Hallo,
ich habe, denke ich, ein Problem, das schon einige hatten.
Google- Links werden auf Werbeseiten, Verkaufsangebote und weiteres umgeleitet und ich muss 3mal zurückklicken bzw den Link neu anklicken, damit ich auf die richtige Seite komme.
Desweiteren wurde mit der Zeit mein Browser (Firefox) so langsam, dass surfen praktisch unmöglich ist.
Habe mal Firefox neu installiert, ohne Erfolg und habe gelesen, dass da ein Trojaner in meinem Laptop steckt. Mein Anti-Virus Programm (Antivir) findet natürlich nichts....
Kann mir jemand helfen?

Habe Windows7 Home Premium, 64-bit.

Sportliche Grüße und vielen Dank schonmal

hi
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die
  OTL.exe
  .
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die
  Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere
  nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hi,
hier die beiden Files...
otl.txt:OTL Logfile:

OTL logfile created on: 24.05.2012 17:39:00 - Run 1
OTL by OldTimer - Version 3.2.43.1     Folder = C:\Users\Benedikt Frank\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,86 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 58,23% Memory free
7,73 Gb Paging File | 5,89 Gb Available in Paging File | 76,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,62 Gb Total Space | 20,67 Gb Free Space | 34,68% Space Free | Partition Type: NTFS
Drive D: | 574,05 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: SPEEDSTER | User Name: Benedikt Frank | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.05.24 17:36:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Benedikt Frank\Desktop\OTL.exe
PRC - [2012.05.20 19:58:11 | 000,529,232 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2012.05.08 23:26:28 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 23:26:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 23:26:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.03.09 22:52:31 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\Steam.exe
PRC - [2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\Benedikt Frank\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.05.20 19:58:11 | 020,313,384 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll
MOD - [2012.05.20 19:58:10 | 001,099,576 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll
MOD - [2012.05.20 19:58:10 | 000,895,312 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.dll
MOD - [2012.05.20 19:58:10 | 000,190,776 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll
MOD - [2012.05.20 19:58:10 | 000,123,192 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.07.08 05:25:02 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.05.20 19:58:11 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.05.08 23:26:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 23:26:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.05 20:54:04 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.27 01:01:59 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.08 23:26:28 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.08 23:26:28 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.16 17:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.07.08 06:15:50 | 009,884,672 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.07.08 04:47:04 | 000,307,712 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009.10.05 16:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.09.17 20:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 23:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.volley.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CD 9A 1A 7F B9 4E CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {9F9F1FFA-56C4-459C-BCB2-6780932ADE88}
IE - HKCU\..\SearchScopes\{9F9F1FFA-56C4-459C-BCB2-6780932ADE88}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 59899
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.27 01:01:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.27 01:01:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.27 01:01:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.27 01:01:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.27 01:01:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.04.27 01:01:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.07.31 01:02:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benedikt Frank\AppData\Roaming\mozilla\Extensions
[2012.05.02 15:54:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benedikt Frank\AppData\Roaming\mozilla\Firefox\Profiles\mm1ooqcs.default\extensions
[2012.03.19 17:54:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.04.27 01:01:59 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.12.21 07:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.12.21 07:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.12.21 07:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.21 07:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.21 07:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.12.21 07:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Benedikt Frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Benedikt Frank\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{69E7437F-DA56-47A2-9B3D-44D6EAC12782}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{71dfb48d-d269-11e0-b98a-ef36aa4e9f7b}\Shell - "" = AutoRun
O33 - MountPoints2\{71dfb48d-d269-11e0-b98a-ef36aa4e9f7b}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{71dfb499-d269-11e0-b98a-ef36aa4e9f7b}\Shell - "" = AutoRun
O33 - MountPoints2\{71dfb499-d269-11e0-b98a-ef36aa4e9f7b}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{d8d85eae-d0ed-11e0-8172-aebc2aaba205}\Shell - "" = AutoRun
O33 - MountPoints2\{d8d85eae-d0ed-11e0-8172-aebc2aaba205}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{d8d85eb2-d0ed-11e0-8172-aebc2aaba205}\Shell - "" = AutoRun
O33 - MountPoints2\{d8d85eb2-d0ed-11e0-8172-aebc2aaba205}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{e0d947de-d59e-11e0-827c-d3058bddf47b}\Shell - "" = AutoRun
O33 - MountPoints2\{e0d947de-d59e-11e0-827c-d3058bddf47b}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{B5930B6C-394C-4F34-85DE-B91485792E76} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
 
 
MsConfig:64bit - StartUpFolder: C:^Users^Benedikt Frank^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: EA Core - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.24 17:37:00 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Benedikt Frank\Desktop\OTL.exe
[2012.05.24 07:32:35 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{A177B248-0CAA-4A50-9943-14A83E5F5D61}
[2012.05.24 07:32:24 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{3E1806B3-68A7-4F3F-8876-22071201917D}
[2012.05.24 07:32:03 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{8C4E616B-F633-4588-807F-0420D45ADE1B}
[2012.05.23 19:31:50 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{59E4B2BE-3F77-4A39-AC44-1F11C30C01C2}
[2012.05.23 19:31:40 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{94A94627-FFBA-4C3C-9690-91775C648137}
[2012.05.23 17:35:53 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Benedikt Frank\Desktop\dds.com
[2012.05.23 07:31:16 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{539F318F-CC00-4EFB-B531-9B8F7E04E511}
[2012.05.23 07:31:06 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{0802774F-FE34-4817-B375-BFDCD447C67A}
[2012.05.23 07:30:44 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{B3C1D2AA-8E5E-4EFE-BB5D-24E85FE31326}
[2012.05.22 19:30:31 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{9A9D1DFE-A02D-4806-87CC-24CB6735656D}
[2012.05.22 19:30:21 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{370EA4DC-BC18-4C4F-81CE-013C28CA65FB}
[2012.05.22 19:30:10 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{0E7E16A4-824D-4352-BEB7-C54BF293CAF1}
[2012.05.22 19:29:59 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2E074DDC-AB0D-4093-98C4-53A7B69E5466}
[2012.05.22 17:05:56 | 000,000,000 | ---D | C] -- C:\ProgramData\GFI Software
[2012.05.22 16:14:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.05.22 16:14:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.05.22 16:14:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2012.05.22 07:29:35 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6C693239-FD2F-45D6-9A76-CD851F860E8A}
[2012.05.22 07:29:24 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{78C44C3F-BF99-44C3-9576-802DC6681E0E}
[2012.05.22 07:29:03 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{EBC4A21F-EE7A-4DD9-8080-49C1F53FC899}
[2012.05.21 19:28:50 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{350B38B0-BDD9-4FE7-BA27-97A78B2412E6}
[2012.05.21 19:28:40 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{A965C6B7-2049-403C-8E47-ECD62DF72AA6}
[2012.05.21 19:28:18 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{ED82CE4C-44CE-4AB8-A0AA-B672B635C2A0}
[2012.05.21 07:28:06 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{C4F509E0-DD96-4135-AA66-39B7BD69B884}
[2012.05.21 07:27:56 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{93AFDB58-DF48-45BC-AED3-B38D27709E77}
[2012.05.21 07:27:45 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{A1851634-6B97-41F0-8F18-12AE69CA8DA7}
[2012.05.21 07:27:34 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{71ECD140-91C4-4207-84FE-8C572966B450}
[2012.05.20 11:37:22 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{DF07807A-887F-484C-ABA0-31AB0152398B}
[2012.05.20 11:37:12 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{C5DAA15C-B5C0-4B54-A0C6-10A963631CBA}
[2012.05.20 11:37:01 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D6BD107B-0D3B-4508-BE56-04600B33A966}
[2012.05.19 23:36:37 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{77A7BAE7-F2B4-46EB-96E9-EA698F6342F0}
[2012.05.19 23:36:27 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6CA5474D-A55C-45BF-87F6-C368E9F70E7B}
[2012.05.19 23:36:05 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{B397690A-0B09-4314-8FED-4D3AAE1431F3}
[2012.05.19 11:35:52 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{9EDD7CE1-5AC5-4473-876F-550EE80F65CE}
[2012.05.19 11:35:42 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{4DA087B2-DDB3-4F54-968A-C89259F95E8F}
[2012.05.19 11:35:31 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{EFB01AEB-8054-4170-ACF8-D5BEEF732C5B}
[2012.05.19 11:35:20 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E1BB5D9E-D55E-4686-B1D4-E944C973BE6B}
[2012.05.18 23:34:54 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6AA7A1D7-1D8C-4138-8B57-192C43BCD83E}
[2012.05.18 23:34:44 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{0DCF5892-4739-4DDD-A2FA-1A003D212C42}
[2012.05.18 11:34:20 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{5545601B-DFD9-4C55-A8C8-8DF0C018EC63}
[2012.05.18 11:34:06 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{80262B48-EDF5-4DCA-881F-08EB856B5CCE}
[2012.05.17 14:31:54 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{060ABB0E-9F64-4F48-8F91-4A77DB13950F}
[2012.05.17 14:31:44 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{BE9EFFB4-76C5-4A62-9171-9FCF5D40F6BB}
[2012.05.17 14:31:33 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{8CACFB8B-B4CE-4FCD-A7C5-16110A7E9EBA}
[2012.05.17 14:31:22 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{608920E2-D1EF-417D-8D3A-9139618A4CCF}
[2012.05.17 02:30:57 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{466DC8B7-6319-4BA5-AAF0-184AC7503444}
[2012.05.17 02:30:46 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{86414917-88BF-4F66-888F-1D5877ED2753}
[2012.05.17 02:30:36 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{537C602F-A767-4E9A-B703-76B2FDC02D26}
[2012.05.16 14:30:12 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D8A3A347-A6F8-44D5-8FAE-1E3E81D26846}
[2012.05.16 14:30:02 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{C1BB60D2-3F68-4CDF-9688-EBB6EC09312D}
[2012.05.16 14:29:51 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{416BAF8F-7BCA-4CB3-BEB4-6E59DA06345B}
[2012.05.16 14:29:39 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{058E0CF2-E0B2-4CB1-9A47-FC5E3E0B5686}
[2012.05.16 02:17:31 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D144F3F6-558F-4683-9210-F496EF995839}
[2012.05.16 02:17:20 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{18AF329B-14FF-4794-846B-6AC2D5CD1CA6}
[2012.05.15 14:16:55 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{766B89BC-80B5-42B7-BF37-D101BAFA759B}
[2012.05.15 14:16:44 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{12D9F60A-876F-482F-9C33-8993C452FE36}
[2012.05.14 22:14:33 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{F7F44EAD-C812-4995-BF80-113DE3CFF4DD}
[2012.05.14 22:14:23 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{44F7501E-8A48-464C-9F7F-85564C13239E}
[2012.05.14 22:14:12 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{04C07414-E3D2-464F-8C56-532059A66682}
[2012.05.14 10:13:49 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{77F4AED7-A308-4647-8424-F7F41650083A}
[2012.05.14 10:13:38 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{A873C826-4B19-4693-A0AB-4AD2E7AAD70E}
[2012.05.14 10:13:28 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{81CE74B7-AB82-4CC0-BBB8-B41160074CFD}
[2012.05.13 22:13:04 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{644436AA-07C3-485B-879A-6CF4E337CA9B}
[2012.05.13 22:12:54 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{58309527-692F-4015-9F63-451E68A16B1D}
[2012.05.13 22:12:31 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{7AE6E60C-1C91-40E3-952B-D78C5A35D5EF}
[2012.05.13 10:12:19 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E566AED5-1B00-4808-895A-221B26DBFE4F}
[2012.05.13 10:12:09 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{AB0E247A-1E56-48E7-8E97-769DCCEFE754}
[2012.05.13 10:11:58 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{8A83926F-4721-495B-95AB-194083D1FA2B}
[2012.05.12 22:11:35 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{78F8436E-4905-4902-A0DF-71B1B51B3FFD}
[2012.05.12 22:11:25 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{AB0DA48C-5C7B-46E4-B6D2-DB9B53E08595}
[2012.05.12 22:11:03 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{3747FC2F-7226-462B-8F15-D27435A61BFF}
[2012.05.12 10:10:51 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2B317DFA-CA10-4EB2-8116-6A38D9AABA92}
[2012.05.12 10:10:40 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E878A1AA-002B-46A3-A918-A75BCA288A88}
[2012.05.12 10:10:29 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{7F8C9F61-5D73-49C9-8E87-896179C23407}
[2012.05.11 22:10:06 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{5D160217-423E-458E-AFAD-1C0B02C0B75E}
[2012.05.11 22:09:55 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{A17E6D35-0500-4021-89CD-F0B5AA206A5D}
[2012.05.11 22:09:34 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{F67E00D6-FA4C-4241-8582-B13EEE71A704}
[2012.05.11 10:09:22 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{BAAA9069-43BB-45A8-AE65-EF195917AEC8}
[2012.05.11 10:09:11 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D233D104-C9DF-4486-808C-1A9CEEBA1215}
[2012.05.11 10:09:00 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{7A556375-C638-490D-A868-C73823BACACA}
[2012.05.11 10:08:50 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{82DABFB2-46D0-4FE2-BFFB-DA98C1DA96F0}
[2012.05.10 22:08:25 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{77734BF0-A2C8-4766-926A-A1E5DAD4F00D}
[2012.05.10 22:08:14 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{4D0CEC53-2033-4028-BB02-AEAA093F2E60}
[2012.05.10 22:08:03 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{CEC38E49-B6B3-40CC-8BEB-241D71355A8D}
[2012.05.10 10:07:40 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{AE03E938-6FF9-4674-9381-62393720F586}
[2012.05.10 10:07:29 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{409971C9-037B-439E-A407-5A78B7CAE5E6}
[2012.05.10 10:07:19 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{93E5D477-2226-4A0A-93B5-DDF7EE648D76}
[2012.05.09 22:06:56 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{10CA0C71-8E17-4556-B6D3-058ABC6620E7}
[2012.05.09 22:06:45 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{5F95A173-1CA2-4CD8-9364-EC3E1358819E}
[2012.05.09 22:06:34 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{3F1410C1-FA73-423F-9A23-4BE33350B02E}
[2012.05.09 10:06:11 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{BD31DDB3-FC26-42AA-B90B-77A01403F20F}
[2012.05.09 10:06:00 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{18B9C965-DA68-4FCB-BA04-5C1B4DC65368}
[2012.05.09 10:05:39 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{A71DCCD2-5B15-43C3-8839-0DCFE0FAEC9A}
[2012.05.08 22:05:26 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E63A323A-E3F3-40C3-8709-930E48A2F4ED}
[2012.05.08 22:05:16 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{B74570F6-013D-422C-9724-C99E80EFACC9}
[2012.05.08 10:04:52 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D3FCA1FA-056D-40D4-8D0C-33A05E4A7419}
[2012.05.08 10:04:42 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{93B9E7C9-2F0A-478D-9908-E27890C8D446}
[2012.05.08 10:04:31 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{0715F635-D9C9-4D5B-A657-DA60C05E4A32}
[2012.05.08 10:04:20 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{03957815-6529-4F61-BCE1-CC85FC04C8E2}
[2012.05.07 22:03:54 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{41D534B7-EE73-4BD1-8317-3843D67BDB13}
[2012.05.07 22:03:43 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{A8C03129-3E53-41D5-8136-9932F42E6C85}
[2012.05.07 22:03:33 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{57810A52-4688-41BB-B17C-A2ED3CA6CFEA}
[2012.05.07 22:03:22 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{162758DB-6B14-48D8-8DE4-2F2FDF25F47D}
[2012.05.07 10:02:57 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{7661CBB7-D7F4-4FE3-9D50-F56251E7DA4B}
[2012.05.07 10:02:44 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6DC9D39D-A9A5-4A61-BBB7-AFC677F425EE}
[2012.05.07 10:02:33 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{843D2420-0F89-47CF-B482-C5D9D330A6B0}
[2012.05.07 10:02:22 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{394CACF9-CE5D-4C43-9EF0-03150421ECFD}
[2012.05.06 20:26:24 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{972F3E8E-8117-409B-AC64-214B545CF31E}
[2012.05.06 20:26:14 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{4DB2CF9B-9B9F-4200-AF3D-DDEB85A9288B}
[2012.05.06 20:26:03 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E3EEB2E4-F59D-42BF-AD5F-481CC0F480DF}
[2012.05.06 20:25:52 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{174C39C2-3D56-4154-BC3B-8463963ABB08}
[2012.05.06 08:25:27 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{84A89826-86A7-43F0-BBAB-E68B2C923A15}
[2012.05.06 08:25:17 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{EC2A0B11-B4D0-43F3-AABA-69D5CB6BDDD1}
[2012.05.06 08:24:55 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D48E1230-507B-4B16-A39A-9C5BD65FB904}
[2012.05.05 20:24:42 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{99C45627-6745-4CB4-8DA6-42CA2FA811A5}
[2012.05.05 20:24:32 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{BBD72781-1957-4948-851D-C7418C7F9108}
[2012.05.05 20:24:21 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{82CA10BD-C3DF-4569-A3FD-827A51581567}
[2012.05.05 08:23:57 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{7677F3F0-B667-4A70-9F4C-1DF191655C48}
[2012.05.05 08:23:47 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{BC79B6FE-8AEF-4DC2-B746-EA545A67FD3A}
[2012.05.05 08:23:36 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D04CFEDC-CA1D-4509-BC42-9093A0AE9B69}
[2012.05.04 20:23:13 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{4C74F2D9-7E9F-4B50-B892-81B78E5F9885}
[2012.05.04 20:23:02 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2BAEBF63-2996-4A81-ADB9-944E5072581A}
[2012.05.04 20:22:51 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2D7D0C3F-4B80-481E-8B23-990382157827}
[2012.05.04 20:22:40 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{F0BC44A4-B511-4342-B67B-5491B7546271}
[2012.05.04 08:22:15 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{73764C40-1DA8-473C-B94B-7B7E49FFC913}
[2012.05.04 08:22:04 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{1FBD39F5-47B9-4130-B856-EA5170D2050F}
[2012.05.03 12:09:21 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{57432D48-1DF2-49B3-AF69-88830D16FAEC}
[2012.05.03 12:09:10 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{94B9E32A-6EDC-4423-888A-E092B5E9C928}
[2012.05.03 12:09:00 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E1E2CB14-6E0E-48D9-BB1A-22D280167BDA}
[2012.05.03 12:08:49 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E0E69C4D-A245-4B3D-88B5-D965AB7742A2}
[2012.05.03 00:08:24 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{84E8F0B9-D699-4627-AED6-E8263064A038}
[2012.05.03 00:08:13 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6556CEFD-0B5A-4097-8F51-2ECF293B749C}
[2012.05.03 00:08:03 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{9558824B-A452-479D-BB19-39F925950B76}
[2012.05.03 00:07:52 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D77030BD-C28A-4B8E-A742-9197B1394130}
[2012.05.02 12:07:27 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{AA3D1D0E-8180-4491-A837-56CBB3766A1E}
[2012.05.02 12:07:16 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{4F2ACF84-5539-4AEF-841F-873C223099BE}
[2012.05.02 12:07:05 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6B60EDB6-2BF2-4E6D-9B5C-BA718CCD1D8D}
[2012.05.02 12:06:54 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{B282BFA1-0FD5-4FC8-B284-BAC266C26F36}
[2012.05.02 00:06:30 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{7DD2F88A-C956-467A-A4A9-79246F1E5C51}
[2012.05.02 00:06:19 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{B61B832D-9515-4046-9562-9188B87CEA79}
[2012.05.02 00:06:08 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2ED23AC3-CDBC-4C22-BAE0-BAAAFECC6779}
[2012.05.02 00:05:58 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{80D1F7D9-B541-480E-858B-4D6C5DB418DD}
[2012.05.01 12:05:32 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{47677027-7FB4-4871-9756-208EDB449987}
[2012.05.01 12:05:21 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{B77BD62F-B78D-4F86-A3F8-5FBCE1314354}
[2012.05.01 12:05:10 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{C580EBE7-118A-457A-A48A-65228E8BFDCE}
[2012.05.01 00:04:47 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{C3C48B1D-126C-4DC8-AA16-F2DFBA435774}
[2012.05.01 00:04:36 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{90E56BC5-0343-4A55-8431-1C6EFECDEB65}
[2012.05.01 00:04:26 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{109ECF49-D6FE-46E7-A3AD-7558A25096C1}
[2012.04.30 12:04:02 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6C989EBE-9BB9-4ABC-99FB-418957656F9E}
[2012.04.30 12:03:51 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{03E64A9E-3F05-4881-8652-E01C2EF5E8AC}
[2012.04.30 12:03:41 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{DB93E67A-C25D-4174-B871-47382E32B110}
[2012.04.30 12:03:05 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{092188F4-B72D-43A4-90B4-29E9E4C8A458}
[2012.04.29 23:38:39 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{8365B33B-4D80-47E5-BF0C-A9AF958901EB}
[2012.04.29 23:38:28 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{C88B9960-F7B6-4FDF-BB43-1DE9CB8E7088}
[2012.04.29 23:38:17 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D04CED33-551D-4D84-90EC-84291FF8C42F}
[2012.04.29 23:38:06 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E3E31A7B-AD02-4183-AF9A-7F3B153DDF95}
[2012.04.29 11:37:42 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{33446AD9-94F9-417B-A0A5-84FE4701B565}
[2012.04.29 11:37:31 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{724D3B75-9ED1-4C1E-B17A-2EBBD9CFBD8C}
[2012.04.29 11:37:21 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{0A4C7121-1F4B-47C4-B9EA-A79E7892C251}
[2012.04.29 11:37:10 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{D7970C6B-38FE-4DFC-A834-BD2C97916AE1}
[2012.04.28 23:36:45 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{3EB05E76-874E-42B1-AE7E-6C09982915C7}
[2012.04.28 23:36:34 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{ADD0965F-4AE5-4411-9489-BF1685C04127}
[2012.04.28 23:36:13 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{E491CBD7-14FD-4EAD-ACFA-47407035B1E1}
[2012.04.28 11:36:00 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{38534FD5-08D7-498F-9EC7-EE8D6F8D3AC6}
[2012.04.28 11:35:49 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{0F466FDB-1FD9-4083-83EB-AB64C654E1F3}
[2012.04.28 11:35:38 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2DEACDE5-BA55-4690-953B-91D3E38A036F}
[2012.04.28 11:35:27 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{CFC43268-9047-4A70-A0C6-2F60F59AE75C}
[2012.04.27 23:35:03 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{666E7255-5277-4893-9A0C-D797657DDB9A}
[2012.04.27 23:34:52 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{6BE1819D-6BF9-4CE4-93FC-04751CBEA3F4}
[2012.04.27 23:34:41 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{677FB271-6340-44EF-A73A-6AC0B72995B0}
[2012.04.27 11:34:17 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{C5F030F6-AB6F-4BD9-846C-1A7A60C07F6F}
[2012.04.27 11:34:07 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{60EE822E-D9D2-416D-96F8-7BD407D7DBB8}
[2012.04.27 11:33:55 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{F5A002F5-069F-4CF1-BABA-8DBE1C42A8BC}
[2012.04.27 01:01:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.04.27 01:01:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.04.26 23:15:05 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{91E91B14-5522-448B-AEC9-7C0D08BE3A77}
[2012.04.26 11:14:41 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{0C56197B-4CF6-42A4-AAFB-98FCCC749083}
[2012.04.26 11:14:30 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2B39BFCD-9C6E-495B-A3B9-523A8BC1FC77}
[2012.04.26 11:14:19 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{F11BA12D-7C8F-4327-9C9F-C5304BBA2E14}
[2012.04.26 11:14:08 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{243DFE4D-4903-4D4D-9883-867B0E65535E}
[2012.04.25 23:13:43 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{039648DF-6E57-47CE-9601-794139BB91DA}
[2012.04.25 23:13:33 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{AB191574-3191-4190-BD42-4D051E567F52}
[2012.04.25 23:13:11 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{8BED562F-6978-4A41-B65D-C87A143065B1}
[2012.04.25 11:12:58 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{2ABEC862-606F-46B6-B287-AC1A4BEB7D03}
[2012.04.25 11:12:48 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{36EF502B-289B-447C-9BF8-9A0D08F52C31}
[2012.04.25 11:12:37 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{CF5F5F0D-6F81-4445-B183-20791FA9137A}
[2012.04.25 11:12:26 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{F9F1AA98-DE1F-4251-8ABD-EA8B5E64A286}
[2012.04.24 23:12:00 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{74F6DCE8-803D-4521-AEAB-E6805197A82D}
[2012.04.24 23:11:50 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{EE74F6DF-5833-4DBC-8B35-0675268D0E72}
[2012.04.24 23:11:38 | 000,000,000 | ---D | C] -- C:\Users\Benedikt Frank\AppData\Local\{21012280-5257-4329-B057-62F296C54DAA}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.24 17:36:44 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Benedikt Frank\Desktop\OTL.exe
[2012.05.24 16:54:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.05.24 12:33:12 | 000,019,104 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.24 12:33:12 | 000,019,104 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.23 23:07:05 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.05.23 23:07:05 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.05.23 23:07:05 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.05.23 23:07:05 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.05.23 23:07:05 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.05.23 17:35:53 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Benedikt Frank\Desktop\dds.com
[2012.05.23 17:33:49 | 000,000,000 | ---- | M] () -- C:\Users\Benedikt Frank\defogger_reenable
[2012.05.23 17:31:50 | 000,050,477 | ---- | M] () -- C:\Users\Benedikt Frank\Desktop\Defogger.exe
[2012.05.22 17:07:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.22 17:07:29 | 3111,501,824 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.22 16:14:58 | 000,001,225 | ---- | M] () -- C:\Users\Benedikt Frank\Desktop\Spybot - Search & Destroy.lnk
[2012.05.11 03:22:36 | 000,292,872 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.05.08 23:26:28 | 000,132,832 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.05.08 23:26:28 | 000,098,848 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.23 17:33:49 | 000,000,000 | ---- | C] () -- C:\Users\Benedikt Frank\defogger_reenable
[2012.05.23 17:31:50 | 000,050,477 | ---- | C] () -- C:\Users\Benedikt Frank\Desktop\Defogger.exe
[2012.05.22 16:14:58 | 000,001,225 | ---- | C] () -- C:\Users\Benedikt Frank\Desktop\Spybot - Search & Destroy.lnk
[2011.12.18 20:49:27 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2011.10.21 12:49:26 | 000,069,632 | R--- | C] () -- C:\Windows\SysWow64\xmltok.dll
[2011.10.21 12:49:26 | 000,036,864 | R--- | C] () -- C:\Windows\SysWow64\xmlparse.dll
[2011.10.03 20:52:14 | 000,005,632 | ---- | C] () -- C:\Users\Benedikt Frank\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.07.30 15:44:09 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.07.07 23:37:28 | 000,053,760 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.03.17 19:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== LOP Check ==========
 
[2011.10.28 12:09:58 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\15632
[2011.08.27 13:58:46 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\AnvSoft
[2011.12.18 23:47:57 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\DesktopIconForAmazon
[2012.05.24 13:36:53 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\Dropbox
[2011.10.17 21:01:46 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\E1315
[2012.01.20 12:44:38 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\IrfanView
[2011.10.01 15:57:55 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\MusicNet
[2012.04.20 11:52:37 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\My Games
[2011.12.18 20:49:26 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\OCS
[2011.08.01 16:27:10 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\OpenOffice.org
[2011.12.18 20:49:29 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\Opera
[2012.02.16 11:55:32 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\PDF reDirect
[2011.08.29 08:30:55 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\PhotoFiltre
[2011.12.18 20:49:44 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\picajet.com
[2011.07.31 23:43:49 | 000,000,000 | ---D | M] -- C:\Users\Benedikt Frank\AppData\Roaming\Windows Live Writer
[2012.02.28 22:20:04 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2011.12.18 18:34:23 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.07.30 15:40:04 | 000,000,000 | ---D | M] -- C:\AMD
[2011.07.30 15:40:42 | 000,000,000 | ---D | M] -- C:\ATI
[2011.10.21 01:00:26 | 000,000,000 | ---D | M] -- C:\BlueByte
[2011.07.31 13:40:22 | 000,000,000 | -HSD | M] -- C:\Boot
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.07.30 13:59:18 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.01.20 14:54:10 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.05.22 17:06:02 | 000,000,000 | ---D | M] -- C:\Program Files (x86)
[2012.05.22 17:06:01 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011.07.30 13:59:18 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.07.30 13:59:18 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.05.24 17:40:03 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.08.17 14:25:37 | 000,000,000 | ---D | M] -- C:\temp
[2011.07.30 13:59:25 | 000,000,000 | R--D | M] -- C:\Users
[2012.04.20 13:57:47 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 03:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\FirewallAPI.dll
 
< %USERPROFILE%\*.* >
[2012.05.23 17:33:49 | 000,000,000 | ---- | M] () -- C:\Users\Benedikt Frank\defogger_reenable
[2012.05.24 17:41:00 | 001,572,864 | -HS- | M] () -- C:\Users\Benedikt Frank\NTUSER.DAT
[2012.05.24 17:41:00 | 000,262,144 | -HS- | M] () -- C:\Users\Benedikt Frank\ntuser.dat.LOG1
[2011.07.30 13:59:27 | 000,000,000 | -HS- | M] () -- C:\Users\Benedikt Frank\ntuser.dat.LOG2
[2011.07.30 14:08:29 | 000,065,536 | -HS- | M] () -- C:\Users\Benedikt Frank\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011.07.30 14:08:29 | 000,524,288 | -HS- | M] () -- C:\Users\Benedikt Frank\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011.07.30 14:08:29 | 000,524,288 | -HS- | M] () -- C:\Users\Benedikt Frank\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011.07.30 13:59:27 | 000,000,020 | -HS- | M] () -- C:\Users\Benedikt Frank\ntuser.ini
[2011.01.19 13:30:10 | 142,700,671 | ---- | M] () -- C:\Users\Benedikt Frank\openofficeorg1.cab
[2011.01.19 13:34:42 | 003,003,392 | ---- | M] () -- C:\Users\Benedikt Frank\openofficeorg33.msi
[2011.01.19 13:33:04 | 000,475,016 | ---- | M] () -- C:\Users\Benedikt Frank\setup.exe
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >
         

--- --- ---



Danke für Deine Hilfe....

OTL EXTRAS Logfile:

OTL Extras logfile created on: 24.05.2012 17:39:00 - Run 1
OTL by OldTimer - Version 3.2.43.1     Folder = C:\Users\Benedikt Frank\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,86 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 58,23% Memory free
7,73 Gb Paging File | 5,89 Gb Available in Paging File | 76,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,62 Gb Total Space | 20,67 Gb Free Space | 34,68% Space Free | Partition Type: NTFS
Drive D: | 574,05 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: SPEEDSTER | User Name: Benedikt Frank | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
https [open] -- "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01E9FBEB-B531-46FE-AEB9-D03276CBB5B4}" = rport=139 | protocol=6 | dir=out | app=system | 
"{27ABCBA4-2F9C-4499-AD87-421E236B6CBA}" = lport=137 | protocol=17 | dir=in | app=system | 
"{2AE61FFA-D228-4150-B81E-262CA633FF97}" = rport=137 | protocol=17 | dir=out | app=system | 
"{32EC9C56-F078-4E1E-843C-7891E76D8072}" = rport=138 | protocol=17 | dir=out | app=system | 
"{3FC492D3-436E-4221-8095-9D05C75E99E4}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{5478EF43-4FB8-4989-A9FC-A0C5736614FF}" = lport=445 | protocol=6 | dir=in | app=system | 
"{5DE120FB-8AFA-4259-8A1C-F364DD537818}" = lport=139 | protocol=6 | dir=in | app=system | 
"{606507CE-B39D-41A0-A07F-2CCB18F75754}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{6DA5F35E-7105-4789-AEEA-F0778E0B05A0}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{7AABCD9C-EC87-423A-A8D4-8F8E4CCDCBC3}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{847CA16E-CF29-43C8-B7AD-CEEFE5613464}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{8800D78E-55A4-48C4-B9F1-2A865654137E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8A9D74CD-6A1F-424E-9290-178579FE2EEA}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{8E90CF4F-8742-4F4C-A742-A0602AAA31EC}" = lport=138 | protocol=17 | dir=in | app=system | 
"{916A8529-FE1A-4453-AC63-668A48BA351F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{99BED1AC-EB26-4082-BDC9-409B50C291F6}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A194A258-E1C0-4E7F-9F53-E419F6811D9A}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B6F7BA91-3543-45C6-A84C-6F1FB4DA986A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{C30D269C-06E0-476C-825E-30081CEA141D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{CE725083-1E68-4C31-BE88-8A9DD6D5A1D1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D112BFDA-5688-4B8C-B6FC-515B682B174B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{E1D6A1FA-AC50-4740-A391-BF721ED99BEB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{EC01E4E6-9F6B-435A-A0AE-719E513E47AB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EC667B26-2AD5-454B-A9EC-1D26395AEFBB}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FF0BF132-FC84-47A5-8A8C-1657600E0A0B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CF302F9-D4C0-4D5F-B7B1-4A33BDD3732E}" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\warlords\civ4warlords_pitboss.exe | 
"{0DB193D9-F4C2-4092-B595-8D7104D887B1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{0DDB70F4-F56A-4BA9-B15B-E0E23C98C16C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{18FF1DED-0E67-432B-911E-126E19C588B6}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{1C87BDB6-0BF3-4F1D-B181-3EBAA68D5EBB}" = protocol=6 | dir=in | app=c:\users\benedikt frank\appdata\roaming\dropbox\bin\dropbox.exe | 
"{1D4331EC-CDC0-4F43-8396-9803EB3225E9}" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\warlords\civ4warlords.exe | 
"{1D522ABE-11E5-41C8-879D-757E16689C1E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization v\launcher.exe | 
"{2344A80B-9361-4F17-8B0C-F8E7671BF1B9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{377A0B1E-81C9-424C-9538-957EA992AE82}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{3ACB125E-CEF7-4EC7-8728-7C2C93ADFEA9}" = protocol=17 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | 
"{3C71DFD1-9061-4E1B-A815-44D38F5A7140}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{418782A6-74CE-49A0-8A88-2AAF086AF093}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4EF8AC61-694A-4C8E-BA6C-762F7E84EA4C}" = protocol=6 | dir=out | app=system | 
"{52EABF2D-7588-4417-9080-0C8F7B83E8D9}" = protocol=17 | dir=in | app=c:\users\benedikt frank\appdata\roaming\dropbox\bin\dropbox.exe | 
"{58114D64-2384-4FAB-8739-7CE4A7C7C6B6}" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\warlords\civ4warlords_pitboss.exe | 
"{5A97FC6B-D7A0-4544-B733-8405A19C29DE}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{5CDC01C1-DAAD-486F-ACEA-5EDC27D5390A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5DE597D5-564F-4186-B335-B93DD21A9B9B}" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe | 
"{605381B0-4245-4CB4-BD66-5686755E4C28}" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe | 
"{69614F21-39E5-4B86-872F-FAD189AB8866}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{72CFC04E-506F-472C-9503-1E0045FBF352}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{7A95A573-36E9-4C9F-9F98-B094AE5190D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7DFB81DC-0AF0-40FA-8EAF-960DA53DB1A4}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{7E508C02-F7DD-4D1C-9F08-E56B3F9FE8E0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{819917B9-8C83-4C8A-A4DA-09315A6F5D98}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{8393C0C3-618B-4F8F-95F9-5BEEB6E90BE0}" = protocol=17 | dir=in | app=c:\users\benedikt frank\downloads\sweetimsetup.exe | 
"{93E4DFD6-EF51-4DB9-AE99-897D545A55B7}" = protocol=17 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword.exe | 
"{9AFFC5AC-7E12-45A8-922A-DF19C76EA526}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{A139A07A-AE76-46B1-A5C9-623C14E25BD1}" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\beyond the sword\civ4beyondsword_pitboss.exe | 
"{B2D250C9-D035-4122-9466-E37A3EC2F7FD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{B4333AB2-CB3D-4904-9B1B-68DDA9CD1506}" = protocol=6 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | 
"{C2D91D49-DB60-42B8-B92D-251DE4B14AF4}" = protocol=6 | dir=in | app=c:\users\benedikt frank\downloads\sweetimsetup.exe | 
"{CA4D821D-9893-4E59-BC68-A1BBE1617502}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DE37B8C9-CCE9-4CE8-8AF8-614F3494B8D5}" = protocol=6 | dir=in | app=c:\program files (x86)\firaxis games\sid meier's civilization 4\warlords\civ4warlords.exe | 
"{E7D093B0-AC90-44BE-B821-B1AFE4A413E0}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{F0BC3FAC-2971-494F-90CC-30C04763D735}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{F4D069B0-CC11-4E73-86D9-298DE165077E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F5D3DAD2-429E-439D-A863-A84AD143BCFF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{FB457C2C-967B-476B-B9C8-960C1676ABBA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization v\launcher.exe | 
"TCP Query User{2FF8AC83-3669-47DE-82D9-E40A84548564}C:\users\benedikt frank\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\benedikt frank\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{409D8C73-1801-48D3-A9C1-B0FB265090B7}C:\program files (x86)\imesh applications\imesh\imesh.exe" = protocol=6 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | 
"TCP Query User{5F3D4498-9B2A-4719-855C-6E4017121D96}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 
"TCP Query User{AD3FFD9A-F0F0-4856-9491-7EF809530D90}C:\program files\spiele\fm 11\manager11.exe" = protocol=6 | dir=in | app=c:\program files\spiele\fm 11\manager11.exe | 
"TCP Query User{B9E22877-758C-4630-B961-23A59C2FBB3E}C:\program files (x86)\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 
"UDP Query User{43790475-89B8-4BCB-894C-73D935011B6A}C:\program files\spiele\fm 11\manager11.exe" = protocol=17 | dir=in | app=c:\program files\spiele\fm 11\manager11.exe | 
"UDP Query User{9A7B6E4F-A710-4BBC-A113-331FC860064B}C:\program files (x86)\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | 
"UDP Query User{9F03577D-4622-4E2A-9CE9-8764E7961ECC}C:\program files (x86)\imesh applications\imesh\imesh.exe" = protocol=17 | dir=in | app=c:\program files (x86)\imesh applications\imesh\imesh.exe | 
"UDP Query User{A6C6D8F8-F5EE-4872-8A00-2E28EA78047D}C:\users\benedikt frank\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\benedikt frank\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{E58DF231-FFDA-4E64-901C-B377EC616B3E}C:\program files (x86)\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\adv\sopadver.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86417001FF}" = Java(TM) 7 Update 1 (64-bit)
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{58EC015E-BA77-A331-0F49-C344EFF7A5D5}" = ccc-utility64
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{83D663BF-E9AF-0C6B-D278-BB8F90EDA304}" = ATI Catalyst Install Manager
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F0D50B6D-925D-D70A-DB07-1FB44C611789}" = AMD Media Foundation Decoders
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E33EC53-22CE-426C-A88B-2AAC231BAC85}" = Catalyst Control Center - Branding
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57F8108C-886F-9424-DB1D-9A5E51ED13C4}" = Catalyst Control Center Graphics Previews Common
"{5B461E1D-1DB0-0BB2-132F-D77C56838FF3}" = Catalyst Control Center InstallProxy
"{61C25DE5-8236-62C2-795F-05DBA452B1B5}" = Catalyst Control Center Localization All
"{658BC6B8-549E-58B3-4FD1-56CF7E3094CB}" = Catalyst Control Center
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B1CBB2A3-2797-6C12-5317-D100F3BD0A76}" = CCC Help English
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Any Video Converter_is1" = Any Video Converter 3.2.5
"Avira AntiVir Desktop" = Avira Free Antivirus
"EA Installer.-631799413" = EA Installer
"FUSSBALL MANAGER 11" = FUSSBALL MANAGER 11
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"SopCast" = SopCast 3.4.0
"Steam App 8930" = Sid Meier's Civilization V
"VLC media player" = VLC media player 1.1.11
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"PhotoFiltre" = PhotoFiltre
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 24.05.2012 02:13:34 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 03:04:26 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 04:13:56 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 05:12:34 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 06:02:44 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 07:00:02 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 08:07:33 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 09:09:07 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 10:10:36 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 24.05.2012 11:12:52 | Computer Name = Speedster | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
[ System Events ]
Error - 17.05.2012 18:35:12 | Computer Name = Speedster | Source = DCOM | ID = 10010
Description = 
 
Error - 18.05.2012 19:42:56 | Computer Name = Speedster | Source = DCOM | ID = 10010
Description = 
 
Error - 19.05.2012 04:07:48 | Computer Name = Speedster | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Steam Client Service erreicht.
 
Error - 19.05.2012 04:07:48 | Computer Name = Speedster | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 20.05.2012 13:57:56 | Computer Name = Speedster | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?20.?05.?2012 um 19:44:06 unerwartet heruntergefahren.
 
Error - 20.05.2012 13:58:19 | Computer Name = Speedster | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Steam Client Service erreicht.
 
Error - 20.05.2012 13:58:19 | Computer Name = Speedster | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 22.05.2012 10:32:46 | Computer Name = Speedster | Source = DCOM | ID = 10010
Description = 
 
Error - 22.05.2012 11:07:04 | Computer Name = Speedster | Source = DCOM | ID = 10010
Description = 
 
Error - 22.05.2012 11:07:41 | Computer Name = Speedster | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   SBRE
 
 
< End of report >
         

--- --- ---

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Combofix Logfile:

ComboFix 12-05-25.02 - *** 25.05.2012  10:42:09.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3956.2581 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-04-25 bis 2012-05-25  ))))))))))))))))))))))))))))))
.
.
2012-05-25 09:26 . 2012-05-25 09:26	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-05-23 02:27 . 2012-05-23 02:27	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{3768EEC7-CF5F-4949-A123-D4E588DE718D}\offreg.dll
2012-05-22 23:26 . 2012-05-08 17:02	8955792	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{3768EEC7-CF5F-4949-A123-D4E588DE718D}\mpengine.dll
2012-05-22 15:05 . 2012-05-22 15:05	--------	d-----w-	c:\programdata\GFI Software
2012-05-22 14:14 . 2012-05-25 08:15	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy
2012-05-22 14:14 . 2012-05-25 08:15	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2012-05-10 09:33 . 2012-03-03 06:35	1544704	----a-w-	c:\windows\system32\DWrite.dll
2012-05-10 09:33 . 2012-03-31 06:05	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-05-10 09:33 . 2012-03-31 03:10	3146240	----a-w-	c:\windows\system32\win32k.sys
2012-05-10 09:33 . 2012-03-03 05:31	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-05-10 09:33 . 2012-03-31 04:39	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-05-10 09:33 . 2012-03-31 04:39	3913072	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-05-10 09:33 . 2012-03-17 07:58	75120	----a-w-	c:\windows\system32\drivers\partmgr.sys
2012-05-10 09:32 . 2012-03-31 05:40	1367552	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-10 09:32 . 2012-03-31 04:29	936960	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-10 09:32 . 2012-03-30 11:35	1918320	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-05-04 07:23 . 2008-05-07 17:59	99840	----a-w-	c:\windows\system32\Spool\prtprocs\x64\HPZPPLHN.DLL
2012-04-26 23:01 . 2012-04-26 23:02	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2012-04-26 23:01 . 2012-04-26 23:01	157352	----a-w-	c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-26 23:01 . 2012-04-26 23:01	129976	----a-w-	c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-08 21:26 . 2012-03-22 06:52	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-05-08 21:26 . 2012-03-22 06:52	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-05-05 18:54 . 2012-04-01 01:31	419488	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-05 18:54 . 2012-02-23 13:55	70304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-05 18:54 . 2012-04-01 01:54	8744608	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-20 11:26 . 2012-04-20 11:26	388096	----a-r-	c:\users\Benedikt Frank\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-03-11 16:11 . 2011-08-01 12:21	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2012-03-08 16:37 . 2012-03-08 16:37	302448	----a-w-	c:\windows\WLXPGSS.SCR
2012-03-01 06:46 . 2012-04-11 14:39	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-03-01 06:38 . 2012-04-11 14:39	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-03-01 06:33 . 2012-04-11 14:39	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-03-01 06:28 . 2012-04-11 14:39	5120	----a-w-	c:\windows\system32\wmi.dll
2012-03-01 05:37 . 2012-04-11 14:39	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-03-01 05:33 . 2012-04-11 14:39	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-03-01 05:29 . 2012-04-11 14:39	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-02-28 06:56 . 2012-04-11 14:40	2311168	----a-w-	c:\windows\system32\jscript9.dll
2012-02-28 06:49 . 2012-04-11 14:40	1390080	----a-w-	c:\windows\system32\wininet.dll
2012-02-28 06:48 . 2012-04-11 14:40	1493504	----a-w-	c:\windows\system32\inetcpl.cpl
2012-02-28 06:42 . 2012-04-11 14:40	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-02-28 01:18 . 2012-04-11 14:40	1799168	----a-w-	c:\windows\SysWow64\jscript9.dll
2012-02-28 01:11 . 2012-04-11 14:40	1427456	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2012-02-28 01:11 . 2012-04-11 14:40	1127424	----a-w-	c:\windows\SysWow64\wininet.dll
2012-02-28 01:03 . 2012-04-11 14:40	2382848	----a-w-	c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WLSync"="c:\program files (x86)\Windows Live\Mesh\WLSync.exe" [2012-03-08 1449824]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-03-09 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-07 336384]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"osk.exe"="osk.exe" [2009-07-14 646144]
.
c:\users\Benedikt Frank\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-26 129976]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 18:54]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Benedikt Frank\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Download Assistant"="c:\windows\system32\rundll32.exe" [2009-07-14 45568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.volley.de/
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Benedikt Frank\AppData\Roaming\Mozilla\Firefox\Profiles\mm1ooqcs.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 59899
FF - prefs.js: network.proxy.type - 4
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-538435716-1745777895-1884591673-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-538435716-1745777895-1884591673-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-05-25  11:51:38
ComboFix-quarantined-files.txt  2012-05-25 09:51
.
Vor Suchlauf: 10 Verzeichnis(se), 21.759.639.552 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 21.257.691.136 Bytes frei
.
- - End Of File - - 6292BCD26585460A9407E5289EF032A2
         

--- --- ---

hi
malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Hi
es gab keine infizierten Dateien... Ist das ein gutes oder schlechtes zeichen?

Malwarebytes Anti-Malware (Test) 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.05.27.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** [Administrator]

Schutz: Deaktiviert

27.05.2012 15:55:09
mbam-log-2012-05-27 (15-55-09).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 300539
Laufzeit: 13 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)