Wie es die Üerschrift schon sagt, hab ich mir einen GVU Trojaner eingefangen. Hatte letztes Jahr mal nen BKA Trojaner auf einem anderen Rechner.Deshalb hab ich es mit der Kaspersky Rescue Disc nach dieser Anleitung hxxp://blog.botfrei.de/2012/03/anleitung-gvu-trojaner-v2-04-entfernen-windows-xp-vista-7/ versucht. Leider hatten die Befehle "DisableTaskmgr" "DisableRegistryTools" & "NoDesktop" nichts gebracht & es wurde kein Suchergebnis angezeigt. Ich kann nur noch mit ausgeschaltetem Internetmodem oder via dem Gastprofil auf den Laptop zugreifen. ich hab malwarebytes(96Tage alt zwecks internet), OTL & Avira drüberlaufen lassen, vielen Dank schon mal für die Hilfe.Logdatei von Malwarebytes ist im Anhang.


OTL logfile created on: 09.07.2012 21:07:06 - Run 2
OTL by OldTimer - Version 3.2.53.1 Folder = G:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

5,91 Gb Total Physical Memory | 4,65 Gb Available Physical Memory | 78,57% Memory free
11,83 Gb Paging File | 9,33 Gb Available in Paging File | 78,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 177,00 Gb Total Space | 115,34 Gb Free Space | 65,16% Space Free | Partition Type: NTFS
Drive D: | 265,09 Gb Total Space | 132,96 Gb Free Space | 50,16% Space Free | Partition Type: NTFS
Drive F: | 1,83 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive G: | 7,52 Gb Total Space | 7,48 Gb Free Space | 99,36% Space Free | Partition Type: FAT32

Computer Name: PEDRO-PC | User Name: Pedro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.09 17:01:56 | 000,595,968 | ---- | M] (OldTimer Tools) -- G:\OTL.exe
PRC - [2012.05.09 11:28:20 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.09 11:28:19 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.09 11:28:19 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.04.04 15:56:38 | 000,981,680 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2012.02.20 08:00:06 | 003,669,680 | ---- | M] (Crawler.com) -- C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
PRC - [2012.02.20 07:59:56 | 002,786,480 | ---- | M] (Crawler.com) -- C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
PRC - [2012.01.23 14:15:54 | 000,127,040 | ---- | M] (ICQ, LLC.) -- C:\Program Files (x86)\ICQ7.7\ICQ.exe
PRC - [2011.12.20 15:52:04 | 002,783,312 | ---- | M] (Samsung Electronics) -- C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
PRC - [2011.12.07 13:44:48 | 000,220,744 | ---- | M] (Geek Software GmbH) -- C:\Program Files (x86)\PDF24\pdf24.exe
PRC - [2011.12.03 14:19:38 | 002,009,704 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.09.04 13:45:26 | 003,398,736 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.05.25 16:53:34 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
PRC - [2011.05.05 14:44:54 | 002,656,536 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.05.05 14:44:52 | 000,326,424 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2011.02.25 03:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.01.11 08:31:34 | 000,719,360 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2011.01.04 15:06:42 | 007,060,560 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
PRC - [2010.12.23 08:07:58 | 000,945,232 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2010.11.29 07:42:38 | 000,775,848 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
PRC - [2010.11.17 10:24:54 | 004,387,632 | ---- | M] (SEC) -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
PRC - [2010.11.10 02:03:52 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
PRC - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2010.02.02 17:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2009.11.02 07:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe


========== Modules (No Company Name) ==========

MOD - [2011.09.27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.09.27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2010.07.05 12:42:58 | 000,203,776 | ---- | M] () -- C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll
MOD - [2010.05.07 16:22:18 | 001,636,864 | ---- | M] () -- C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll
MOD - [2009.11.02 07:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009.11.02 07:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2006.08.12 05:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010.08.09 21:04:12 | 000,166,704 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\Windows\SysNative\SUPDSvc.exe -- (Samsung UPD Service)
SRV - [2012.06.24 05:29:34 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.20 13:14:13 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.09 11:28:20 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.09 11:28:19 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.10 06:14:42 | 001,148,632 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe -- (ST2012_Svc)
SRV - [2011.12.03 14:19:38 | 002,009,704 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.05.05 14:44:54 | 002,656,536 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2011.05.05 14:44:52 | 000,326,424 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2011.04.20 02:57:02 | 000,241,648 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe -- (CLKMSVC10_38F51D56)
SRV - [2011.03.28 22:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.03.01 14:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 03:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010.10.08 03:24:16 | 000,150,016 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) Intel(R)
SRV - [2010.09.22 11:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.06.01 08:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2012.05.09 11:28:20 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.09 11:28:20 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.24 22:05:48 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.13 16:49:32 | 000,051,496 | ---- | M] (Windows (R) Win 7 DDK provider) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\stflt.sys -- (sp_rsdrv2)
DRV:64bit: - [2011.12.28 22:41:52 | 000,207,656 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2011.12.15 16:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.12.03 14:19:36 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2011.12.01 22:51:00 | 011,417,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)
DRV:64bit: - [2011.08.02 18:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.07.26 17:22:48 | 012,288,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.04.22 12:17:04 | 000,471,144 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.20 18:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010.10.15 11:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010.10.08 03:23:38 | 000,019,192 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010.09.13 11:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.03.23 14:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.28 08:38:04 | 000,013,824 | ---- | M] (SAMSUNG ELECTRONICS) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SABI.sys -- (SABI)
DRV:64bit: - [2009.05.18 14:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2011.09.20 19:55:33 | 000,015,144 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\rtport.sys -- (rtport)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60747
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung.msn.com
IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~2\Crawler\Toolbar\ctbr.dll (Crawler.com)
IE - HKCU\..\SearchScopes,DefaultScope = {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = hxxp://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=60747
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.28 03:25:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Program Files (x86)\Crawler\Toolbar\firefox\ [2012.01.13 16:50:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.20 13:14:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.07 13:48:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.20 13:14:14 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.07.07 13:48:28 | 000,000,000 | ---D | M]

[2011.11.11 18:00:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pedro\AppData\Roaming\mozilla\Extensions
[2012.07.07 13:48:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pedro\AppData\Roaming\mozilla\Firefox\Profiles\cwpcolky.default\extensions
[2012.01.19 13:08:35 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Pedro\AppData\Roaming\mozilla\Firefox\Profiles\cwpcolky.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.27 22:49:11 | 000,000,000 | ---D | M] (FoxLingo) -- C:\Users\Pedro\AppData\Roaming\mozilla\Firefox\Profiles\cwpcolky.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2012.05.21 21:17:04 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Pedro\AppData\Roaming\mozilla\Firefox\Profiles\cwpcolky.default\extensions\ich@maltegoetz.de
[2012.07.07 13:48:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pedro\AppData\Roaming\mozilla\Firefox\Profiles\cwpcolky.default\extensions\staged
[2011.12.01 18:04:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.29 04:39:06 | 000,743,305 | ---- | M] () (No name found) -- C:\USERS\PEDRO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\CWPCOLKY.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.06.20 13:14:14 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.06.18 14:43:36 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll
[2012.06.20 13:14:11 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.20 13:14:11 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2007.07.26 13:05:16 | 000,001,329 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\crawlersrch.xml
[2012.06.20 13:14:11 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.20 13:14:11 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.20 13:14:11 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.20 13:14:11 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (&Crawler Toolbar Helper) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~2\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Samsung BHO Class) - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Programme\Samsung AnyWeb Print\W2PBrowser.dll ()
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~2\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Pedro\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~2\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKCU\..\Toolbar\WebBrowser: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Pedro\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH)
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SpywareTerminatorShield] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4:64bit: - HKLM..\Run: [SpywareTerminatorUpdater] C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Crawler Search - tbr:iemenu File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pedro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Crawler Search - tbr:iemenu File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Pedro\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Samsung AnyWeb Print - {328ECD19-C167-40eb-A0C7-16FE7634105E} - C:\Programme\Samsung AnyWeb Print\W2PBrowser.dll ()
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files (x86)\ICQ7.7\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C50A0935-D837-4E57-B6D7-B72A4E5EA3EF}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\tbr - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~2\Crawler\Toolbar\ctbr.dll (Crawler.com)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.03.22 17:17:27 | 000,000,175 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{90cdd95c-8ad2-11e1-992b-e811329e44ff}\Shell - "" = AutoRun
O33 - MountPoints2\{90cdd95c-8ad2-11e1-992b-e811329e44ff}\Shell\AutoRun\command - "" = F:\setup.exe -- [2010.03.12 14:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{90cdd95c-8ad2-11e1-992b-e811329e44ff}\Shell\configure\command - "" = F:\setup.exe -- [2010.03.12 14:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{90cdd95c-8ad2-11e1-992b-e811329e44ff}\Shell\install\command - "" = F:\setup.exe -- [2010.03.12 14:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{d299ae5e-8e45-11e1-9763-e811329e44ff}\Shell - "" = AutoRun
O33 - MountPoints2\{d299ae5e-8e45-11e1-9763-e811329e44ff}\Shell\AutoRun\command - "" = F:\setup.exe -- [2010.03.12 14:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{d299ae5e-8e45-11e1-9763-e811329e44ff}\Shell\configure\command - "" = F:\setup.exe -- [2010.03.12 14:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{d299ae5e-8e45-11e1-9763-e811329e44ff}\Shell\install\command - "" = F:\setup.exe -- [2010.03.12 14:43:46 | 000,464,248 | R--- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.09 17:30:04 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Roaming\Malwarebytes
[2012.07.09 17:29:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.09 17:29:53 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.09 17:29:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.07.09 17:29:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.09 17:28:52 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{055D2EEB-CE28-4B08-B472-A9552508B968}
[2012.07.09 16:53:21 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{D1B1A084-0B6D-4342-A285-C823088F8A89}
[2012.07.09 16:53:05 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{8C5A7F54-2681-4AAF-83F6-7F66318203E3}
[2012.07.08 01:57:02 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{3B3F183A-9526-415E-ABAC-E59FD6999F61}
[2012.07.08 01:56:50 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{CF8330B3-1B51-4A92-9344-6E67C792A6D4}
[2012.07.07 16:05:18 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.07.07 13:49:27 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Roaming\Canneverbe Limited
[2012.07.07 13:49:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2012.07.07 13:49:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CDBurnerXP
[2012.07.07 13:48:27 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Roaming\convert
[2012.07.07 13:48:24 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Roaming\loadtbs
[2012.07.07 13:35:45 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{6219EBCD-6263-4D36-AC44-679801E3A93D}
[2012.07.07 13:35:28 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{B028F71D-752F-4ED2-B1B3-812FE3F7084A}
[2012.07.07 06:23:33 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2012.06.30 02:41:48 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{FA734559-F56D-4789-BB53-44D0C89C09CC}
[2012.06.30 02:41:31 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{C0530B2E-C20A-4291-9246-D666EEA568CD}
[2012.06.25 18:30:08 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Roaming\TuneUp Software
[2012.06.25 18:29:52 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.06.25 18:29:44 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.06.25 18:29:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2012.06.25 18:28:51 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Roaming\OpenCandy
[2012.06.24 05:39:09 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\Macromedia
[2012.06.22 14:13:11 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{F22AA66D-CC3B-46C2-9E6C-74D785457748}
[2012.06.22 08:28:00 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2012.06.22 08:28:00 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2012.06.22 08:28:00 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2012.06.22 08:27:53 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2012.06.22 08:27:53 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2012.06.22 08:27:53 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2012.06.22 08:27:47 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2012.06.22 08:27:47 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2012.06.22 01:59:27 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{530F2758-918C-41D6-BBC6-8A55AEB4C66A}
[2012.06.22 01:59:05 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{8919446D-0748-4BE4-80C4-C6EAEBF7445A}
[2012.06.20 23:35:14 | 000,000,000 | ---D | C] -- C:\Users\Pedro\Desktop\sds
[2012.06.20 17:53:05 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{87237335-F8D9-4DDD-9FA4-B0595A624E95}
[2012.06.20 17:52:53 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{08678990-05F8-48DE-AA3B-F3E1656D1214}
[2012.06.20 16:53:05 | 000,000,000 | ---D | C] -- C:\Users\Pedro\Desktop\bildernso
[2012.06.20 13:13:13 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{C103AF01-3755-413D-80A6-454E0885181A}
[2012.06.20 13:12:59 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{AA0CAB47-FCF7-4C31-862A-F50C51F38EF3}
[2012.06.19 02:38:45 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{9F4259D7-CD87-4046-9569-48DC78E7DBE0}
[2012.06.18 13:27:38 | 000,000,000 | ---D | C] -- C:\Users\Pedro\Desktop\Neuer Ordner (2)
[2012.06.15 14:08:41 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{4A9CE0DF-6468-4224-999D-61C84843DCCB}
[2012.06.14 08:10:51 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{6F9C1C97-9DA0-476E-8509-8DF07AF64762}
[2012.06.14 08:10:38 | 000,000,000 | ---D | C] -- C:\Users\Pedro\AppData\Local\{B2E8234C-0800-4405-BE07-205222394DC1}
[2012.06.14 03:00:25 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.06.14 03:00:24 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.06.14 03:00:24 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.06.14 03:00:24 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.06.14 03:00:23 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.06.14 03:00:23 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.06.14 03:00:23 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.06.14 03:00:23 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.06.14 03:00:22 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.06.14 03:00:22 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.06.14 03:00:22 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.06.14 03:00:22 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.06.14 03:00:22 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.06.14 00:24:07 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2012.06.14 00:24:00 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.06.14 00:24:00 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.06.14 00:22:47 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.06.14 00:22:47 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.06.14 00:22:46 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.06.14 00:07:35 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2012.06.14 00:07:35 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2012.06.14 00:07:35 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2012.06.11 12:24:30 | 000,000,000 | ---D | C] -- C:\Users\Pedro\Desktop\ppt
[2012.06.11 11:38:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.06.11 11:38:36 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[1 C:\Users\Pedro\Desktop\*.tmp files -> C:\Users\Pedro\Desktop\*.tmp -> ]
[1 C:\Users\Pedro\*.tmp files -> C:\Users\Pedro\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.07.09 21:02:16 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.09 21:02:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.09 21:02:13 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.09 17:35:37 | 000,028,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 17:35:37 | 000,028,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 17:29:54 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.09 17:28:22 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.09 17:27:49 | 2055,512,063 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.09 17:26:19 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.09 17:26:19 | 000,697,082 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.09 17:26:19 | 000,652,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.09 17:26:19 | 000,148,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.09 17:26:19 | 000,121,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.09 17:24:24 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.07.07 13:49:13 | 000,001,953 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.07.07 13:21:49 | 000,001,879 | ---- | M] () -- C:\Users\Pedro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.06.25 18:28:37 | 000,001,402 | ---- | M] () -- C:\Users\Pedro\Desktop\Free YouTube to MP3 Converter.lnk
[2012.06.24 05:29:33 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.06.24 05:29:33 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.06.22 09:40:48 | 000,044,806 | ---- | M] () -- C:\Users\Pedro\Desktop\Unbenannt.jpg
[2012.06.20 19:40:54 | 000,000,842 | ---- | M] () -- C:\Users\Pedro\.recently-used.xbel
[2012.06.20 13:08:54 | 001,591,234 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.06.15 07:08:49 | 000,164,690 | ---- | M] () -- C:\Users\Pedro\Desktop\BSC.jpg
[2012.06.15 03:43:12 | 000,036,202 | ---- | M] () -- C:\Users\Pedro\Desktop\funktionen.jpg
[2012.06.14 23:47:48 | 000,022,055 | ---- | M] () -- C:\Users\Pedro\Desktop\bwi_arten_von_kennzahlen.GIF
[2012.06.14 18:11:50 | 000,023,170 | ---- | M] () -- C:\Users\Pedro\Desktop\formel.jpg
[2012.06.14 18:09:06 | 000,047,579 | ---- | M] () -- C:\Users\Pedro\Desktop\vergleich.jpg
[2012.06.14 16:49:04 | 000,056,215 | ---- | M] () -- C:\Users\Pedro\Desktop\Vergleich Gewinnwirkung.jpg
[2012.06.14 15:51:56 | 000,041,108 | ---- | M] () -- C:\Users\Pedro\Desktop\Kostenstruktur.jpg
[2012.06.14 15:43:35 | 000,143,680 | ---- | M] () -- C:\Users\Pedro\Desktop\Kennzahlenstruktur.jpg
[2012.06.14 12:54:42 | 000,052,086 | ---- | M] () -- C:\Users\Pedro\Desktop\Kennzahlen der Beschaffung.jpg
[2012.06.14 09:59:53 | 000,147,857 | ---- | M] () -- C:\Users\Pedro\Desktop\672_lp.pdf
[2012.06.14 09:39:11 | 000,058,740 | ---- | M] () -- C:\Users\Pedro\Desktop\barney.jpg
[2012.06.14 09:22:10 | 000,046,560 | ---- | M] () -- C:\Users\Pedro\Desktop\bond.jpg
[2012.06.14 08:37:34 | 000,027,359 | ---- | M] () -- C:\Users\Pedro\Desktop\die mannschaft.jpg
[2012.06.14 03:25:08 | 000,425,680 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[1 C:\Users\Pedro\Desktop\*.tmp files -> C:\Users\Pedro\Desktop\*.tmp -> ]
[1 C:\Users\Pedro\*.tmp files -> C:\Users\Pedro\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.07.09 17:29:54 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.07 13:49:13 | 000,001,953 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.07.07 13:49:13 | 000,001,903 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012.07.07 13:21:48 | 000,001,879 | ---- | C] () -- C:\Users\Pedro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.07 13:21:47 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2012.06.22 09:40:48 | 000,044,806 | ---- | C] () -- C:\Users\Pedro\Desktop\Unbenannt.jpg
[2012.06.20 19:40:54 | 000,000,842 | ---- | C] () -- C:\Users\Pedro\.recently-used.xbel
[2012.06.15 07:08:49 | 000,164,690 | ---- | C] () -- C:\Users\Pedro\Desktop\BSC.jpg
[2012.06.15 03:43:12 | 000,036,202 | ---- | C] () -- C:\Users\Pedro\Desktop\funktionen.jpg
[2012.06.14 23:47:47 | 000,022,055 | ---- | C] () -- C:\Users\Pedro\Desktop\bwi_arten_von_kennzahlen.GIF
[2012.06.14 18:11:50 | 000,023,170 | ---- | C] () -- C:\Users\Pedro\Desktop\formel.jpg
[2012.06.14 18:04:04 | 000,047,579 | ---- | C] () -- C:\Users\Pedro\Desktop\vergleich.jpg
[2012.06.14 16:49:04 | 000,056,215 | ---- | C] () -- C:\Users\Pedro\Desktop\Vergleich Gewinnwirkung.jpg
[2012.06.14 15:51:56 | 000,041,108 | ---- | C] () -- C:\Users\Pedro\Desktop\Kostenstruktur.jpg
[2012.06.14 15:43:35 | 000,143,680 | ---- | C] () -- C:\Users\Pedro\Desktop\Kennzahlenstruktur.jpg
[2012.06.14 12:54:42 | 000,052,086 | ---- | C] () -- C:\Users\Pedro\Desktop\Kennzahlen der Beschaffung.jpg
[2012.06.14 09:59:52 | 000,147,857 | ---- | C] () -- C:\Users\Pedro\Desktop\672_lp.pdf
[2012.06.14 09:31:10 | 000,058,740 | ---- | C] () -- C:\Users\Pedro\Desktop\barney.jpg
[2012.06.14 09:19:22 | 000,046,560 | ---- | C] () -- C:\Users\Pedro\Desktop\bond.jpg
[2012.06.14 08:37:32 | 000,027,359 | ---- | C] () -- C:\Users\Pedro\Desktop\die mannschaft.jpg
[2012.02.17 01:53:47 | 001,591,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.07 19:17:09 | 000,258,864 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2011.09.07 19:13:35 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.09.07 05:14:31 | 000,307,200 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe
[2011.09.07 04:35:01 | 000,001,816 | ---- | C] () -- C:\Windows\HotFixList.ini
[2011.09.07 04:34:41 | 000,142,128 | ---- | C] () -- C:\Windows\wiainst64.exe
[2011.07.26 17:20:38 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.07.26 17:20:38 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.07.26 17:14:32 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.07.26 16:50:58 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll

========== LOP Check ==========

[2012.07.07 13:49:27 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\Canneverbe Limited
[2012.07.07 13:48:27 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\convert
[2012.04.24 21:39:00 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\DAEMON Tools Lite
[2012.06.25 18:28:52 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\DVDVideoSoft
[2012.01.19 13:08:34 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.12.01 18:25:51 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\FloodLightGames
[2012.02.03 22:46:26 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\gtk-2.0
[2011.12.16 12:20:07 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\ICQ
[2012.07.07 13:48:28 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\loadtbs
[2012.06.25 18:28:53 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\OpenCandy
[2012.04.24 21:41:55 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\SoftGrid Client
[2012.01.13 16:49:32 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\Spyware Terminator
[2011.11.14 18:33:23 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\TP
[2012.06.25 18:30:08 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\TuneUp Software
[2011.12.01 18:25:56 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\Wi-Fi Sync
[2011.12.01 18:25:56 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\WildTangent
[2012.02.10 14:16:52 | 000,000,000 | ---D | M] -- C:\Users\Pedro\AppData\Roaming\WindSolutions
[2012.05.06 17:01:04 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >





Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 9. Juli 2012 21:02

Es wird nach 3853289 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : PEDRO-PC

Versionsinformationen:
BUILD.DAT : 12.0.0.1125 41829 Bytes 02.05.2012 16:34:00
AVSCAN.EXE : 12.3.0.15 466896 Bytes 09.05.2012 09:28:19
AVSCAN.DLL : 12.3.0.15 66256 Bytes 09.05.2012 09:28:19
LUKE.DLL : 12.3.0.15 68304 Bytes 09.05.2012 09:28:20
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 09.05.2012 09:28:20
AVREG.DLL : 12.3.0.17 232200 Bytes 11.05.2012 10:23:45
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 18:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 23:31:49
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 14:54:21
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 10:44:51
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 13:03:27
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 02:51:30
VBASE006.VDF : 7.11.34.117 2048 Bytes 29.06.2012 02:51:30
VBASE007.VDF : 7.11.34.118 2048 Bytes 29.06.2012 02:51:30
VBASE008.VDF : 7.11.34.119 2048 Bytes 29.06.2012 02:51:30
VBASE009.VDF : 7.11.34.120 2048 Bytes 29.06.2012 02:51:30
VBASE010.VDF : 7.11.34.121 2048 Bytes 29.06.2012 02:51:30
VBASE011.VDF : 7.11.34.122 2048 Bytes 29.06.2012 02:51:30
VBASE012.VDF : 7.11.34.123 2048 Bytes 29.06.2012 02:51:30
VBASE013.VDF : 7.11.34.124 2048 Bytes 29.06.2012 02:51:30
VBASE014.VDF : 7.11.34.201 169472 Bytes 02.07.2012 10:02:32
VBASE015.VDF : 7.11.35.19 122368 Bytes 04.07.2012 13:50:16
VBASE016.VDF : 7.11.35.87 146944 Bytes 06.07.2012 23:43:08
VBASE017.VDF : 7.11.35.88 2048 Bytes 06.07.2012 23:43:08
VBASE018.VDF : 7.11.35.89 2048 Bytes 06.07.2012 23:43:09
VBASE019.VDF : 7.11.35.90 2048 Bytes 06.07.2012 23:43:09
VBASE020.VDF : 7.11.35.91 2048 Bytes 06.07.2012 23:43:09
VBASE021.VDF : 7.11.35.92 2048 Bytes 06.07.2012 23:43:09
VBASE022.VDF : 7.11.35.93 2048 Bytes 06.07.2012 23:43:09
VBASE023.VDF : 7.11.35.94 2048 Bytes 06.07.2012 23:43:09
VBASE024.VDF : 7.11.35.95 2048 Bytes 06.07.2012 23:43:09
VBASE025.VDF : 7.11.35.96 2048 Bytes 06.07.2012 23:43:09
VBASE026.VDF : 7.11.35.97 2048 Bytes 06.07.2012 23:43:09
VBASE027.VDF : 7.11.35.98 2048 Bytes 06.07.2012 23:43:09
VBASE028.VDF : 7.11.35.99 2048 Bytes 06.07.2012 23:43:09
VBASE029.VDF : 7.11.35.100 2048 Bytes 06.07.2012 23:43:09
VBASE030.VDF : 7.11.35.101 2048 Bytes 06.07.2012 23:43:09
VBASE031.VDF : 7.11.35.136 125440 Bytes 09.07.2012 14:53:06
Engineversion : 8.2.10.106
AEVDF.DLL : 8.1.2.8 106867 Bytes 02.06.2012 10:54:30
AESCRIPT.DLL : 8.1.4.32 455034 Bytes 05.07.2012 22:37:58
AESCN.DLL : 8.1.8.2 131444 Bytes 27.01.2012 09:46:37
AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 20:57:11
AERDL.DLL : 8.1.9.15 639348 Bytes 14.12.2011 23:31:02
AEPACK.DLL : 8.2.16.22 807288 Bytes 21.06.2012 11:53:01
AEOFFICE.DLL : 8.1.2.40 201082 Bytes 29.06.2012 02:33:15
AEHEUR.DLL : 8.1.4.64 5009782 Bytes 05.07.2012 22:37:57
AEHELP.DLL : 8.1.23.2 258422 Bytes 29.06.2012 02:33:12
AEGEN.DLL : 8.1.5.32 434548 Bytes 06.07.2012 23:43:10
AEEXP.DLL : 8.1.0.60 86388 Bytes 05.07.2012 22:37:58
AEEMU.DLL : 8.1.3.0 393589 Bytes 14.12.2011 23:30:58
AECORE.DLL : 8.1.25.10 201080 Bytes 01.06.2012 10:54:44
AEBB.DLL : 8.1.1.0 53618 Bytes 14.12.2011 23:30:58
AVWINLL.DLL : 12.3.0.15 27344 Bytes 09.05.2012 09:28:19
AVPREF.DLL : 12.3.0.15 51920 Bytes 09.05.2012 09:28:19
AVREP.DLL : 12.3.0.15 179208 Bytes 09.05.2012 09:28:20
AVARKT.DLL : 12.3.0.15 211408 Bytes 09.05.2012 09:28:19
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 09.05.2012 09:28:19
SQLITE3.DLL : 3.7.0.1 398288 Bytes 09.05.2012 09:28:20
AVSMTP.DLL : 12.3.0.15 63440 Bytes 09.05.2012 09:28:19
NETNT.DLL : 12.3.0.15 17104 Bytes 09.05.2012 09:28:20
RCIMAGE.DLL : 12.3.0.15 4447952 Bytes 09.05.2012 09:28:19
RCTEXT.DLL : 12.3.0.15 98512 Bytes 09.05.2012 09:28:19

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_4ffaf88f\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: reparieren
Sekundäre Aktion......................: quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig

Beginn des Suchlaufs: Montag, 9. Juli 2012 21:02

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SUPBackground.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SSCKbdHk.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MovieColorEnhancer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'EasySpeedUpManager.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PDVD10Serv.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'brs.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WCScheduler.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'dmhkcore.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'YCMMirage.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'WifiManager.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ICQ.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'msnmsgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpywareTerminatorUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpywareTerminatorShield.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'cvpnd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Users\Pedro\Downloads\OFFICE.2010.RTM.Final.Volume.Activator.READNFO-SHELOMOTUVI-PLZ\Activator\kmsreset.exe'
C:\Users\Pedro\Downloads\OFFICE.2010.RTM.Final.Volume.Activator.READNFO-SHELOMOTUVI-PLZ\Activator\kmsreset.exe
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54ab85c0.qua' verschoben!
Beginne mit der Suche in 'C:\Users\Pedro\Downloads\Office_2010_Activation_and_Conversion_Kit_V1.3_by_Raz0r\Office 2010 Activation and Conversion Kit V1.3 by Raz0r\O2ACK1.3.exe'
C:\Users\Pedro\Downloads\Office_2010_Activation_and_Conversion_Kit_V1.3_by_Raz0r\Office 2010 Activation and Conversion Kit V1.3 by Raz0r\O2ACK1.3.exe
[FUND] Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Agent.awry
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4c6eaa1c.qua' verschoben!
Beginne mit der Suche in 'C:\Users\Pedro\Downloads\Office_2010_Activation_and_Conversion_Kit_V1.3_by_Raz0r\Office 2010 Activation and Conversion Kit V1.3 by Raz0r\Resources\KeyCheck\Checker.exe'
C:\Users\Pedro\Downloads\Office_2010_Activation_and_Conversion_Kit_V1.3_by_Raz0r\Office 2010 Activation and Conversion Kit V1.3 by Raz0r\Resources\KeyCheck\Checker.exe
[FUND] Ist das Trojanische Pferd TR/Agent.xdh.7
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1e6df082.qua' verschoben!


Ende des Suchlaufs: Montag, 9. Juli 2012 21:03
Benötigte Zeit: 00:27 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

0 Verzeichnisse wurden überprüft
36 Dateien wurden geprüft
3 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
3 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
33 Dateien ohne Befall
1 Archive wurden durchsucht
0 Warnungen
3 Hinweise

C:\Users\Pedro\AppData\Local\Temp\Resources\KMSKG\Keygen.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
die verwendung von keygens ist illegal, dies unterstützen wir nicht, deswegen gibts hier nur hilfe beim formatieren und neu aufsetzen, und pc absichern.