000,000 | ---D | C] -- C:\ProgramData\B+P Heyer
[2013/06/29 17:36:45 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\PerformerSoft
[2013/06/29 17:36:45 | 000,000,000 | ---D | C] -- C:\ProgramData\IBUpdaterService
[2013/06/29 17:36:44 | 000,019,632 | ---- | C] (PerformerSoft LLC) -- C:\Windows\SysNative\roboot64.exe
[2013/06/29 17:36:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Performer
[2013/06/29 17:36:26 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\SSync
[2013/06/29 17:36:26 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Intermediate
[2013/06/29 17:36:26 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\DataMgr
[2013/06/29 17:36:25 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\SCheck
[2013/06/29 17:36:20 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\FBDownloader
[2013/06/29 17:36:20 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Common
[2013/06/29 17:36:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BPH
[2013/06/28 22:03:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
[2013/06/28 22:02:31 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\PhotoScape
[2013/06/28 22:02:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape
[2013/06/28 22:02:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotoScape
[2013/06/28 21:43:30 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\gtk-2.0
[2013/06/28 21:42:23 | 000,000,000 | ---D | C] -- C:\Users\user\.thumbnails
[2013/06/28 21:39:14 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\webkit
[2013/06/28 20:46:19 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\gegl-0.2
[2013/06/28 20:46:19 | 000,000,000 | ---D | C] -- C:\Users\user\.gimp-2.8
[2013/06/28 20:43:29 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP 2
[2013/06/25 16:34:09 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\O_Stadt_Aschaffenburg_2013_Sicherheitskopie
[2013/06/15 11:06:32 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013/06/15 11:06:31 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/12 16:25:22 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013/06/12 16:25:22 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/06/12 16:25:22 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013/06/12 16:25:22 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013/06/12 16:25:22 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013/06/12 16:25:22 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013/06/12 16:25:22 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013/06/12 16:25:21 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013/06/12 16:25:21 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/06/12 16:25:20 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013/06/12 16:25:19 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013/06/12 16:25:19 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013/06/12 16:25:19 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013/06/12 15:00:33 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013/06/12 15:00:31 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013/06/12 15:00:26 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013/06/12 15:00:26 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013/06/12 15:00:23 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013/06/12 15:00:21 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013/06/12 15:00:21 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013/06/12 15:00:21 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013/06/12 15:00:20 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013/06/12 15:00:20 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013/06/12 15:00:20 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013/06/12 15:00:14 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013/06/12 15:00:14 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013/06/03 17:02:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox.bak
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/07/03 16:28:00 | 000,000,282 | ---- | M] () -- C:\Windows\tasks\DSite.job
[2013/07/03 16:24:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/07/03 15:47:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/03 15:01:07 | 000,000,274 | ---- | M] () -- C:\Windows\tasks\PC Performer_DEFAULT.job
[2013/07/03 14:58:42 | 000,013,936 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/07/03 14:58:42 | 000,013,936 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/07/03 14:50:23 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/03 14:49:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/07/03 14:49:15 | 4137,803,776 | -HS- | M] () -- C:\hiberfil.sys
[2013/07/02 23:06:07 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3457901039-3679683318-3372754741-1000UA.job
[2013/07/02 20:06:01 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3457901039-3679683318-3372754741-1000Core.job
[2013/07/02 20:00:51 | 000,007,956 | ---- | M] () -- C:\Users\user\Desktop\Videos_2009 - Verknüpfung.lnk
[2013/07/02 20:00:49 | 000,006,835 | ---- | M] () -- C:\Users\user\Desktop\IXUS105_107_CUG_DE - Verknüpfung.lnk
[2013/07/02 20:00:48 | 000,007,069 | ---- | M] () -- C:\Users\user\Desktop\iPod_touch_Funktionshandbuch - Verknüpfung.lnk
[2013/07/02 19:57:55 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2013/07/02 19:57:38 | 000,002,262 | ---- | M] () -- C:\Users\user\Desktop\SpyHunter.lnk
[2013/07/02 18:28:04 | 000,000,005 | ---- | M] () -- C:\Users\user\AppData\Roaming\WBPU-TTL.DAT
[2013/07/02 17:17:40 | 002,828,552 | ---- | M] (AVAST Software) -- C:\Users\user\Desktop\avast-browser-cleanup_8.0.1484.29.exe
[2013/07/02 16:56:36 | 000,054,272 | -H-- | M] () -- C:\Users\user\Documents\photothumb.db
[2013/06/30 09:29:54 | 000,000,282 | ---- | M] () -- C:\Windows\tasks\PC Performer_UPDATES.job
[2013/06/30 09:29:33 | 000,423,008 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/06/29 20:17:35 | 000,007,985 | ---- | M] () -- C:\Users\user\AppData\Local\recently-used.xbel
[2013/06/28 22:01:15 | 000,002,265 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/06/12 16:24:17 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/06/12 16:24:17 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/06/11 10:26:59 | 000,010,054 | ---- | M] () -- C:\Users\user\Documents\Lidl Silberh_Postkarte Klassik (12er-Set).pcf
[2013/06/08 16:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013/06/08 13:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/07/02 19:57:55 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2013/07/02 19:57:40 | 000,022,704 | ---- | C] () -- C:\Windows\SysNative\drivers\EsgScanner.sys
[2013/07/02 19:57:37 | 000,002,262 | ---- | C] () -- C:\Users\user\Desktop\SpyHunter.lnk
[2013/06/30 14:28:04 | 000,000,005 | ---- | C] () -- C:\Users\user\AppData\Roaming\WBPU-TTL.DAT
[2013/06/30 13:28:39 | 000,000,282 | ---- | C] () -- C:\Windows\tasks\DSite.job
[2013/06/29 20:17:35 | 000,007,985 | ---- | C] () -- C:\Users\user\AppData\Local\recently-used.xbel
[2013/06/29 17:36:50 | 000,000,282 | ---- | C] () -- C:\Windows\tasks\PC Performer_UPDATES.job
[2013/06/29 17:36:50 | 000,000,274 | ---- | C] () -- C:\Windows\tasks\PC Performer_DEFAULT.job
[2013/06/28 22:04:25 | 000,054,272 | -H-- | C] () -- C:\Users\user\Documents\photothumb.db
[2013/06/28 20:44:38 | 000,000,898 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
[2012/07/01 11:17:11 | 000,000,827 | ---- | C] () -- C:\Windows\wiso.ini
[2012/01/20 19:25:01 | 000,004,096 | -H-- | C] () -- C:\Users\user\AppData\Local\keyfile3.drm
[2011/10/14 17:57:51 | 000,000,052 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/01/09 16:27:21 | 000,000,101 | ---- | C] () -- C:\Users\user\AppData\Roaming\default.pls
[2010/12/08 17:39:15 | 000,056,320 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/16 16:28:14 | 000,001,024 | ---- | C] () -- C:\Users\user\.rnd
[2010/11/08 10:31:12 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:4CF61E54
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:798A3728

< End of report >
--- --- ---

Und der zweite Logfile:
OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 7/3/2013 4:23:12 PM - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\user\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.85 Gb Total Physical Memory | 2.05 Gb Available Physical Memory | 53.15% Memory free
7.71 Gb Paging File | 5.35 Gb Available in Paging File | 69.43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 179.00 Gb Total Space | 16.27 Gb Free Space | 9.09% Space Free | Partition Type: NTFS
Drive D: | 266.67 Gb Total Space | 133.83 Gb Free Space | 50.19% Space Free | Partition Type: NTFS
 
Computer Name: AP-*** | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_USERS\S-1-5-21-3457901039-3679683318-3372754741-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05653917-6364-4E03-AD6F-0334F55BD3C0}" = lport=137 | protocol=17 | dir=in | app=system |
"{0AD5EA90-4C61-4BFD-B630-69A0F5B5CD7E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1CDD7A00-4E07-401B-A47D-B24721DB5837}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1D129FF2-37E9-4B83-9029-5806A244570E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2AF358EE-954A-46D0-9940-6D8A23EAE1E1}" = rport=445 | protocol=6 | dir=out | app=system |
"{52FCB7C0-1D41-4427-8306-F69741B878CB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6256DA94-CF74-4C3F-BCB0-D6EC867384A5}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{65DE1AC9-37E6-483D-BA3D-B733528D31DD}" = rport=139 | protocol=6 | dir=out | app=system |
"{6891CF6B-224D-451F-B616-5D77FEB8AB6A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{6B4DB886-399B-43ED-A20C-78DFF062C69B}" = lport=10243 | protocol=6 | dir=in | app=system |
"{8A612414-687B-4FD2-B2CF-6C6E75957F55}" = lport=139 | protocol=6 | dir=in | app=system |
"{A844D4D0-F6FB-4759-B828-411B6CADEDCD}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AD281432-B033-44C1-A697-359D437BBDE7}" = lport=138 | protocol=17 | dir=in | app=system |
"{B39F758F-3FB2-4949-91F2-8610E3B5DDFF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B4D7E6B7-879E-48BA-A3FB-B83C19E9303F}" = rport=10243 | protocol=6 | dir=out | app=system |
"{B65DE5FD-6047-4B63-B742-B16B51116FEE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D313AE16-7F22-488F-8CBD-8176B979E8F8}" = lport=445 | protocol=6 | dir=in | app=system |
"{E0EDBD07-4E94-419A-92BD-E1E562FC7A9D}" = rport=138 | protocol=17 | dir=out | app=system |
"{E411663B-BC3E-42E4-AD9B-FE3EDE68237E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{ED3DC4E9-B368-47A7-B094-80F5C74130A5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EF1787CF-D80B-481F-95C1-4143CB116CA6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F0FA784F-B08F-4F4C-B535-7B728982C46F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{F7A78CCF-4BE2-44D0-A990-16AD4E01FA62}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F81C95E5-80AB-4A5F-AC6D-25E9036EA5C2}" = rport=137 | protocol=17 | dir=out | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{025F2D66-20D8-4D30-8AF5-0BD0636E0426}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{0A1FF716-1827-4906-9E34-B4B96B401DF1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0F59E276-D0D8-4C1E-BF79-F872C83B4E9F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1643A5BB-8E3C-47B5-A6B0-DD7AA5D7C7E2}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{16CE2825-4156-4B11-831E-D646B3D92465}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{172A93DE-1C76-4CB8-9D2F-959F594E78F6}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{23211A7B-01EA-41B3-AF39-E249B132A849}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{248EEA55-FAB9-4D30-9824-D0B0D8B37177}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{27E24FA6-3143-4DCF-BF73-3762DDA29AE9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2B77E7F9-CB04-41F3-9126-24BC0446D625}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\raceroom racing experience\rrrlauncher.exe |
"{2F995BFF-4124-4D3D-8C43-95A10C080DE7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{301F8040-3155-4BB4-8637-444AA2BCEADC}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{3059F974-4A92-4F5B-92DE-77213E97B4CD}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{306A0459-E817-4128-A173-E8CF48F863EC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f1 2012\f1_2012.exe |
"{3E954C78-9DA9-4CE2-8F37-6FC27D929BCD}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{41B6AA88-3D14-430E-9B58-38DE085CF088}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{41E81C0C-1658-4F1D-A69B-56AC097A999A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5F37AE75-EFB4-4165-BD8F-C6FC5594B9AB}" = dir=in | app=c:\users\user\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{62D19215-FE70-44A5-A676-6F8E0F69363E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{68D12C00-9CDF-417F-BC0B-E5C069BE9366}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{76054C99-5CAB-4466-B6FC-E08F1D06185D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{760C966B-2BDE-455B-B005-7D26B007F06C}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{7C5A26E0-2D3A-40C0-8FE8-E748F86D1FBD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f1 2012\f1_2012.exe |
"{7D424ACE-BDC9-4913-8BA8-16BC0FD30A95}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{86755DBE-83E4-40CF-A2AA-0A2A8ECF9606}" = dir=in | app=c:\program files (x86)\htc\htc sync manager\htc sync\htcsyncloader.exe |
"{89BACF92-5F83-44F5-93F6-45157E5A6B2B}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8BA8B49A-B5A0-4D63-BB07-37F6D236668F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f1 2012 demo\f1_2012.exe |
"{8C298F23-1440-4517-A974-825695302B3B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{99D5035F-5417-4025-BCD1-9BF8A239CDE0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A16A5355-4C8A-4C91-8039-952A3F3E4066}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{A3D726DC-94D7-413D-86EE-AB1F76FA1B8A}" = dir=in | app=c:\program files (x86)\common files\nokia\service layer\a\nsl_host_process.exe |
"{A4E1DA26-28E1-42D8-88D9-7CCCCD666545}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\raceroom racing experience\rrrlauncher.exe |
"{ABE7CA88-C1F0-447B-BD0E-23C691FE6313}" = dir=in | app=c:\program files (x86)\nokia\nokia ovi suite\nokiaovisuite.exe |
"{ADE28D26-ACF5-4403-B089-03870B791067}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\raceroom racing experience\rrrlauncher.exe |
"{AF65C5E0-53CF-47F7-87D0-CE86E29663E2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BB2FDF3C-15FC-4DF5-A23C-F9533E397013}" = dir=in | app=c:\program files (x86)\common files\mcafee\mna\mcnasvc.exe |
"{BED1C92D-7C6F-47B9-B6CF-8B2510FDD79F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CBD4D459-135F-4576-B84D-1426D7EB31EE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f1 2012\f1_2012.exe |
"{CC97A1B2-5FC8-4DDA-9F96-0246CF61C9AB}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f1 2012 demo\f1_2012.exe |
"{D4FDD0A0-658C-4F30-A738-20C08D697F16}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\f1 2012\f1_2012.exe |
"{D80F7F05-6F13-472A-9F14-F40EFF9D6A02}" = dir=in | app=c:\program files (x86)\nokia\nokia suite\nokiasuite.exe |
"{DB6C9FE4-0187-4134-815E-8656D5499289}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E0008838-FC08-4060-B8BC-E5A11D7DD75C}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{F19CAEE6-5F65-4CF2-965F-A0FF688B9A59}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\raceroom racing experience\rrrlauncher.exe |
"{F3D29469-047D-49B8-9980-172770AB50F5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{F792DB1E-5F97-4208-9AF5-13717DB80C8E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F829CFB1-6AAE-4E77-8257-E0822E4EAEDB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F8FFBB6E-6629-4759-98F3-4FF53B8DBFD6}" = protocol=6 | dir=out | app=system |
"{FBF9E22E-94EB-4A59-8BDD-F3CCEDB0D8C0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{5E16DFF2-40D0-4F4E-8EAE-EDBD250E53B7}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
"UDP Query User{074E85C2-6F1B-40AC-B7DD-73795EDFAD09}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6100_series" = Canon MG6100 series MP Drivers
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{AF5020D9-116A-46AC-A922-087592F37EC9}" = MobileMe Control Panel
"{BCD55450-77AC-4347-B24F-654B1189F8D4}" = SpyHunter
"{D0CB24F4-084F-40DE-B6B9-A03626E682F0}" = iCloud
"{D954C6C2-544B-4091-A47F-11E77162883E}" = Microsoft Security Client
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F82D3110-2996-B896-9ADC-394C18071095}" = ccc-utility64
"{F8FEEFC0-D7D6-9A40-28E9-1E7A6716E803}" = ATI Catalyst Install Manager
"Broadcom 802.11 Network Adapter" = Broadcom 802.11 Network Adapter
"Elantech" = ETDWare PS/2-x64 7.0.7.0_WHQL
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"GIMP-2_is1" = GIMP 2.8.6
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Stellarium_is1" = Stellarium 0.12.1
"VLC media player" = VLC media player 2.0.5
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{058E7BC0-15C3-D5F6-FD8D-34E4B44E4F82}" = CCC Help Thai
"{085C9E07-E122-DECF-350D-5CB3594EC54D}" = Catalyst Control Center Graphics Previews Common
"{08B67A13-8501-48CB-B747-9D413BDC4594}" = BatteryLifeExtender
"{0E806605-5B82-4A4F-BC31-AA4FADA03C42}" = t@x 2012
"{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}" = Windows Media Center Add-in for Silverlight
"{0F796312-289C-40CA-856C-9FBCF5E83342}" = REALTEK Wireless LAN Software
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{11A5DA06-82B8-B47C-B6A9-6BFA8008108C}" = CCC Help Dutch
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4
"{15B2BC56-D179-4450-84B9-7A8D7F4CE1B9}" = Lexware Info Service
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{283EFC5E-041A-4AC7-8824-2F33695EBC11}" = CCC Help Korean
"{2D4E3A20-01D9-713F-2CD5-15FBD9312F28}" = CCC Help Chinese Traditional
"{2DDC70C1-C77A-4D08-89D2-9AB648504533}" = Easy Content Share
"{31CABF76-F113-30F6-1BF1-19CA660C72B4}" = CCC Help Finnish
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{41CE67B3-7766-4CC0-9E5A-D28DF12072E7}" = HTC Sync Manager
"{43609114-F9B7-48AA-BAAC-F320BB5E88DD}" = CCC Help Spanish
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A331D24-A9E8-484F-835E-1BA7B139689C}" = EasyBatteryManager
"{4A87034C-621A-DAC1-D7C3-FB9102A453D4}" = CCC Help Japanese
"{4AA68A73-DB9C-439D-9481-981C82BD008B}" = Nokia Connectivity Cable Driver
"{4B526075-AF27-47A2-860D-3DA92928A051}" = Steuer 2010
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{4FBB6BFD-774C-E86B-84E6-23C08FD76C0C}" = Catalyst Control Center Graphics Light
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{6737F045-A91A-4177-9C8C-59460FC1C84D}" = t@x 2013
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BCE77FA-82A3-E502-0956-AA9AE0E169D0}" = CCC Help English
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6D7798B0-4DE4-4F44-ABF3-D7FD57A08266}" = Clever Steuern sparen 2010
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78FDD286-2C51-17B5-22BC-DA769D237E1A}" = CCC Help Swedish
"{79B0F7B2-31BD-D377-CCA2-F647601283C0}" = CCC Help Polish
"{80059A57-F141-5556-7FA2-CD97EB8A05F9}" = CCC Help Danish
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110109903}" = Flip Words
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110160733}" = Slingo
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110245793}" = Insaniquarium Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110521483}" = Gem Shop
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}" = Mahjong Escape Ancient China
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111768557}" = Bonbon Quest
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}" = Alice Greenfingers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113128447}" = Daycare Nightmare
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8FB2A014-A0B0-42D8-8E18-9AFC6A6E2814}" = Seagate DiscWizard
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92D1CEBC-7C72-4ECF-BFC6-C131EF3FE6A7}" = Nokia Suite
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1
"{983D01A7-FD14-5F70-9A46-3DBE1C0A3FFF}" = Catalyst Control Center InstallProxy
"{989FB5FD-9B00-4B32-8663-849CB1370DD1}" = Google Drive
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C51C947-7E8D-3EEB-6087-276446E4914C}" = CCC Help Hungarian
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9F1A6A24-4901-42F6-A355-5DD2B82E62AE}" = Samsung Drive Manager
"{A2AA4204-C05A-4013-888A-AD153139297F}" = PC Connectivity Solution
"{A5CCD0C8-6D5E-4515-BDD7-2A22D5D91031}" = Nero 8 Essentials
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B1FA9E3F-86F3-136A-84DA-809A40458243}" = CCC Help Russian
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D8DC8C-F077-4631-A221-4D5E1D8E87E7}" = Catalyst Control Center - Branding
"{B7FB9C80-A61F-6BFE-7F93-C493AC3F9E91}" = CCC Help Turkish
"{B91B9BD2-C3D1-2632-26C9-170EB39CADAC}" = CCC Help Greek
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BD8D4FE1-8E1D-2D41-ED33-3E2B64ED3AF3}" = CCC Help Chinese Standard
"{C28CE716-3F07-528A-6CC8-FDF2865BCAAF}" = ccc-core-static
"{C4582EED-A3FB-4358-8F3F-8C994460DF28}" = EasyFileShare
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C9F9C082-A19F-9672-4F78-CC93F363A07D}" = CCC Help Norwegian
"{CEF185AA-392D-82EF-339B-F36547C0D9F8}" = Catalyst Control Center Core Implementation
"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program
"{D1886477-86CD-8365-CE96-42AD6F950ED0}" = CCC Help Italian
"{D1F6FBBB-B204-459A-9BF8-D06FFAB96CCC}_is1" = Game Pack
"{D1FAD629-67C3-B9D5-FD06-73A4EF76528A}" = CCC Help Portuguese
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{D53D7F78-94AC-CE27-199E-5F509437C7E6}" = Catalyst Control Center Graphics Previews Vista
"{D55BE2BD-14D6-E8AA-A1C0-519C50E28EB2}" = Catalyst Control Center Graphics Full Existing
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{DCADA7D3-8142-4352-AE01-873F890A7340}" = Heyer's Adventskalender 2
"{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}" = AAVUpdateManager
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E91CD838-0ED0-0BCD-ECAF-1A089F1A27E5}" = CCC Help Czech
"{EF1E3D76-6F52-3F63-6848-346ACD86096D}" = CCC Help German
"{F0B13553-B3CA-76A9-182A-9E352F4EB749}" = Catalyst Control Center Graphics Full New
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F6340C10-589F-7D1E-1819-2F8CF6247505}" = CCC Help French
"{F687E657-F636-44DF-8125-9FEEA2C362F5}" = Samsung Support Center
"{F771F1D4-EDD4-4D68-82DC-811583C099CD}" = Easy Network Manager
"{FFE45CD9-4070-78E3-5794-8575B389336E}" = Catalyst Control Center Localization All
"82A44D22-9452-49FB-00FB-CEC7DCAF7E23" = EA SPORTS online 2006
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AlpenOnlineViewer_is1" = 3D RealityMaps Viewer 1.2.5.3
"CameraWindowDC8" = Canon Utilities CameraWindow DC 8
"CameraWindowLauncher" = Canon Utilities CameraWindow
"Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data
"Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MG6100 series Benutzerregistrierung" = Canon MG6100 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"Delta Chrome Toolbar" = Delta Chrome Toolbar
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-PhotoPrint Pro" = Canon Easy-PhotoPrint Pro
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"FreePDF_XP" = FreePDF (Remove only)
"Google Chrome" = Google Chrome
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"IrfanView" = IrfanView (remove only)
"K-Meleon" = K-Meleon 1.5.4 de-DE (nur entfernen)
"Lidl-Fotos_is1" = Lidl-Fotos
"Marvell Miniport Driver" = Marvell Miniport Driver
"McAfee Security Scan" = McAfee Security Scan Plus
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MovieUploaderForYouTube" = Canon Utilities Movie Uploader for YouTube
"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"MyCamera" = Canon Utilities MyCamera
"NAVIGON Fresh" = NAVIGON Fresh 3.4.0
"Nokia Suite" = Nokia Suite
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PC Performer_is1" = PC Performer
"PhotoScape" = PhotoScape
"PhotoStitch" = Canon Utilities PhotoStitch
"Scribus 1.4.2" = Scribus 1.4.2
"ST6UNST #1" = Transalp
"Steam App 208500" = F1 2012
"Steam App 211500" = RaceRoom Racing Experience
"VLC media player" = VLC media player 0.9.9
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3457901039-3679683318-3372754741-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"DSite" = Update for Video Converter
"fbDownloader" = FBDownloader
"GeoGebra WebStart" = GeoGebra WebStart
"PhotoFiltre 7" = PhotoFiltre 7
"Video Converter Packages" = Video Converter Packages
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 6/29/2013 1:27:46 PM | Computer Name = AP-*** | Source = Application Hang | ID = 1002
Description = Programm gimp-2.8.exe, Version 2.8.6.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 670    Startzeit:
01ce74eaaa9f3ff6    Endzeit: 12    Anwendungspfad: C:\Program Files\GIMP 2\bin\gimp-2.8.exe

Berichts-ID:
 3328d87d-e0e1-11e2-881c-002454b07c8e 
 
Error - 6/30/2013 7:35:13 AM | Computer Name = AP-*** | Source = Application Hang | ID = 1002
Description = Programm NOTEPAD.EXE, Version 6.1.7600.16385 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: fb0    Startzeit: 01ce7585d354ea7d    Endzeit: 3    Anwendungspfad: C:\Windows\system32\NOTEPAD.EXE

Berichts-ID:
 1e2b016d-e179-11e2-abec-002454b07c8e 
 
Error - 6/30/2013 1:18:11 PM | Computer Name = AP-*** | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: PCPerformer.exe, Version: 11.10.1.2243,
 Zeitstempel: 0x50d1954d  Name des fehlerhaften Moduls: PCPerformer.exe, Version:
11.10.1.2243, Zeitstempel: 0x50d1954d  Ausnahmecode: 0xc000001d  Fehleroffset: 0x000b0048
ID
 des fehlerhaften Prozesses: 0xadc  Startzeit der fehlerhaften Anwendung: 0x01ce75b51b60a7db
Pfad
 der fehlerhaften Anwendung: C:\Program Files (x86)\PC Performer\PCPerformer.exe
Pfad
 des fehlerhaften Moduls: C:\Program Files (x86)\PC Performer\PCPerformer.exe  Berichtskennung:
 09ba622a-e1a9-11e2-aa10-002454b07c8e
 
Error - 6/30/2013 1:18:11 PM | Computer Name = AP-*** | Source = Application Error | ID = 1005
Description = Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen
 werden:  Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der
 gespeicherten Datei bzw. den auf dem Computer installierten  Speichertreibern, oder
 der Datenträger fehlt.  Das Programm PC Performer wurde wegen dieses Fehlers geschlossen.

Programm:
 PC Performer  Datei:    Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1.
 Öffnen Sie die Datei erneut.  Diese Situation ist eventuell ein temporäres Problem,
 das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.  2.  Wenn
 Sie weiterhin nicht auf die Datei zugreifen können und  - diese sich im Netzwerk
befindet,  dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem
 besteht und dass eine Verbindung mit dem Server hergestellt werden kann.  - diese
 sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet,
 überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.  3. Überprüfen
 und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu
 im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben
 Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4.
 Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin
 besteht.  5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet
 werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
  Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware,
um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.    Zusätzliche
 Daten  Fehlerwert: 00000000  Datenträgertyp: 0
 
Error - 6/30/2013 1:24:12 PM | Computer Name = AP-*** | Source = System Restore | ID = 8193
Description =
 
Error - 7/1/2013 1:32:31 PM | Computer Name = AP-*** | Source = System Restore | ID = 8193
Description =
 
Error - 7/2/2013 11:08:55 AM | Computer Name = AP-*** | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\$Recycle.Bin\S-1-5-21-3457901039-3679683318-3372754741-1000\$RJMD9FH.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
 
Error - 7/2/2013 1:56:18 PM | Computer Name = AP-*** | Source = System Restore | ID = 8193
Description =
 
Error - 7/2/2013 1:57:21 PM | Computer Name = AP-*** | Source = System Restore | ID = 8193
Description =
 
Error - 7/2/2013 1:57:33 PM | Computer Name = AP-*** | Source = System Restore | ID = 8193
Description =
 
[ Media Center Events ]
Error - 7/11/2012 9:55:27 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 15:55:27 - Fehler beim Herstellen der Internetverbindung.  15:55:27
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 7/11/2012 9:55:33 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 15:55:32 - Fehler beim Herstellen der Internetverbindung.  15:55:32
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 7/30/2012 7:11:54 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 13:11:54 - Fehler beim Herstellen der Internetverbindung.  13:11:54
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 7/30/2012 7:12:04 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 13:12:00 - Fehler beim Herstellen der Internetverbindung.  13:12:00
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 7/30/2012 8:12:10 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 14:12:10 - Fehler beim Herstellen der Internetverbindung.  14:12:10
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 7/30/2012 8:12:16 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 14:12:15 - Fehler beim Herstellen der Internetverbindung.  14:12:15
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 7/30/2012 9:12:22 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 15:12:22 - Fehler beim Herstellen der Internetverbindung.  15:12:22
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 7/30/2012 9:12:28 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 15:12:27 - Fehler beim Herstellen der Internetverbindung.  15:12:27
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 8/2/2012 7:18:18 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 13:18:18 - Fehler beim Herstellen der Internetverbindung.  13:18:18
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 8/2/2012 7:18:27 AM | Computer Name = AP-*** | Source = MCUpdate | ID = 0
Description = 13:18:23 - Fehler beim Herstellen der Internetverbindung.  13:18:23
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 7/1/2013 4:06:12 AM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 7/1/2013 1:21:24 PM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 7/1/2013 1:24:11 PM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst Wlansvc erreicht.
 
Error - 7/1/2013 1:24:41 PM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst Netman erreicht.
 
Error - 7/2/2013 2:41:37 AM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 7/2/2013 10:40:45 AM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 7/2/2013 11:20:08 AM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 7/2/2013 1:43:57 PM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 7/3/2013 12:31:18 AM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
Error - 7/3/2013 8:49:40 AM | Computer Name = AP-*** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Real-time Scanner" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%2
 
 
< End of report >
--- --- ---

[/CODE]

cosinus 03.07.2013 16:34
Rootkitscan mit GMER

Bitte lade dir GMER Rootkit Scanner GMER herunter: (Dateiname zufällig)
  • Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
  • Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei: IAT/EAT und Show All
  • Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
  • Starte den Scan mit "Scan".
  • Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!


Tauchen Probleme auf?
  • Probiere alternativ den abgesicherten Modus.
  • Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.


Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

M.L. 03.07.2013 17:44
Zitat:
Den Rootkitscan mit GMER habe ich bereits ausgeführt und jetzt wollte ich mbar.exe. starten, aber es erscheint folgende Fehlermeldung:"Das Programm kann nicht gestartet werden, da QtGui4.dll auf dem Computer fehlt. Installieren Sie das Programm erneut um das Problem zu beheben."

Ich habe es auch erneut installiert und bin genau so vorgegangen. Aber es erscheint wieder dieselbe Fehlermeldung.

Wie soll ich jetzt fortfahren?
--> Es hat jetzt funktioniert!

Und dies ist die Logfile von GMER:
Code:
GMER Logfile:

       
Code:

       
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-03 18:19:25
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\user\AppData\Local\Temp\uwrdqpod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                              0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[1644] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                             0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1804] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                        0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1804] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                       0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe[1480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe[2236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe[2236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                        0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                       0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe[3972] C:\PROGRA~2\COMMON~1\MICROS~1\WEBFOL~1\pkmws.dll!CreateSemaphoreW + 1          000000004997b150 4 bytes {JMP 0x2bf118f3}
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe[3972] C:\PROGRA~2\COMMON~1\MICROS~1\WEBFOL~1\pkmws.dll!GetModuleFileNameW + 1        000000004997b1be 4 bytes {JMP 0x2bef977b}
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe[3972] C:\PROGRA~2\COMMON~1\MICROS~1\WEBFOL~1\pkmws.dll!GetModuleHandleW + 1          000000004997b1c3 4 bytes {JMP 0x2bef82ce}
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe[3972] C:\PROGRA~2\COMMON~1\MICROS~1\WEBFOL~1\pkmws.dll!RegisterClipboardFormatW + 1  000000004997b420 4 bytes {JMP 0x2c4fea9e}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
?      C:\Windows\system32\mssprxy.dll [4040] entry point in ".rdata" section                                                                                     0000000073e271e6
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\ABRTMon.exe[3368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                              0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Clarus\Samsung Drive Manager\ABRTMon.exe[3368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                             0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5                                 00000000776df991 7 bytes {MOV EDX, 0x756228; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5                                      00000000776dfbd5 7 bytes {MOV EDX, 0x756268; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5                                          00000000776dfc05 7 bytes {MOV EDX, 0x7561a8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5                                   00000000776dfc1d 7 bytes {MOV EDX, 0x756128; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5                                     00000000776dfc35 7 bytes {MOV EDX, 0x756328; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5                                   00000000776dfc65 7 bytes {MOV EDX, 0x756368; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5                                    00000000776dfce5 7 bytes {MOV EDX, 0x7562e8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5                                   00000000776dfcfd 7 bytes {MOV EDX, 0x7562a8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                                             00000000776dfd49 7 bytes {MOV EDX, 0x756068; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5                                  00000000776dfe41 7 bytes {MOV EDX, 0x7560a8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5                                           00000000776e0099 7 bytes {MOV EDX, 0x756028; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5                                     00000000776e10a5 7 bytes {MOV EDX, 0x7561e8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5                                           00000000776e111d 7 bytes {MOV EDX, 0x756168; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5                              00000000776e1321 7 bytes {MOV EDX, 0x7560e8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5                                 00000000776df991 7 bytes {MOV EDX, 0x87a228; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5                                      00000000776dfbd5 7 bytes {MOV EDX, 0x87a268; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5                                          00000000776dfc05 7 bytes {MOV EDX, 0x87a1a8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5                                   00000000776dfc1d 7 bytes {MOV EDX, 0x87a128; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5                                     00000000776dfc35 7 bytes {MOV EDX, 0x87a328; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5                                   00000000776dfc65 7 bytes {MOV EDX, 0x87a368; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5                                    00000000776dfce5 7 bytes {MOV EDX, 0x87a2e8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5                                   00000000776dfcfd 7 bytes {MOV EDX, 0x87a2a8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                                             00000000776dfd49 7 bytes {MOV EDX, 0x87a068; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5                                  00000000776dfe41 7 bytes {MOV EDX, 0x87a0a8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5                                           00000000776e0099 7 bytes {MOV EDX, 0x87a028; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5                                     00000000776e10a5 7 bytes {MOV EDX, 0x87a1e8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5                                           00000000776e111d 7 bytes {MOV EDX, 0x87a168; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5                              00000000776e1321 7 bytes {MOV EDX, 0x87a0e8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationThread + 5                                 00000000776df991 7 bytes {MOV EDX, 0xe3be28; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadToken + 5                                      00000000776dfbd5 7 bytes {MOV EDX, 0xe3be68; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 5                                          00000000776dfc05 7 bytes {MOV EDX, 0xe3bda8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 5                                   00000000776dfc1d 7 bytes {MOV EDX, 0xe3bd28; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection + 5                                     00000000776dfc35 7 bytes {MOV EDX, 0xe3bf28; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection + 5                                   00000000776dfc65 7 bytes {MOV EDX, 0xe3bf68; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtOpenThreadTokenEx + 5                                    00000000776dfce5 7 bytes {MOV EDX, 0xe3bee8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessTokenEx + 5                                   00000000776dfcfd 7 bytes {MOV EDX, 0xe3bea8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 5                                             00000000776dfd49 7 bytes {MOV EDX, 0xe3bc68; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile + 5                                  00000000776dfe41 7 bytes {MOV EDX, 0xe3bca8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 5                                           00000000776e0099 7 bytes {MOV EDX, 0xe3bc28; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcessToken + 5                                     00000000776e10a5 7 bytes {MOV EDX, 0xe3bde8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtOpenThread + 5                                           00000000776e111d 7 bytes {MOV EDX, 0xe3bd68; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile + 5                              00000000776e1321 7 bytes {MOV EDX, 0xe3bce8; JMP RDX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000075c11465 2 bytes [C1, 75]
.text  C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[4100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              0000000075c114bb 2 bytes [C1, 75]
.text  ...                                                                                                                                                        * 2

---- Disk sectors - GMER 2.1 ----

Disk   \Device\Harddisk0\DR0                                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----

--- --- ---
Nach dem ersten Scan durch mbar.exe. ist Folgendes erschienen: "Congratulations, no cleanup is required! Scan Finished: No malware found!" Es gab deswegen auch keinen Neustart.


Dies ist die Logfile:
Code:
Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org

Database version: v2013.07.03.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
user :: AP-*** [administrator]

03.07.2013 18:59:52
mbar-log-2013-07-03 (18-59-52).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 247616
Time elapsed: 30 minute(s), 3 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 03.07.2013 23:00
aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).




TDSS-Killer

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

M.L. 04.07.2013 16:38
Hallo,
es ist ein Problem bei dem Download von aswMBR.exe aufgetreten. Der Download startet nicht aufgrund einer Netzwerk-Zeitüberschreitung. Ich habe es bereits mehr mals versucht.

Gruß M.L. :rolleyes:

cosinus 04.07.2013 19:58
Scheint down zu sein. Mach erstmal tdssiller


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:57 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19