Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Licensevalidator.exe und hermes_v01 auf dem PC

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 20.07.2012, 11:04   #1
Medix
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



Hallo Forum!

Auch ich habe aktuell einen Fund von Schadsoftware auf meinem PC und scheine mit den Auswirkungen nicht alleine zu sein, soweit ich hier im Forum schon fündig geworden bin.

Zunächst konnte ich via Firefox 14.0.1 keine verschlüsselten Seiten mehr aufrufen, da die Sicherheitszertifikate nicht mehr erkannt wurden. Nach einem Neustart des PC meldete meine AV-Software (AVG) den Fund der Datei "Licensevalidator.exe", welche daraufhin in Quarantäne verschoben wurde. Vollständiger Pfad der Datei: C:\USERS\BENUTZER\APPDATA\ROAMING\GOOGLE\{B6C12F26-99C8-4CC9-8205-42FE06C8FD73}\LICENSEVALIDATOR.EXE

Nach dem Login in mein web.de-Postfach bekam ich die Meldung über einen Virus, welcher mein Passwort zum Postfach ausgespäht hatte: hermes_v01

Diverse Scans mittels AV-Software brachten keinen Fund, die Schadsoftware ist aber offensichtlich weiterhin aktiv. Nach wie vor werden in Firefox keine Identitätsdaten der Webseiten zur Verfügung gestellt; wie auch bei anderen Usern werden keine Favicons mehr angezeigt.

System: WIN7 64bit

Um es gleich vorweg zu nehmen: mit dem PC werden auch Online-Einkäufe sowie Online-Banking getätigt.

Vorab vielen Dank für Hilfestellung!

Alt 21.07.2012, 23:16   #2
t'john
/// Helfer-Team
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC





1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt
Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.
__________________

__________________

Alt 24.07.2012, 01:31   #3
Medix
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



Vielen Dank für deine Hilfe.
Hier die Logfiles

Code:
ATTFilter
OTL Extras logfile created on: 23.07.2012 20:47:24 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Daniel\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 5,98 Gb Available Physical Memory | 74,76% Memory free
24,00 Gb Paging File | 21,91 Gb Available in Paging File | 91,31% Paging File free
Paging file location(s): c:\pagefile.sys 0 0d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 100,01 Gb Total Space | 2,95 Gb Free Space | 2,95% Space Free | Partition Type: NTFS
Drive D: | 365,75 Gb Total Space | 288,29 Gb Free Space | 78,82% Space Free | Partition Type: NTFS
Drive E: | 298,08 Gb Total Space | 71,49 Gb Free Space | 23,98% Space Free | Partition Type: NTFS
 
Computer Name: DANIEL-PC | User Name: Daniel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Microsoft Office 2010\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Microsoft Office 2010\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Microsoft Office 2010\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Microsoft Office 2010\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{157394C7-5142-41F6-A662-F97A62ED9817}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{28234653-F7BC-4008-920F-F914EBC637B3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{2F545695-8CBA-41B1-A373-F2E5D920B901}" = lport=138 | protocol=17 | dir=in | app=system | 
"{4E2065A2-6730-4386-9497-A12A20274326}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{559395B4-E04B-4273-828B-08930980434F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5741B8A7-ECC2-4183-92B8-17AD27498331}" = rport=445 | protocol=6 | dir=out | app=system | 
"{5D4C172C-C9EE-4374-888A-1A2091C43D57}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6032767C-920E-4E16-B69A-AE11D15F2AAA}" = lport=445 | protocol=6 | dir=in | app=system | 
"{650F44B3-1CA2-4275-BB1D-22D53E8B41B2}" = lport=6004 | protocol=17 | dir=in | app=d:\microsoft office 2010\office14\outlook.exe | 
"{7E5B4868-00EF-4CF3-B01F-0D0797DC6A3D}" = lport=137 | protocol=17 | dir=in | app=system | 
"{8002E79A-2126-46EB-8645-32F7F528114A}" = rport=137 | protocol=17 | dir=out | app=system | 
"{8028DC85-6F8F-44DB-93C1-B88E3572F02C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{84E7043C-02AB-4B7F-98C3-1699E8FC9078}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A999A001-93F6-437F-895D-9EBC6EA2E78E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{B9DD8FFE-C2D8-4232-A698-D838BDD3514E}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{BBF06B3C-9561-4ABE-8767-8BF113E57D15}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{BC0254F0-D333-4CB5-AD6B-F9ACB1F43B89}" = lport=139 | protocol=6 | dir=in | app=system | 
"{BCC88094-C368-454C-8ABC-BBB7AB33CC1D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C6EBAE0F-822C-418E-90FE-021173641E6B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C9DD8DD6-6DCC-494B-B622-E3C21462A239}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{DC66F90C-6767-4BB8-A77E-539C8CBB73E5}" = rport=139 | protocol=6 | dir=out | app=system | 
"{E0AFF185-2B2A-42A1-BDAF-D159F4693D2E}" = rport=138 | protocol=17 | dir=out | app=system | 
"{E3CB21C2-E6BB-456A-8E9C-8C9A092821A2}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{E979FA46-604C-4B80-A210-3EE76D7C0D81}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00C4549F-BBE8-4A70-B614-B63B76E1AE17}" = protocol=6 | dir=out | app=system | 
"{13B62551-FD5B-4731-A015-DD0A5AB1E679}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe | 
"{1BF02B28-FADD-4A56-BF23-7D8C4658C0DF}" = protocol=6 | dir=in | app=e:\programme\thq\reliccoh.exe | 
"{1FF7E427-D5B6-467D-9BDA-FFCE06107F5F}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{203ED092-D423-4595-8158-5C1FF817E7CA}" = protocol=6 | dir=in | app=c:\users\daniel\appdata\roaming\dropbox\bin\dropbox.exe | 
"{268A32ED-FE88-4A64-88CF-E37A4C1D2488}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe | 
"{2C1F8A8F-E547-40A4-B1F9-DF872639CE28}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{2F90FF9E-08D9-4BEA-A611-80E34466ABFE}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe | 
"{2FBB650C-2E83-4C6A-91BD-6EF96DF4D3A8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{33F15D36-2758-404B-9181-619C0D848062}" = dir=in | app=c:\windows\system32\lxeacoms.exe | 
"{38ECB4B1-0910-4F99-A657-E4BA99BF228C}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{3B63EC84-4C04-4461-B16F-DC2BE5AF6F64}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{44BF1C37-E0BD-4DF7-ADAC-ED0D57E1AD16}" = protocol=6 | dir=in | app=e:\programme\thq\relicdownloader\relicdownloader.exe | 
"{45C9FC2E-2CFF-44C9-BD9B-2FD47F1495CC}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe | 
"{4772E9A5-98DA-4AF5-82E0-B305DCC9D1DD}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{49393EE2-C51F-45E8-9CCE-D0F622046817}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{4D64DE5C-5297-497F-9FC9-14C8F8CDAEBA}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\pluginwrapper\opera_plugin_wrapper.exe | 
"{593A64E9-6CD6-40F0-8598-60DCECF2BC21}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe | 
"{5BD52B76-EECA-4ABE-BD8F-6AABDE5880BC}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe | 
"{5BDCDEA0-2E15-42F2-B13F-77414D82AF91}" = protocol=6 | dir=in | app=d:\microsoft office 2010\office14\onenote.exe | 
"{5C52E87D-179A-40E0-8F13-85286AC5927E}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreediigame.exe | 
"{614F8A72-3866-4DE2-A1AF-470525CD1999}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{65DD0AD9-CF0A-42DB-B119-B7D5D5F1AD65}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\uplaybrowser.exe | 
"{66BF21D1-EFA2-4D0D-AB0C-175F516C8319}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreediigame.exe | 
"{6800273F-3609-4C63-95DD-E16662EA982C}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe | 
"{69BB4846-E09D-4F62-8840-FE8277F9C8A2}" = protocol=6 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{6A33672C-384F-4572-AE41-BFDF7E5AB97D}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe | 
"{6F109AA7-611E-4344-8EB9-B94199973D67}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgemca.exe | 
"{7100EC6F-E25A-4CB4-BC35-BECEE13ED316}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreedii.exe | 
"{72407425-8BE8-4D4A-BBF2-8C3B2A1B3DF7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{77F58291-5ACA-4A57-8159-9161FFAB675A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{79E04DCF-3F26-4F78-A6B7-5BB8E04A80BD}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe | 
"{7C08557A-8D32-49A0-85E1-FF5792F870F9}" = protocol=17 | dir=in | app=e:\programme\thq\reliccoh.exe | 
"{7D8B5CEA-0A3C-424B-BE2C-42AFA220D7A0}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\assassinscreedii.exe | 
"{807FB1D8-A072-4050-8E2F-B531F56258EE}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgmfapx.exe | 
"{810EFA05-FDAC-445E-AEFC-8691F99CDB48}" = protocol=17 | dir=in | app=c:\users\daniel\appdata\roaming\dropbox\bin\dropbox.exe | 
"{85B7538B-5379-4F90-A693-77964CB791D1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{88DE45FF-B447-499C-A65F-FCDE5EDD0209}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe | 
"{894DA8C5-7480-449C-9F2C-B0A766D74F19}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe | 
"{8DE12C0B-ED91-4745-9F9F-D855E4521693}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{8FAAA143-7107-4182-A8DA-ED39E4D5DAC9}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgnsa.exe | 
"{92CB8342-3474-41DF-B7F9-D2A24FA56C19}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe | 
"{9C67956E-2926-423C-B730-6F69C6BDBDDC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9CC28824-D856-47A1-A04A-CC2DF8CA5989}" = protocol=17 | dir=in | app=e:\programme\thq\relicdownloader\relicdownloader.exe | 
"{A0D1ABE8-8EAE-4D92-B844-091262EA24F3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{A11C106D-B313-40FD-ACF7-56C5D1B933B4}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{ABF8323C-F8FA-4723-A439-17ECF1281B17}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{B19B80F0-F780-4C79-8EBE-1EF8CD2FFBB1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B5688CC6-E8E3-4FD9-A11B-04C0B30CE718}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed ii\uplaybrowser.exe | 
"{B7BC844F-4DE9-4041-B7D5-8165F9B1A306}" = protocol=17 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{B84682A6-F631-464A-9945-FBAD8BA4052B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{C443AB01-2B36-4FEA-A156-82A3BCFE2DFE}" = protocol=17 | dir=in | app=d:\microsoft office 2010\office14\onenote.exe | 
"{C5F3D838-CD55-425D-A50E-076980ECC856}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{CCDA948B-53BF-4430-BD36-5F307D080636}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{D57BB710-3439-4A8F-A4E5-2DA810916035}" = dir=in | app=c:\windows\system32\lxeacoms.exe | 
"{E2B5C4ED-F75A-455D-A1F5-91E05ADE40B5}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{E7622741-A3C5-45AC-BA58-FC431F1464CD}" = dir=in | app=c:\windows\system32\lxeacoms.exe | 
"{E9225708-41EC-4C59-8182-DE1FA2AAD3E4}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{EB85703D-2581-4148-A103-377A29FFD956}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg10\avgdiagex.exe | 
"{EBC8E5ED-EEE1-401E-8A32-E45D6584FB10}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{ED16E093-8FB9-4DB5-8946-96A82D8F2BBC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{ED394840-249A-45FD-B0AB-5DA7704C7F4E}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{F483BDFC-F55B-4C30-ADE3-A447DF16694F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{FC53826D-B3C3-459A-923B-3CE5C36F0FC9}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{062747CE-F470-41F0-B467-D86B40921885}E:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe" = protocol=6 | dir=in | app=e:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"TCP Query User{242E3083-DDF3-4775-8228-C3D7099A0AC4}C:\users\daniel\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\daniel\appdata\roaming\dropbox\bin\dropbox.exe | 
"TCP Query User{491BAAED-0C03-44E2-AA85-F4A0425F16A9}C:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe | 
"TCP Query User{63B15F27-7DEC-41CB-BF3D-28E10520C51F}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"TCP Query User{97C6775B-6931-4E0F-9FCA-C062AF48CA37}E:\programme\ea games\mohaa\mohaa.exe" = protocol=6 | dir=in | app=e:\programme\ea games\mohaa\mohaa.exe | 
"TCP Query User{A2987C54-42F9-49F2-A6C3-F6BD6817DA48}C:\program files (x86)\2k games\firaxis games\sid meier's railroads!\railroads.exe" = protocol=6 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's railroads!\railroads.exe | 
"TCP Query User{AE08D5C1-A19E-49E6-972D-E425F88C61F9}E:\programme\thq\company of heroes\reliccoh.exe" = protocol=6 | dir=in | app=e:\programme\thq\company of heroes\reliccoh.exe | 
"TCP Query User{BCE9248F-80E6-4B10-86F1-489A4F3820F9}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"TCP Query User{C3DBE1ED-1D06-40C5-A6BA-2765ADF2EE7B}C:\users\daniel\appdata\local\temp\f59fc58181af420dbe6c1838bb2db491\relicdownloader.exe" = protocol=6 | dir=in | app=c:\users\daniel\appdata\local\temp\f59fc58181af420dbe6c1838bb2db491\relicdownloader.exe | 
"TCP Query User{C3EE53B2-1857-4088-8BAC-8945A077A1F5}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"TCP Query User{FEBB8963-4D45-4BEF-B78D-F6E82CC3F1BB}C:\users\daniel\appdata\local\temp\9ecb5fd8c9c344e087409563d2c404b0\relicdownloader.exe" = protocol=6 | dir=in | app=c:\users\daniel\appdata\local\temp\9ecb5fd8c9c344e087409563d2c404b0\relicdownloader.exe | 
"UDP Query User{0076175A-3B9F-4DDC-A4C7-9AF150EF9C30}E:\programme\thq\company of heroes\reliccoh.exe" = protocol=17 | dir=in | app=e:\programme\thq\company of heroes\reliccoh.exe | 
"UDP Query User{0D757B0A-CB7C-4353-AB03-07EE788F1253}E:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe" = protocol=17 | dir=in | app=e:\programme\thq\company of heroes\relicdownloader\relicdownloader.exe | 
"UDP Query User{356B30CF-5FC6-4ECD-912F-B87033809315}E:\programme\ea games\mohaa\mohaa.exe" = protocol=17 | dir=in | app=e:\programme\ea games\mohaa\mohaa.exe | 
"UDP Query User{7A2C0863-2B69-4E57-A81F-0156EA915C02}C:\users\daniel\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\daniel\appdata\roaming\dropbox\bin\dropbox.exe | 
"UDP Query User{8503CCC0-B84A-41A1-A252-9441A6AD8CD4}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"UDP Query User{8DEAFD8F-8261-47D8-B021-C1C30FDD17C5}C:\program files (x86)\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\google\google earth\plugin\geplugin.exe | 
"UDP Query User{AC853F7D-9685-4FDE-848F-186D6F4C1146}C:\users\daniel\appdata\local\temp\9ecb5fd8c9c344e087409563d2c404b0\relicdownloader.exe" = protocol=17 | dir=in | app=c:\users\daniel\appdata\local\temp\9ecb5fd8c9c344e087409563d2c404b0\relicdownloader.exe | 
"UDP Query User{AEF4736A-7145-4062-BE08-CFC0206F5C1C}C:\users\daniel\appdata\local\temp\f59fc58181af420dbe6c1838bb2db491\relicdownloader.exe" = protocol=17 | dir=in | app=c:\users\daniel\appdata\local\temp\f59fc58181af420dbe6c1838bb2db491\relicdownloader.exe | 
"UDP Query User{BC5D6193-4146-476F-8E7B-9FE1C861AC29}C:\program files (x86)\mozilla firefox\plugin-container.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\plugin-container.exe | 
"UDP Query User{CDD89668-CAF8-4F48-A9DA-8EAE2F331535}C:\program files (x86)\2k games\firaxis games\sid meier's railroads!\railroads.exe" = protocol=17 | dir=in | app=c:\program files (x86)\2k games\firaxis games\sid meier's railroads!\railroads.exe | 
"UDP Query User{EE044F63-B24A-4B9C-8944-7CEBEB244F06}C:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis 2\bin32\crysis2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{61A3F855-4587-4187-9D77-2EF8CD825A47}" = AVG 2011
"{7D4CEDA5-DF94-45A1-A893-C8779C781236}" = AVG 2011
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB3}" = Paint.NET v3.5.8
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 301.42
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AVG" = AVG 2011
"GPL Ghostscript 9.04" = GPL Ghostscript
"GSview 4.91beta" = GSview 4.91beta
"Lexmark S300-S400 Series" = Lexmark S300-S400 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Pen Tablet Driver" = Bamboo
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{0FEDB460-562A-4A93-B92D-02DA249F9618}" = Articulate Studio '09 Pro
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{11D08055-939C-432b-98C3-E072478A0CD7}" = PSE10 STI Installer
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}" = LG PC Suite II
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1B73CE68-01BC-479C-AC6D-3B596FF86051}" = LG PC Suite II
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{207CA43E-5BEB-4134-872F-D6E0C3C0DA45}" = Brother HL-2030
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{22D3A614-482C-444A-932C-9DA1B8ECDFD2}" = Elements 10 Organizer
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}" = LG United Mobile Driver
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{3AF8C37F-696E-871C-0851-CDE980FD665E}" = Bamboo Dock
"{3CEA4CA8-CDD4-451C-B673-E8F17BE01B15}" = Ulead COOL 360 1.0
"{3E5131E9-1241-4E43-8036-E870C0DEDD97}" = Articulate Studio '09 Pro
"{44E1DE63-C8FA-4C70-B4AA-0C49A947ACDE}" = Sid Meier's Railroads!
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA player 5.0
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{54F8DACC-E782-4840-980A-D76EFEA23DBD}" = Articulate Studio '09 Pro
"{6033673D-2530-4587-8AD0-EB059FC263F9}" = Crysis® 2
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD(R)
"{7403F306-1C79-4E98-AD5F-29ACD0F0BE00}" = Articulate Storyline
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.0.0
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EA79DBF-D637-448A-89D6-410A087A4493}" = Samsung_MonSetup
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A127C3C0-055E-38CF-B38F-1E85F8BBBFFE}" = Adobe Community Help
"{A6C11493-C2E4-4240-A59F-5DC804071DA6}" = Hemera Photo-Objects 1000
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C8550C86-A712-4219-AD4C-038C9FD1D149}" = Ulead PhotoImpact 11
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CF080EA9-C318-46D7-A597-4EA95714E631}" = Articulate Storyline
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark 
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D6044256-A309-43B5-9833-D3FAFE2AD24D}" = MagicTune Premium
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{E36E864B-BFB6-440A-9A23-2B0BEDE59A92}" = MultiScreen
"{E4352D83-BC0E-4AAB-851D-F279EBCFB971}" = Alien Skin Filter
"{E948B551-08DB-4163-8995-8C43B03D1B19}" = maxdome Download Manager 4.1.300.78
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{EE3FBD3C-782E-4A90-9507-0ECFE1FECCE4}" = Sid Meier's Railroads!
"{EE549AF9-8FAA-4584-83B2-ECF1BC9DC1FF}" = Adobe Photoshop Elements 10
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FFB768E4-E427-4553-BC36-A11F5E62A94D}" = Adobe Flash Player 10 ActiveX
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 10" = Adobe Photoshop Elements 10
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.13 (Unicode)
"AVMWLANCLI" = AVM FRITZ!WLAN
"Bamboo Dock" = Bamboo Dock
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Company of Heroes" = Company of Heroes
"Crysis WARHEAD(R)" = Crysis WARHEAD(R)
"FFmpeg for Audacity_is1" = FFmpeg v0.6.2 for Audacity
"FileZilla Client" = FileZilla Client 3.5.3
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.8
"Free YouTube Download 3_is1" = Free YouTube Download 3 version 3.0.7.718
"Free YouTube Download_is1" = Free YouTube Download version 2.10.32.305
"Free YouTube to DVD Converter_is1" = Free YouTube to DVD Converter version 3.0.6.1206
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.20.423
"Inkscape" = Inkscape 0.48.3.1
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{A6C11493-C2E4-4240-A59F-5DC804071DA6}" = Hemera Photo-Objects 1000
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.4.0 (Full)
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"MAGIX 3D Maker D" = MAGIX 3D Maker (embeded)
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Speed burnR D" = MAGIX Speed burnR
"MAGIX Video deluxe 16 Premium D" = MAGIX Video deluxe 16 Premium 9.0.1.60 (D)
"MAGIX Xtreme Foto Designer 6 D" = MAGIX Xtreme Foto Designer 6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"Opera 12.00.1467" = Opera 12.00
"Origin" = Origin
"PhotoStitch" = Canon Utilities PhotoStitch
"POIbase_is1" = POIbase 1.036
"Sid Meier's Railroads! Holiday Scenario" = Sid Meier's Railroads! Holiday Scenario
"TomTom HOME" = TomTom HOME 2.8.3.2499
"Uninstall_is1" = Uninstall 1.0.0.1
"virtualPhotographer_is1" = virtualPhotographer 1.5.6
"VLC media player" = VLC media player 1.1.5
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"XnView_is1" = XnView 1.97.8
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Kies Air Discovery Service" = Kies Air Discovery Service
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 05.05.2012 08:46:32 | Computer Name = Daniel-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: spoolsv.exe, Version: 6.1.7601.17514,
 Zeitstempel: 0x4ce7b4e7  Name des fehlerhaften Moduls: lxealmpm.dll, Version: 9.2.33.0,
 Zeitstempel: 0x4b20076a  Ausnahmecode: 0x40000015  Fehleroffset: 0x0000000000077f7e
ID
 des fehlerhaften Prozesses: 0x6e0  Startzeit der fehlerhaften Anwendung: 0x01cd2abacd000bd1
Pfad
 der fehlerhaften Anwendung: C:\Windows\System32\spoolsv.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\System32\lxealmpm.dll  Berichtskennung: 572338f4-96b0-11e1-9338-d027881f979b
 
Error - 10.05.2012 02:11:56 | Computer Name = Daniel-PC | Source = TabletServicePen | ID = 1
Description = 
 
Error - 16.05.2012 18:35:02 | Computer Name = Daniel-PC | Source = Application Hang | ID = 1002
Description = Programm ga_main.exe, Version 5.0.5.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 2c94    Startzeit:
 01cd33b319118925    Endzeit: 13    Anwendungspfad: C:\Program Files (x86)\Ulead Systems\Ulead
 PhotoImpact 11\anygif\ga_main.exe    Berichts-ID: 2e36279b-9fa7-11e1-9192-d027881f979b

 
Error - 16.05.2012 18:53:15 | Computer Name = Daniel-PC | Source = Application Hang | ID = 1002
Description = Programm ga_main.exe, Version 5.0.5.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 34ec    Startzeit:
 01cd33b5fd61f54b    Endzeit: 10    Anwendungspfad: C:\Program Files (x86)\Ulead Systems\Ulead
 PhotoImpact 11\anygif\ga_main.exe    Berichts-ID: 9190e8bc-9fa9-11e1-9192-d027881f979b

 
Error - 16.05.2012 18:55:23 | Computer Name = Daniel-PC | Source = Application Hang | ID = 1002
Description = Programm ga_main.exe, Version 5.0.5.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 3484    Startzeit:
 01cd33b6b4673956    Endzeit: 14    Anwendungspfad: C:\Program Files (x86)\Ulead Systems\Ulead
 PhotoImpact 11\anygif\ga_main.exe    Berichts-ID: 2fccbfed-9faa-11e1-9192-d027881f979b

 
Error - 16.05.2012 18:58:54 | Computer Name = Daniel-PC | Source = Application Hang | ID = 1002
Description = Programm ga_main.exe, Version 5.0.5.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 3464    Startzeit:
 01cd33b71f977400    Endzeit: 11    Anwendungspfad: C:\Program Files (x86)\Ulead Systems\Ulead
 PhotoImpact 11\anygif\ga_main.exe    Berichts-ID: a8a96489-9faa-11e1-9192-d027881f979b

 
Error - 19.05.2012 13:43:57 | Computer Name = Daniel-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 09.06.2012 12:59:59 | Computer Name = Daniel-PC | Source = TomTomHOMEService | ID = 10000
Description = 
 
Error - 21.06.2012 19:07:35 | Computer Name = Daniel-PC | Source = Application Hang | ID = 1002
Description = Programm PhotoshopElementsEditor.exe, Version 10.0.0.0 kann nicht 
mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
 in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 23c8    Startzeit: 01cd50027e831e7e    Endzeit: 10    Anwendungspfad:
 C:\Program Files (x86)\Adobe\Photoshop Elements 10\PhotoshopElementsEditor.exe    Berichts-ID:
 db0ba655-bbf5-11e1-a940-d027881f979b  
 
Error - 21.06.2012 19:54:46 | Computer Name = Daniel-PC | Source = Application Hang | ID = 1002
Description = Programm PhotoshopElementsEditor.exe, Version 10.0.0.0 kann nicht 
mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
 in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 1884    Startzeit: 01cd500909820f1f    Endzeit: 7    Anwendungspfad: 
C:\Program Files (x86)\Adobe\Photoshop Elements 10\PhotoshopElementsEditor.exe    Berichts-ID:
 78630e4b-bbfc-11e1-a940-d027881f979b  
 
[ System Events ]
Error - 23.07.2012 10:04:17 | Computer Name = Daniel-PC | Source = WMPNetworkSvc | ID = 866317
Description = 
 
Error - 23.07.2012 10:06:33 | Computer Name = Daniel-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 23.07.2012 10:06:42 | Computer Name = Daniel-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 23.07.2012 14:17:18 | Computer Name = Daniel-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 lxeaCATSCustConnectService erreicht.
 
Error - 23.07.2012 14:17:18 | Computer Name = Daniel-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lxeaCATSCustConnectService" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 23.07.2012 14:18:29 | Computer Name = Daniel-PC | Source = DCOM | ID = 10016
Description = 
 
Error - 23.07.2012 14:19:14 | Computer Name = Daniel-PC | Source = WMPNetworkSvc | ID = 866321
Description = 
 
Error - 23.07.2012 14:19:14 | Computer Name = Daniel-PC | Source = WMPNetworkSvc | ID = 866317
Description = 
 
Error - 23.07.2012 14:19:14 | Computer Name = Daniel-PC | Source = WMPNetworkSvc | ID = 866321
Description = 
 
Error - 23.07.2012 14:19:14 | Computer Name = Daniel-PC | Source = WMPNetworkSvc | ID = 866317
Description = 
 
 
< End of report >
         
Code:
ATTFilter
OTL logfile created on: 23.07.2012 20:47:24 - Run 1
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Daniel\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 5,98 Gb Available Physical Memory | 74,76% Memory free
24,00 Gb Paging File | 21,91 Gb Available in Paging File | 91,31% Paging File free
Paging file location(s): c:\pagefile.sys 0 0d:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 100,01 Gb Total Space | 2,95 Gb Free Space | 2,95% Space Free | Partition Type: NTFS
Drive D: | 365,75 Gb Total Space | 288,29 Gb Free Space | 78,82% Space Free | Partition Type: NTFS
Drive E: | 298,08 Gb Total Space | 71,49 Gb Free Space | 23,98% Space Free | Partition Type: NTFS
 
Computer Name: DANIEL-PC | User Name: Daniel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Daniel\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Opera\opera.exe (Opera Software)
PRC - C:\Program Files (x86)\Opera\pluginwrapper\opera_plugin_wrapper.exe (Opera Software)
PRC - C:\Users\Daniel\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
PRC - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
PRC - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Program Files (x86)\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\pdf24\pdf24.exe (Geek Software GmbH)
PRC - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
PRC - E:\Programme\WISO\mshaktuell.exe ()
PRC - C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe ()
PRC - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - D:\Microsoft Office 2010\Office14\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe ()
PRC - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe ()
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files (x86)\MultiScreen\MultiScreen.exe ()
PRC - C:\Program Files (x86)\maxdome\DCBin\DCTrayApp.exe ()
PRC - C:\Program Files (x86)\maxdome\DCBin\DCService.exe (Entriq, Inc.)
PRC - C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe ()
PRC - C:\Program Files (x86)\MagicTune Premium\GammaTray.exe ()
PRC - C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\Monitor.exe (Ulead Systems, Inc.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll ()
MOD - C:\Users\Daniel\AppData\Local\Temp\c06086cf-47b1-4760-b263-4e4271d9922f\CliSecureRT.dll ()
MOD - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MOD - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
MOD - E:\Programme\WISO\wgui11.dll ()
MOD - E:\Programme\WISO\rscorewinapi47.dll ()
MOD - E:\Programme\WISO\wstyle11.dll ()
MOD - E:\Programme\WISO\wstyle111.dll ()
MOD - E:\Programme\WISO\wauff11.dll ()
MOD - E:\Programme\WISO\wfvie11.dll ()
MOD - E:\Programme\WISO\mshaktuell.exe ()
MOD - E:\Programme\WISO\wreli11.dll ()
MOD - E:\Programme\WISO\rsodbc47.dll ()
MOD - E:\Programme\WISO\rsdcom47.dll ()
MOD - E:\Programme\WISO\wcore11.dll ()
MOD - E:\Programme\WISO\wsteu11.dll ()
MOD - E:\Programme\WISO\rsguiwinapi47.dll ()
MOD - C:\Users\Daniel\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_Accessibility.DEU ()
MOD - C:\Users\Daniel\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_rdlang32.deu ()
MOD - E:\Programme\WISO\qtsqlrs47.dll ()
MOD - C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe ()
MOD - E:\Programme\WISO\qtxmlrs47.dll ()
MOD - E:\Programme\WISO\qtwebkitrs47.dll ()
MOD - E:\Programme\WISO\qtsvgrs47.dll ()
MOD - E:\Programme\WISO\qttestrs47.dll ()
MOD - E:\Programme\WISO\qtscriptrs47.dll ()
MOD - E:\Programme\WISO\qtnetworkrs47.dll ()
MOD - E:\Programme\WISO\qtguirs47.dll ()
MOD - E:\Programme\WISO\qt3supportrs47.dll ()
MOD - E:\Programme\WISO\qtcorers47.dll ()
MOD - E:\Programme\WISO\phononrs47.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\Epwizard.DLL ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\customui.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\Epfunct.DLL ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\Eputil.DLL ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\Imagutil.DLL ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeaDRS.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeascw.dll ()
MOD - C:\Program Files (x86)\MultiScreen\MultiScreen.exe ()
MOD - C:\Program Files (x86)\MultiScreen\MGResGer.dll ()
MOD - C:\Program Files (x86)\MultiScreen\SmartMouseDll.dll ()
MOD - C:\Program Files (x86)\MultiScreen\TitleBar.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\EPOEMDll.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\epstring.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\EPWizRes.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeadatr.dll ()
MOD - C:\Program Files (x86)\maxdome\DCBin\sqlite3.dll ()
MOD - C:\Program Files (x86)\maxdome\DCBin\PocoFoundation.dll ()
MOD - C:\Program Files (x86)\maxdome\DCBin\PocoNet.dll ()
MOD - C:\Program Files (x86)\maxdome\DCBin\DCTrayApp.exe ()
MOD - C:\Windows\SysWOW64\LXEAsmr.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\iptk.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeacaps.dll ()
MOD - C:\Program Files (x86)\Lexmark S300-S400 Series\lxeaptp.dll ()
MOD - C:\Windows\SysWOW64\LXEAsm.dll ()
MOD - C:\Program Files (x86)\MagicTune Premium\GammaTray.exe ()
MOD - C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\DetMethod.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (lxea_device) -- C:\Windows\SysNative\lxeacoms.exe ( )
SRV:64bit: - (lxeaCATSCustConnectService) -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeaserv.exe ()
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AVGIDSAgent) -- C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (TomTomHOMEService) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (TabletServicePen) -- C:\Programme\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (TouchServicePen) -- C:\Programme\Tablet\Pen\Pen_TouchService.exe (Wacom Technology, Corp.)
SRV - (AdobeActiveFileMonitor10.0) -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (avgwd) -- C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin)
SRV - (lxeaCATSCustConnectService) -- C:\Windows\system32\spool\DRIVERS\x64\3\\lxeaserv.exe ()
SRV - (lxea_device) -- C:\Windows\SysWOW64\lxeacoms.exe ( )
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Prosieben) -- C:\Program Files (x86)\maxdome\DCBin\DCService.exe (Entriq, Inc.)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (MagicTuneEngine) -- C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (wacmoumonitor) -- C:\Windows\SysNative\drivers\wacmoumonitor.sys (Wacom Technology)
DRV:64bit: - (wacommousefilter) -- C:\Windows\SysNative\drivers\wacommousefilter.sys (Wacom Technology)
DRV:64bit: - (wacomvhid) -- C:\Windows\SysNative\drivers\wacomvhid.sys (Wacom Technology)
DRV:64bit: - (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (AVGIDSDriver) -- C:\Windows\SysNative\drivers\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgtdia) -- C:\Windows\SysNative\drivers\avgtdia.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (Avgrkx64) -- C:\Windows\SysNative\drivers\avgrkx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (Avgmfx64) -- C:\Windows\SysNative\drivers\avgmfx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (AVGIDSEH) -- C:\Windows\SysNative\drivers\AVGIDSEH.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (AVGIDSFilter) -- C:\Windows\SysNative\drivers\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV:64bit: - (Avgldx64) -- C:\Windows\SysNative\drivers\avgldx64.sys (AVG Technologies CZ, s.r.o.)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (FWLANUSB) -- C:\Windows\SysNative\drivers\fwlanusb.sys (AVM GmbH)
DRV:64bit: - (avmeject) -- C:\Windows\SysNative\drivers\avmeject.sys (AVM Berlin)
DRV:64bit: - (ahcix64s) -- C:\Windows\SysNative\drivers\ahcix64s.sys (Advanced Micro Devices, Inc)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (NEC Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (NEC Electronics Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:64bit: - (USBModem) -- C:\Windows\SysNative\drivers\lgx64modem.sys (LG Electronics Inc.)
DRV:64bit: - (UsbDiag) -- C:\Windows\SysNative\drivers\lgx64diag.sys (LG Electronics Inc.)
DRV:64bit: - (usbbus) -- C:\Windows\SysNative\drivers\lgx64bus.sys (LG Electronics Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {766C7474-5BBE-409B-9780-74503C1F2E45}
IE:64bit: - HKLM\..\SearchScopes\{766C7474-5BBE-409B-9780-74503C1F2E45}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {303DEC1A-4896-4D24-9BC7-28A73B2282CE}
IE - HKLM\..\SearchScopes\{303DEC1A-4896-4D24-9BC7-28A73B2282CE}: "URL" = hxxp://www.google.de/search?q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.kiebel.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.kiebel.de
IE - HKCU\..\SearchScopes,DefaultScope = {FB9D2757-3BB3-4FC1-8924-851293C7E0DD}
IE - HKCU\..\SearchScopes\{9DADB8AD-3E1F-497E-B3EE-24402EA6DC5A}: "URL" = hxxp://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms}
IE - HKCU\..\SearchScopes\{C47DE371-80FA-475A-AF12-972937E9D128}: "URL" = hxxp://dict.leo.org/ende?lp=ende&lang=de&searchLoc=0&cmpType=relaxed&sectHdr=on&spellToler=on&chinese=both&pinyin=diacritic&search={searchTerms}&relink=on
IE - HKCU\..\SearchScopes\{FB9D2757-3BB3-4FC1-8924-851293C7E0DD}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1178
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.1
FF - prefs.js..extensions.enabledItems: {ada4b710-8346-4b82-8199-5de2b400a6ae}:1.9.9.3
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:3.4
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2
FF - prefs.js..network.proxy.http: "195.191.13.252"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@virtools.com/3DviaPlayer: C:\Program Files (x86)\Virtools\3D Life Player\npvirtools.dll (Dassault Systèmes)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.1: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG10\Firefox4\ [2012.02.02 21:41:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.19 10:45:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.08.26 13:14:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.16 20:59:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.19 10:45:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.08.26 13:14:20 | 000,000,000 | ---D | M]
 
[2011.02.19 20:08:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\mozilla\Extensions
[2011.02.02 22:25:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.02.19 20:08:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012.07.19 21:17:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions
[2012.07.10 12:11:12 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2011.02.03 04:08:01 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.02.22 11:32:13 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2012.07.19 21:17:34 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2011.03.12 18:18:43 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2012.06.13 19:51:50 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions\foxmarks@kei.com
[2012.05.17 20:40:36 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Daniel\AppData\Roaming\mozilla\Firefox\Profiles\scnvlys5.default\extensions\ich@maltegoetz.de
[2011.01.31 01:44:52 | 000,002,152 | ---- | M] () -- C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\scnvlys5.default\searchplugins\qrobeit.xml
[2012.06.03 23:36:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.02 01:26:42 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.03 23:36:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\firefoxevents@articulate.com
[2012.02.11 19:41:42 | 000,265,651 | ---- | M] () (No name found) -- C:\USERS\DANIEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SCNVLYS5.DEFAULT\EXTENSIONS\{398E77B8-2304-11DC-8314-0800200C9A66}.XPI
[2012.07.12 15:47:16 | 000,525,390 | ---- | M] () (No name found) -- C:\USERS\DANIEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SCNVLYS5.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
[2012.06.16 10:13:23 | 000,182,698 | ---- | M] () (No name found) -- C:\USERS\DANIEL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SCNVLYS5.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
[2012.07.19 10:45:54 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.02.24 15:26:39 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.04.26 14:03:39 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.26 14:03:39 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.04.26 14:03:39 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.26 14:03:39 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.26 14:03:39 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.26 14:03:39 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Microsoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [lxeamon.exe] C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [B2C_AGENT] C:\ProgramData\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe (LG Electronics)
O4 - HKLM..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\pdf24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [TrayServer] C:\PROGRA~2\MAGIX\VIDEO_~1\TrayServer.exe (MAGIX AG)
O4 - HKLM..\Run: [Ulead AutoDetector v2] C:\Program Files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe (Ulead Systems, Inc.)
O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [MultiScreen] C:\Program Files (x86)\MultiScreen\MultiScreen.exe ()
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Daniel\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = D:\Microsoft Office 2010\Office14\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O8:64bit: - Extra context menu item: An OneNote s&enden - D:\Microsoft Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to DVD Converter - C:\Users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetodvdconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Microsoft Office 2010\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: An OneNote s&enden - D:\Microsoft Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to DVD Converter - C:\Users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetodvdconverter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Microsoft Office 2010\Office14\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Microsoft Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Microsoft Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Microsoft Office 2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Microsoft Office 2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: entriq.net ([]http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: entriq.net ([]https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: rettungsfachpersonal.de ([www] https in Vertrauenswürdige Sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63691414-881A-4524-B6C2-0219CE6B319B}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F25D7454-71CD-4B20-BDC9-EE9BBAD91DB7}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autorun.exe
O33 - MountPoints2\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe
O33 - MountPoints2\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\Shell - "" = AutoRun
O33 - MountPoints2\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\Shell\AutoRun\command - "" = H:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgchsva.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.23 20:46:07 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
[2012.07.23 18:19:03 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Malwarebytes
[2012.07.23 18:18:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.23 18:18:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.23 18:18:54 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.23 18:18:54 | 000,000,000 | ---D | C] -- D:\Malwarebytes' Anti-Malware
[2012.07.19 21:17:41 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\QuickScan
[2012.07.19 14:30:30 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Help
[2012.07.19 14:10:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\TeamViewer
[2012.07.19 14:10:08 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Roaming\Google
[2012.07.12 10:05:43 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.07.12 10:05:43 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.07.12 10:05:42 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.07.12 10:05:42 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.07.12 10:05:41 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.07.12 10:05:41 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.07.12 10:05:40 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.07.12 10:05:40 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.07.12 10:05:38 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.07.12 10:05:38 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.07.12 10:05:38 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.07.12 10:05:38 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.07.12 10:05:38 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.07.11 10:19:33 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.11 10:19:33 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.11 10:19:25 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.11 10:19:23 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.07.11 10:19:23 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012.07.05 22:28:57 | 007,316,624 | ---- | C] (Green Eye GmbH                      ) -- D:\WEBDE_Fussballspiel.exe
[2012.07.02 21:03:00 | 000,000,000 | ---D | C] -- D:\drupal-7.14-DE
[2012.07.02 20:20:49 | 004,518,720 | ---- | C] (FileZilla Project) -- D:\FileZilla_3.5.3_win32-setup.exe
[2012.07.02 01:26:18 | 000,000,000 | ---D | C] -- D:\OneNote-Notizbücher
[2012.07.01 18:46:43 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Desktop\HLW BLS guidelines2010
[2012.07.01 15:21:12 | 001,355,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msvbvm50.dll
[2012.07.01 15:21:12 | 000,880,640 | ---- | C] (Woodbury Associates Limited) -- C:\Windows\SysWow64\UniBox10.ocx
[2012.07.01 15:21:12 | 000,368,640 | ---- | C] (Shyam Pillai) -- C:\Windows\SysWow64\artemflib.dll
[2012.07.01 15:21:12 | 000,180,224 | ---- | C] (Softanics) -- C:\Windows\SysWow64\fctlbox.dll
[2012.07.01 15:21:12 | 000,147,456 | ---- | C] (Info-ZIP) -- C:\Windows\SysWow64\vbzip11.dll
[2012.07.01 15:21:12 | 000,090,112 | ---- | C] (hxxp://www.mvps.org/vb) -- C:\Windows\SysWow64\ccrpTmr6.dll
[2012.07.01 15:21:12 | 000,065,536 | ---- | C] (vbAccelerator) -- C:\Windows\SysWow64\ProgBar6.ocx
[2012.07.01 15:11:38 | 092,796,176 | ---- | C] (Macrovision Corporation) -- D:\Studio-09-Update-8.exe
[2012.07.01 14:36:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2012.07.01 14:36:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2012.07.01 14:35:58 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2012.07.01 14:33:21 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2012.07.01 14:33:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2012.07.01 14:32:48 | 000,000,000 | ---D | C] -- C:\Users\Daniel\AppData\Local\Microsoft Help
[2012.07.01 14:32:45 | 000,000,000 | ---D | C] -- D:\Microsoft Office 2010
[2012.07.01 14:32:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2012.07.01 14:32:32 | 000,000,000 | RH-D | C] -- D:\MSOCache
[2012.07.01 13:18:29 | 000,000,000 | ---D | C] -- C:\Users\Daniel\Desktop\Microsoft Office Home and Business 2010 - 1PC-1User
[2012.07.01 13:18:00 | 000,849,056 | ---- | C] (Amazon Services LLC) -- D:\Microsoft_Office_Home_and_Business_2010_1PC_1User_Downloader.exe
[2007.08.13 18:46:00 | 000,102,912 | ---- | C] (Albert L Faber) -- C:\Users\Daniel\AppData\Local\CDRip.dll
[2007.01.18 22:09:54 | 000,623,616 | ---- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\Daniel\AppData\Local\No23 Recorder.exe
[2006.12.11 20:13:14 | 000,013,872 | ---- | C] (Un4seen Developments) -- C:\Users\Daniel\AppData\Local\basscd.dll
[2006.12.11 20:13:12 | 000,097,336 | ---- | C] (Un4seen Developments) -- C:\Users\Daniel\AppData\Local\bass.dll
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.23 20:49:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.23 20:46:08 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Daniel\Desktop\OTL.exe
[2012.07.23 20:24:39 | 000,019,904 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.23 20:24:39 | 000,019,904 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.23 20:18:07 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.23 20:17:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.23 20:17:11 | 2146,836,479 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.23 18:18:55 | 000,000,775 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.23 16:07:43 | 101,994,634 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2012.07.22 20:25:21 | 000,000,283 | ---- | M] () -- C:\Windows\Brownie.ini
[2012.07.22 20:10:32 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.22 20:10:32 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.22 20:10:32 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.22 20:10:32 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.22 20:10:32 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.22 14:13:32 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.07.22 14:13:32 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.07.20 07:27:46 | 000,002,411 | ---- | M] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2012.07.20 00:48:10 | 005,281,237 | ---- | M] () -- D:\IMG_2992.JPG
[2012.07.19 02:45:46 | 005,601,121 | ---- | M] () -- D:\Braunwald 013.JPG
[2012.07.19 02:45:13 | 005,714,076 | ---- | M] () -- D:\Braunwald 005.JPG
[2012.07.12 17:47:58 | 000,591,174 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavichjg.avm
[2012.07.12 16:03:31 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2012.07.12 15:32:16 | 001,202,304 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.11 01:09:11 | 000,000,022 | ---- | M] () -- D:\desert_airfield.zip
[2012.07.11 01:01:03 | 000,000,022 | ---- | M] () -- D:\BlueRiver_Island_8.zip
[2012.07.11 00:58:23 | 007,287,045 | ---- | M] () -- D:\thehillside.7z
[2012.07.10 23:55:17 | 000,000,022 | ---- | M] () -- D:\scraping_the_barrel.zip
[2012.07.10 23:46:05 | 000,000,136 | ---- | M] () -- D:\the_castle_wars_sgb_file.zip
[2012.07.07 00:42:56 | 000,392,970 | ---- | M] () -- D:\keine-verunglimpfung-von-rettungsfachpersonal-durch-aerztliche-verbaende-und-organisationen.pdf
[2012.07.05 22:29:23 | 007,316,624 | ---- | M] (Green Eye GmbH                      ) -- D:\WEBDE_Fussballspiel.exe
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.02 21:02:14 | 003,606,721 | ---- | M] () -- D:\drupal-7.14-DE.zip
[2012.07.02 20:21:08 | 004,518,720 | ---- | M] (FileZilla Project) -- D:\FileZilla_3.5.3_win32-setup.exe
[2012.07.02 01:26:20 | 000,001,019 | ---- | M] () -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
[2012.07.01 18:31:40 | 000,045,847 | ---- | M] () -- D:\SME-Logo-articulate.JPG
[2012.07.01 15:21:45 | 000,000,662 | ---- | M] () -- C:\Users\Public\Desktop\Articulate Video Encoder '09.lnk
[2012.07.01 15:21:33 | 000,000,817 | ---- | M] () -- C:\Users\Public\Desktop\Articulate Quizmaker '09.lnk
[2012.07.01 15:21:25 | 000,000,797 | ---- | M] () -- C:\Users\Public\Desktop\Articulate Engage '09.lnk
[2012.07.01 15:21:10 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\Articulate Presenter '09.lnk
[2012.07.01 15:19:55 | 000,001,281 | ---- | M] () -- C:\Users\Daniel\Desktop\EXCEL - Verknüpfung.lnk
[2012.07.01 15:19:32 | 000,001,297 | ---- | M] () -- C:\Users\Daniel\Desktop\WINWORD - Verknüpfung.lnk
[2012.07.01 15:19:06 | 000,001,340 | ---- | M] () -- C:\Users\Daniel\Desktop\POWERPNT - Verknüpfung.lnk
[2012.07.01 15:17:41 | 092,796,176 | ---- | M] (Macrovision Corporation) -- D:\Studio-09-Update-8.exe
[2012.07.01 13:18:01 | 000,849,056 | ---- | M] (Amazon Services LLC) -- D:\Microsoft_Office_Home_and_Business_2010_1PC_1User_Downloader.exe
 
========== Files Created - No Company Name ==========
 
[2012.07.23 18:18:55 | 000,000,775 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.20 00:47:30 | 005,281,237 | ---- | C] () -- D:\IMG_2992.JPG
[2012.07.19 02:45:26 | 005,601,121 | ---- | C] () -- D:\Braunwald 013.JPG
[2012.07.19 02:44:39 | 005,714,076 | ---- | C] () -- D:\Braunwald 005.JPG
[2012.07.11 01:05:12 | 000,000,022 | ---- | C] () -- D:\desert_airfield.zip
[2012.07.11 00:59:13 | 000,000,022 | ---- | C] () -- D:\BlueRiver_Island_8.zip
[2012.07.11 00:57:56 | 007,287,045 | ---- | C] () -- D:\thehillside.7z
[2012.07.10 23:54:15 | 000,000,022 | ---- | C] () -- D:\scraping_the_barrel.zip
[2012.07.10 23:39:13 | 000,000,136 | ---- | C] () -- D:\the_castle_wars_sgb_file.zip
[2012.07.07 00:42:56 | 000,392,970 | ---- | C] () -- D:\keine-verunglimpfung-von-rettungsfachpersonal-durch-aerztliche-verbaende-und-organisationen.pdf
[2012.07.02 21:02:01 | 003,606,721 | ---- | C] () -- D:\drupal-7.14-DE.zip
[2012.07.02 01:26:20 | 000,001,019 | ---- | C] () -- C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
[2012.07.01 18:31:40 | 000,045,847 | ---- | C] () -- D:\SME-Logo-articulate.JPG
[2012.07.01 15:21:45 | 000,000,662 | ---- | C] () -- C:\Users\Public\Desktop\Articulate Video Encoder '09.lnk
[2012.07.01 15:21:33 | 000,000,817 | ---- | C] () -- C:\Users\Public\Desktop\Articulate Quizmaker '09.lnk
[2012.07.01 15:21:25 | 000,000,797 | ---- | C] () -- C:\Users\Public\Desktop\Articulate Engage '09.lnk
[2012.07.01 15:21:10 | 000,000,871 | ---- | C] () -- C:\Users\Public\Desktop\Articulate Presenter '09.lnk
[2012.07.01 15:19:55 | 000,001,281 | ---- | C] () -- C:\Users\Daniel\Desktop\EXCEL - Verknüpfung.lnk
[2012.07.01 15:19:32 | 000,001,297 | ---- | C] () -- C:\Users\Daniel\Desktop\WINWORD - Verknüpfung.lnk
[2012.07.01 15:19:18 | 000,001,340 | ---- | C] () -- C:\Users\Daniel\Desktop\POWERPNT - Verknüpfung.lnk
[2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012.05.06 17:24:52 | 000,000,035 | ---- | C] () -- C:\Windows\A5W.INI
[2012.04.28 00:30:37 | 000,000,218 | ---- | C] () -- C:\Users\Daniel\AppData\Local\recently-used.xbel
[2012.03.10 19:29:51 | 000,003,584 | ---- | C] () -- C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.26 19:20:58 | 000,000,758 | ---- | C] () -- C:\Windows\wiso.ini
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.08.08 20:51:11 | 000,011,270 | ---- | C] () -- C:\Users\Daniel\gsview64.ini
[2011.03.03 00:06:18 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.03.02 16:53:06 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2011.02.21 18:41:01 | 000,000,204 | ---- | C] () -- C:\Windows\ulead32.ini
[2011.02.17 02:11:44 | 000,007,597 | ---- | C] () -- C:\Users\Daniel\AppData\Local\Resmon.ResmonCfg
[2011.02.15 23:29:32 | 000,001,540 | ---- | C] () -- C:\Users\Daniel\AppData\Local\RecConfig.xml
[2011.01.30 23:30:44 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeaserv.dll
[2011.01.30 23:30:44 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeausb1.dll
[2011.01.30 23:30:44 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacomc.dll
[2011.01.30 23:30:44 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeahbn3.dll
[2011.01.30 23:30:44 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeapmui.dll
[2011.01.30 23:30:44 | 000,598,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacoms.exe
[2011.01.30 23:30:44 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxealmpm.dll
[2011.01.30 23:30:44 | 000,373,416 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacfg.exe
[2011.01.30 23:30:44 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeacomm.dll
[2011.01.30 23:30:44 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeainpa.dll
[2011.01.30 23:30:44 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxeacomx.dll
[2011.01.30 23:30:44 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeaiesc.dll
[2011.01.30 23:30:44 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEAinst.dll
[2011.01.30 23:30:44 | 000,324,264 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeaih.exe
[2011.01.30 23:30:44 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxeains.dll
[2011.01.30 23:30:44 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxeainsb.dll
[2011.01.30 23:30:44 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxeacu.dll
[2011.01.30 23:30:44 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxeainsr.dll
[2011.01.30 23:30:44 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxeacub.dll
[2011.01.30 23:30:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxeajswr.dll
[2011.01.30 23:30:44 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxeacur.dll
[2011.01.30 19:05:17 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEAsm.dll
[2011.01.30 19:05:17 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\LXEAsmr.dll
[2011.01.30 18:13:18 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.01.29 00:52:12 | 000,000,151 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2011.01.29 00:52:12 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2011.01.29 00:52:11 | 000,009,030 | ---- | C] () -- C:\Windows\HL-2030.INI
[2011.01.29 00:52:11 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\brlmw03a.ini
[2011.01.29 00:51:51 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.01.29 00:50:57 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\bd2030.dat
[2011.01.29 00:50:02 | 000,000,283 | ---- | C] () -- C:\Windows\Brownie.ini
[2011.01.29 00:36:31 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll
[2011.01.29 00:36:31 | 000,002,411 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini
[2010.12.22 17:20:54 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.12.22 17:20:54 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.12.22 17:20:53 | 000,790,528 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.12.22 17:20:53 | 000,134,144 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.12.22 17:20:53 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.12.22 16:47:39 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2007.08.13 18:46:00 | 000,155,136 | ---- | C] () -- C:\Users\Daniel\AppData\Local\lame_enc.dll
[2006.10.26 02:06:48 | 000,064,000 | ---- | C] () -- C:\Users\Daniel\AppData\Local\vorbisenc.dll
[2006.10.26 02:06:48 | 000,019,456 | ---- | C] () -- C:\Users\Daniel\AppData\Local\vorbisfile.dll
[2006.10.26 02:06:46 | 000,143,872 | ---- | C] () -- C:\Users\Daniel\AppData\Local\vorbis.dll
[2006.10.26 02:06:36 | 000,015,872 | ---- | C] () -- C:\Users\Daniel\AppData\Local\ogg.dll
[2005.08.23 23:34:06 | 000,029,184 | ---- | C] () -- C:\Users\Daniel\AppData\Local\no23xwrapper.dll

< End of report >
         
__________________

Alt 24.07.2012, 01:44   #4
t'john
/// Helfer-Team
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



MBAM Log?

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
PRC - E:\Programme\WISO\mshaktuell.exe ()
MOD - C:\Users\Daniel\AppData\Local\Temp\c06086cf-47b1-4760-b263-4e4271d9922f\CliSecureRT.dll () 
MOD - C:\Windows\SysWOW64\LXEAsmr.dll () 
MOD - C:\Windows\SysWOW64\LXEAsm.dll () 
SRV:64bit: - (lxeaCATSCustConnectService) -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeaserv.exe () 
SRV - (lxeaCATSCustConnectService) -- C:\Windows\system32\spool\DRIVERS\x64\3\\lxeaserv.exe () 
SRV - (MagicTuneEngine) -- C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {766C7474-5BBE-409B-9780-74503C1F2E45} 
IE:64bit: - HKLM\..\SearchScopes\{766C7474-5BBE-409B-9780-74503C1F2E45}: "URL" = http://www.google.de/search?q={searchTerms} 
IE - HKLM\..\SearchScopes,DefaultScope = {303DEC1A-4896-4D24-9BC7-28A73B2282CE} 
IE - HKLM\..\SearchScopes\{303DEC1A-4896-4D24-9BC7-28A73B2282CE}: "URL" = http://www.google.de/search?q={searchTerms} 
IE - HKCU\..\SearchScopes,DefaultScope = {FB9D2757-3BB3-4FC1-8924-851293C7E0DD} 
IE - HKCU\..\SearchScopes\{9DADB8AD-3E1F-497E-B3EE-24402EA6DC5A}: "URL" = http://de.wikipedia.org/w/index.php?title=Spezial:Suche&search={searchTerms} 
IE - HKCU\..\SearchScopes\{C47DE371-80FA-475A-AF12-972937E9D128}: "URL" = http://dict.leo.org/ende?lp=ende&lang=de&searchLoc=0&cmpType=relaxed§Hdr=on&spellToler=on&chinese=both&pinyin=diacritic&search={searchTerms}&relink=on 
IE - HKCU\..\SearchScopes\{FB9D2757-3BB3-4FC1-8924-851293C7E0DD}: "URL" = http://www.google.de/search?q={searchTerms} 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://www.web.de" 
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1178 
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.1 
FF - prefs.js..extensions.enabledItems: {ada4b710-8346-4b82-8199-5de2b400a6ae}:1.9.9.3 
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:3.4 
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9 
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.2 
FF - prefs.js..network.proxy.http: "195.191.13.252" 
FF - prefs.js..network.proxy.http_port: 8080 
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" 
FF - prefs.js..network.proxy.share_proxy_settings: true 
FF - prefs.js..network.proxy.type: 0 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) 
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found 
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll () 
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) 
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe () 
O4:64bit: - HKLM..\Run: [lxeamon.exe] C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe () 
O4 - HKLM..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe () 
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () 
O4 - HKCU..\Run: [MultiScreen] C:\Program Files (x86)\MultiScreen\MultiScreen.exe () 
O4 - Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Daniel\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) 
O4 - Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = D:\Microsoft Office 2010\Office14\ONENOTEM.EXE (Microsoft Corporation) 
O4 - Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data] 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Autorun.exe 
O33 - MountPoints2\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autorun.exe 
O33 - MountPoints2\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\Shell - "" = AutoRun 
O33 - MountPoints2\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\Shell\AutoRun\command - "" = H:\pushinst.exe 

:Files

E:\Programme\WISO\mshaktuell.exe
C:\Windows\MusiccityDownload.exe
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________
Mfg, t'john
Das TB unterstützen

Alt 24.07.2012, 12:40   #5
Medix
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



OTL-Logfile

Code:
ATTFilter
All processes killed
========== OTL ==========
No active process named mshaktuell.exe was found!
Service lxeaCATSCustConnectService stopped successfully!
Service lxeaCATSCustConnectService deleted successfully!
File move failed. C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeaserv.exe scheduled to be moved on reboot.
Error: No service named lxeaCATSCustConnectService was found to stop!
Service\Driver key lxeaCATSCustConnectService not found.
File  C:\Windows\system32\spool\DRIVERS\x64\3\\lxeaserv.exe  not found.
Error: Unable to stop service MagicTuneEngine!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MagicTuneEngine deleted successfully.
C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{766C7474-5BBE-409B-9780-74503C1F2E45}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{766C7474-5BBE-409B-9780-74503C1F2E45}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{303DEC1A-4896-4D24-9BC7-28A73B2282CE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{303DEC1A-4896-4D24-9BC7-28A73B2282CE}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9DADB8AD-3E1F-497E-B3EE-24402EA6DC5A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9DADB8AD-3E1F-497E-B3EE-24402EA6DC5A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C47DE371-80FA-475A-AF12-972937E9D128}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C47DE371-80FA-475A-AF12-972937E9D128}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FB9D2757-3BB3-4FC1-8924-851293C7E0DD}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FB9D2757-3BB3-4FC1-8924-851293C7E0DD}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.web.de" removed from browser.startup.homepage
Prefs.js: {3f963a5b-e555-4543-90e2-c3908898db71}:10.0.0.1178 removed from extensions.enabledItems
Prefs.js: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.1.1 removed from extensions.enabledItems
Prefs.js: {ada4b710-8346-4b82-8199-5de2b400a6ae}:1.9.9.3 removed from extensions.enabledItems
Prefs.js: fastdial@telega.phpnet.us:3.4 removed from extensions.enabledItems
Prefs.js: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9 removed from extensions.enabledItems
Prefs.js: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 removed from extensions.enabledItems
Prefs.js: de-DE@dictionaries.addons.mozilla.org:2.0.2 removed from extensions.enabledItems
Prefs.js: "195.191.13.252" removed from network.proxy.http
Prefs.js: 8080 removed from network.proxy.http_port
Prefs.js: "localhost, 127.0.0.1, stealthy.co" removed from network.proxy.no_proxies_on
Prefs.js: true removed from network.proxy.share_proxy_settings
Prefs.js: 0 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll not found.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1017A80C-6F09-4548-A84D-EDD6AC9525F0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1017A80C-6F09-4548-A84D-EDD6AC9525F0}\ deleted successfully.
C:\Programme\Lexmark Toolbar\toolband.dll moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeAAMUpdater-1.0 deleted successfully.
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EzPrint deleted successfully.
C:\Program Files (x86)\Lexmark S300-S400 Series\ezprint.exe moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\lxeamon.exe deleted successfully.
C:\Program Files (x86)\Lexmark S300-S400 Series\lxeamon.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\BambooCore deleted successfully.
C:\Program Files (x86)\Bamboo Dock\BambooCore.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\KiesPDLR deleted successfully.
C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MultiScreen deleted successfully.
C:\Program Files (x86)\MultiScreen\MultiScreen.exe moved successfully.
C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk moved successfully.
C:\Users\Daniel\AppData\Roaming\Dropbox\bin\Dropbox.exe moved successfully.
C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk moved successfully.
D:\Microsoft Office 2010\Office14\ONENOTEM.EXE moved successfully.
C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk moved successfully.
C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutorun deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{14399e9a-3ba2-11e0-858b-806e6f6e6963}\ not found.
File F:\Autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{22e3e355-24ba-11e0-bc29-806e6f6e6963}\ not found.
File E:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3b8d37f4-2b1c-11e0-857b-d027881f979b}\ not found.
File H:\pushinst.exe not found.
========== FILES ==========
E:\Programme\WISO\mshaktuell.exe moved successfully.
C:\Windows\MusiccityDownload.exe moved successfully.
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Daniel\Desktop\cmd.bat deleted successfully.
C:\Users\Daniel\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Daniel
->Temp folder emptied: 146332110 bytes
->Temporary Internet Files folder emptied: 839693278 bytes
->Java cache emptied: 23393731 bytes
->FireFox cache emptied: 66174275 bytes
->Opera cache emptied: 43183873 bytes
->Flash cache emptied: 58131 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 66340 bytes
->Flash cache emptied: 56478 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Internet
->Temp folder emptied: 508660 bytes
->Temporary Internet Files folder emptied: 67052 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 288709935 bytes
->Flash cache emptied: 2543 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 66340 bytes
->Flash cache emptied: 56466 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 395181327 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 751 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 1.720,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Daniel
->Flash cache emptied: 0 bytes
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Internet
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.54.0 log created on 07242012_132727

Files\Folders moved on Reboot...
File\Folder C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxeaserv.exe not found!
C:\Users\Daniel\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Windows\SysNative\spool\DRIVERS\x64\3\lxeaserv.exe not found!
File C:\Users\Daniel\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...
         
Hier noch das MBAM-Logfile

Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.23.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Daniel :: DANIEL-PC [Administrator]

23.07.2012 18:20:22
mbam-log-2012-07-23 (20-12-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 698415
Laufzeit: 1 Stunde(n), 49 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 9
D:\AppsMsnDe.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
E:\Dokumente und Einstellungen\Daniel\Eigene Dateien\Downloads\sayiti.exe (Malware.Packer.Gen) -> Keine Aktion durchgeführt.
E:\Programme\Lupo_PenSuite\Lupo PenSuite v6.64 Full\Apps\CCleaner Portable\unicows.dll (Malware.Packer.Gen) -> Keine Aktion durchgeführt.
E:\Programme\Lupo_PenSuite\Lupo PenSuite v6.64 Full\Apps\Free Download Manager\dbghelp.dll (Malware.Packer.Gen) -> Keine Aktion durchgeführt.
E:\Programme\Lupo_PenSuite\Lupo PenSuite v6.64 Full\Apps\Free Download Manager\msvcp60.dll (Malware.Packer.Gen) -> Keine Aktion durchgeführt.
E:\Programme\Lupo_PenSuite\Lupo PenSuite v6.64 Full\Apps\Gnumeric Plus\App\Gnumeric\lib\gnumeric\1.9.3\plugins\fn-tsa\plugin.dll (Trojan.Downloader) -> Keine Aktion durchgeführt.
E:\Programme\Lupo_PenSuite\Lupo PenSuite v6.64 Full\Apps\Recuva Portable\unicows.dll (Malware.Packer.Gen) -> Keine Aktion durchgeführt.
E:\WINDOWS\ServicePackFiles\i386\ctfmon.exe (Trojan.FakeMS) -> Keine Aktion durchgeführt.
E:\WINDOWS\system32\ctfmon.exe (Trojan.FakeMS) -> Keine Aktion durchgeführt.

(Ende)
         
Nach dem Neustart des PC bekam ich noch folgende Meldung:

Zitat:
Das Programm kann nicht gestartet werden, da wgui11.dll auf dem Computer fehlt. Installieren...
Auf welches Programm kann sich diese Meldung beziehen bzw. ist diese relevant? Ich meine, es handelte sich um mshaktuell - was auch immer das ist.


Alt 24.07.2012, 23:52   #6
t'john
/// Helfer-Team
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



Sehr gut!

Benutzt du eine WISO-Software?

  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> Licensevalidator.exe und hermes_v01 auf dem PC

Alt 26.07.2012, 20:54   #7
Medix
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



Ja, WISO-Software ist installiert.
Hier das erste Logfile des AdwCleaner

Code:
ATTFilter
# AdwCleaner v1.703 - Logfile created 07/26/2012 at 21:46:23
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Daniel - DANIEL-PC
# Running from : C:\Users\Daniel\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\scnvlys5.default\extensions\staged
Folder Deleted : C:\ProgramData\boost_interprocess

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Canneverbe Limited\OpenCandy

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\scnvlys5.default\prefs.js

[OK] File is clean.

Profile name : default 
File : C:\Users\Internet\AppData\Roaming\Mozilla\Firefox\Profiles\rmy63lt6.default\prefs.js

[OK] File is clean.

-\\ Opera v12.0.1467.0

File : C:\Users\Daniel\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [1617 octets] - [26/07/2012 21:46:23]

########## EOF - C:\AdwCleaner[S1].txt - [1745 octets] ##########
         
Hier das Ergebnis von Anti-Malware

Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 26.07.2012 22:07:44

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	26.07.2012 22:08:22

E:\Programme\Lupo_PenSuite\Lupo PenSuite v6.64 Full\Apps\HTTP File Server\HFS.exe 	gefunden: Trojan.Win32.Server-Web.HFS.AMN!E1
E:\Programme\Lupo_PenSuite\Lupo PenSuite v6.64 Full\Apps\Free Download Manager\fdmwi.exe 	gefunden: Trojan.Code!E2

Gescannt	940163
Gefunden	2

Scan Ende:	27.07.2012 00:48:55
Scan Zeit:	2:40:33
         

Alt 31.07.2012, 16:10   #8
t'john
/// Helfer-Team
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 21.08.2012, 03:39   #9
t'john
/// Helfer-Team
 
Licensevalidator.exe und hermes_v01 auf dem PC - Standard

Licensevalidator.exe und hermes_v01 auf dem PC



Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu Licensevalidator.exe und hermes_v01 auf dem PC
appdata, aufrufe, auswirkungen, av-software, avg, datei, e-banking, erkannt, firefox, forum, fund, gen, google, hermes_v01, ide, licensevalidaotor.exe, meldung, neustart, nicht mehr, online-banking, passwort, quarantäne, roaming, seite, seiten, virus, webseite, webseiten, win, win7



Ähnliche Themen: Licensevalidator.exe und hermes_v01 auf dem PC


  1. LicenseValidator Virus
    Log-Analyse und Auswertung - 17.10.2012 (7)
  2. Hermes_v01 Trojaner laut bankinformation
    Log-Analyse und Auswertung - 26.09.2012 (2)
  3. System infiziert mit Hermes_V01: OTL-Dateien
    Plagegeister aller Art und deren Bekämpfung - 26.09.2012 (2)
  4. Hermes_V01 :: Auch auf meinem Rechner?
    Log-Analyse und Auswertung - 09.09.2012 (8)
  5. hermes_v01 - Onlinebanking
    Log-Analyse und Auswertung - 30.08.2012 (12)
  6. Hermes_V01 - Online-Banking
    Plagegeister aller Art und deren Bekämpfung - 23.08.2012 (20)
  7. Licensevalidator.exe ist bei mir auf dem PC
    Plagegeister aller Art und deren Bekämpfung - 20.08.2012 (15)
  8. web.de hat mich über hermes_v01 informiert
    Log-Analyse und Auswertung - 15.08.2012 (10)
  9. Hermes_V01
    Log-Analyse und Auswertung - 13.08.2012 (13)
  10. Hermes_V01 auf Rechner
    Plagegeister aller Art und deren Bekämpfung - 08.08.2012 (7)
  11. Hermes_v01 nach web.de
    Log-Analyse und Auswertung - 02.08.2012 (9)
  12. Licensevalidator.exe und graues Fenster in der Mitte des Bildschirms
    Log-Analyse und Auswertung - 30.07.2012 (1)
  13. web.de hat mich wegen hermes_v01 informiert
    Plagegeister aller Art und deren Bekämpfung - 27.07.2012 (7)
  14. hermes_v01 Trojaner ... TR/Gataka.D.57
    Plagegeister aller Art und deren Bekämpfung - 19.07.2012 (21)
  15. Trojaner Hermes_V01 auf meinem Rechner
    Plagegeister aller Art und deren Bekämpfung - 12.07.2012 (3)
  16. laut web.de Sicherheitsteam Hermes_V01 auf dem PC
    Log-Analyse und Auswertung - 09.07.2012 (5)
  17. Hermes_v01 und Öffnen vieler Internetseiten in https
    Log-Analyse und Auswertung - 09.07.2012 (9)

Zum Thema Licensevalidator.exe und hermes_v01 auf dem PC - Hallo Forum! Auch ich habe aktuell einen Fund von Schadsoftware auf meinem PC und scheine mit den Auswirkungen nicht alleine zu sein, soweit ich hier im Forum schon fündig geworden - Licensevalidator.exe und hermes_v01 auf dem PC...
Archiv
Du betrachtest: Licensevalidator.exe und hermes_v01 auf dem PC auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.