Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Variante des Bundespilzei Trojaner mit Webcam eingefangen

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Log-Analyse und Auswertung: Variante des Bundespilzei Trojaner mit Webcam eingefangen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 06.09.2012, 13:25   #1
Fragnax
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Hallo Trojaner-Broad-Team,


vorgestern Abend hab ich mir anscheinend auch eine Variante des Bundespolizei-Trojaners gefangen. Auf einer Seite öffnete sich auf einmal das typische Sperrfenster. Die kopfzeile war vom Bundesjustizministerium kopiert. Oben links waren meine IP und mein Netzwerk angegeben, rechts daneben lief in einem Fenster meine Webcam. In Panik habe ich leider direkt alle Verbindungen gekappt ohne einen Screenshot o.Ä. anzulegen

Nach einem Neustart habe ich direkt mit Malwarebytes einen kompletten Scan machen lassen mit folgenden Resultat:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.04.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Felix :: FELIX-PC [Administrator]

Schutz: Aktiviert

04.09.2012 21:06:24
mbam-log-2012-09-04 (21-06-24).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 474435
Laufzeit: 1 Stunde(n), 58 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Users\Felix\AppData\Local\Temp\wgsdgsdgdsgsd.exe (Trojan.FakeMS) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Felix\M-1-52-5782-8752-5245 (Trojan.Agent.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 6
C:\Users\Felix\AppData\Local\Temp\wgsdgsdgdsgsd.exe (Trojan.FakeMS) -> Löschen bei Neustart.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\3b8bc7cf-6d3c186a (Trojan.PWS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\4e8d9846-1bba7254 (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Felix\Downloads\SoftonicDownloader_fuer_directx.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Felix\Downloads\SoftonicDownloader_fuer_vidomi.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(End
e)

Die infizierten Datein habe leider dann direkt gelöscht und nicht wie hier beschrieben in Quarantäne verschoben.

Ein anschließender Scan mit Antivir ergab folgenden Fund:

Die Datei 'C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\5c5e13c8-5eb3555b'
enthielt einen Virus oder unerwünschtes Programm 'EXP/2008-5353.AO.2' [exploit].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56e9cf40.qua' verschoben!



Bei einem zweiter Durchlauf mit Malwarebytes wurde dann nichts mehr gefunden.

Derweil läuft bei mir eine Firewall von Comodo auf "paranoid" und gibt bei jeden Programm das aktiv wird bescheid.



Kann mir eventuell jemand mit ein paar weiteren Anweisungen helfen in wie weit ich meinen PC weiter durchsuchen und bereinigen kann. Oder komme ich um eine Formatierung nicht rum?

Vielen Dank schon einmal vorab.

Grüße
Fragnax

und hier noch der OTL Quick Scan:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 06.09.2012 17:47:45 - Run 1
OTL by OldTimer - Version 3.2.61.0     Folder = C:\Users\Felix\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,68 Gb Total Physical Memory | 2,49 Gb Available Physical Memory | 67,76% Memory free
7,36 Gb Paging File | 6,05 Gb Available in Paging File | 82,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 452,66 Gb Total Space | 47,65 Gb Free Space | 10,53% Space Free | Partition Type: NTFS
Drive D: | 6,20 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 3,92 Gb Total Space | 3,25 Gb Free Space | 83,08% Space Free | Partition Type: FAT32
 
Computer Name: FELIX-PC | User Name: Felix | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.06 17:19:37 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Felix\Downloads\OTL.exe
PRC - [2012.07.12 15:26:27 | 000,138,096 | ---- | M] (Facebook Inc.) -- C:\Users\Felix\AppData\Local\Facebook\Update\FacebookUpdate.exe
PRC - [2012.06.27 13:01:14 | 000,096,768 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
PRC - [2012.05.31 14:33:56 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
PRC - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
PRC - [2012.01.18 11:44:32 | 002,057,048 | ---- | M] (Tobit.Software) -- C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
PRC - [2012.01.11 13:49:51 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.08.03 22:43:45 | 000,645,048 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
PRC - [2011.07.05 06:18:35 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.04.28 18:11:49 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010.05.27 04:41:24 | 000,349,552 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
PRC - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
PRC - [2010.04.13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009.05.12 03:05:52 | 000,247,808 | ---- | M] (Winstep Software Technologies) -- C:\Program Files (x86)\Winstep\WsxService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.26 13:39:32 | 009,560,576 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Client\TOBITCLT.dll
MOD - [2012.01.26 12:13:36 | 000,215,552 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client$.ger
 
 
========== Services (SafeList) ==========
 
SRV - [2012.08.30 08:06:09 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.15 15:55:10 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.06.27 13:01:14 | 000,096,768 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
SRV - [2012.06.15 12:26:32 | 000,103,472 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2012.05.31 14:33:56 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc)
SRV - [2012.05.31 14:33:10 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc)
SRV - [2012.03.11 21:13:24 | 002,815,496 | ---- | M] (COMODO) [Auto | Running] -- C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe -- (Radio.fx)
SRV - [2012.01.11 13:49:51 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.11.23 12:27:10 | 001,267,000 | ---- | M] (COMODO) [Auto | Running] -- C:\Programme\COMODO\COMODO GeekBuddy\CLPSLS.exe -- (CLPSLS)
SRV - [2011.08.03 22:43:45 | 000,645,048 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2011.07.05 06:18:35 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.28 18:11:49 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.11.06 07:59:23 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.06.11 15:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [Auto | Running] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.04.13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 06:57:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.12 03:05:52 | 000,247,808 | ---- | M] (Winstep Software Technologies) [Auto | Running] -- C:\Program Files (x86)\Winstep\WsxService.exe -- (Winstep Xtreme Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.01.24 13:36:54 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.08.03 22:27:28 | 000,022,264 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)
DRV:64bit: - [2011.07.05 06:18:36 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.05 06:18:36 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.10.22 03:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2010.10.22 03:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.08.25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.07.09 05:51:50 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2010.06.21 11:45:56 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.06.17 11:18:28 | 000,246,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.05.15 14:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010.05.11 12:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010.04.20 04:35:14 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2010.04.13 18:44:22 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.02.27 01:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.12.10 13:25:10 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.09.17 07:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2012.05.31 14:33:50 | 000,075,144 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Aktuelle Nachrichten - Inland Ausland Wirtschaft Kultur Sport - ARD Tagesschau
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\URLSearchHook: {32b29df0-2237-4370-9a29-37cebb730e9b} - No CLSID value found
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "tagesthemen.de"
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.2
FF - prefs.js..extensions.enabledAddons: support@lastpass.com:2.0.0
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://start.facemoods.com/results.php?f=5&a=ddr&q="
FF - prefs.js..network.proxy.http: "84.53.240.61"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Felix\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.05.17 10:22:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.05.17 10:22:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012.08.23 13:30:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 08:06:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.30 17:11:37 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 08:06:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.30 17:11:37 | 000,000,000 | ---D | M]
 
[2011.02.01 17:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\bookmarkbackups\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\bookmarkbackups\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\chrome\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\chrome\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\minidumps\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\minidumps\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.07.25 08:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qyegxxs9.default\extensions
[2012.05.21 15:16:44 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qyegxxs9.default\extensions\ich@maltegoetz.de
[2012.07.25 08:15:16 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qyegxxs9.default\extensions\support@lastpass.com
[2012.07.24 23:45:29 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\firefox\profiles\qyegxxs9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.05.02 12:41:26 | 000,000,834 | ---- | M] () -- C:\Users\Felix\AppData\Roaming\mozilla\firefox\profiles\qyegxxs9.default\searchplugins\lonely-planet-online.xml
[2012.01.17 03:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.18 18:23:48 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] (Memory Fox) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\firefox@tvunetworks.com
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Personas) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Nero Toolbar) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\vshare@toolbar
[2012.08.30 08:06:09 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.12.07 00:03:18 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.22 08:03:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 08:06:08 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.22 08:03:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.12.13 14:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2012.06.22 08:03:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.22 08:03:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.22 08:03:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [COMODO] C:\Programme\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
O4 - HKLM..\Run: [CPA] C:\Programme\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001..\Run: [Facebook Update] C:\Users\Felix\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001..\Run: [RfxSrvTray] C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe (Tobit.Software)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4A693AF5-DD4B-4711-9628-95FD0D213972}: DhcpNameServer = 192.168.20.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F132E583-5FAF-44EE-9630-C6CDB4887DB5}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\guard32.dll) - C:\Windows\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.03.07 05:31:42 | 000,000,000 | R--D | M] - D:\Autorun -- [ UDF ]
O32 - AutoRun File - [2007.02.25 06:23:24 | 000,000,047 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O32 - AutoRun File - [2007.03.02 11:31:43 | 000,162,880 | R--- | M] () - D:\autorun.exe -- [ UDF ]
O32 - AutoRun File - [2010.09.09 13:08:10 | 000,000,054 | ---- | M] () - F:\autorun.bat -- [ FAT32 ]
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe -- [2007.03.02 11:31:43 | 000,162,880 | R--- | M] ()
O33 - MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\Shell\AutoRun\command - "" = E:\autorun.exe
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell\install\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\Shell\AutoRun\command - "" = E:\start.exe
O33 - MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\Shell\AutoRun\command - "" = E:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.04 21:36:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2012.09.04 21:36:23 | 000,000,000 | ---D | C] -- C:\Program Files\COMODO
[2012.09.04 21:36:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
[2012.09.04 21:36:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Comodo
[2012.09.04 21:01:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.04 21:01:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.06 17:55:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.06 17:52:56 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.06 17:52:56 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.06 17:45:30 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.06 17:45:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.06 17:45:08 | 2962,259,968 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.06 17:33:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.06 17:19:09 | 000,000,000 | ---- | M] () -- C:\Users\Felix\defogger_reenable
[2012.09.06 15:48:02 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.06 15:48:02 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.06 15:48:02 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.06 15:48:02 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.06 15:48:02 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.06 15:33:00 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001UA.job
[2012.09.06 15:33:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001Core.job
[2012.09.04 21:36:55 | 000,001,846 | ---- | M] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.09.04 21:36:29 | 000,001,049 | ---- | M] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.09.04 21:36:15 | 000,001,118 | ---- | M] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.09.04 21:01:59 | 004,503,728 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.04 21:01:23 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.03 01:27:53 | 000,066,937 | ---- | M] () -- C:\Users\Felix\Desktop\419339_10151052606705735_1883277236_n.jpg
[2012.08.27 08:43:30 | 004,812,735 | ---- | M] () -- C:\Users\Felix\Desktop\af0100009162l1.jpg
[2012.08.24 13:27:03 | 015,022,943 | ---- | M] () -- C:\Users\Felix\Desktop\af0100009162l2AA.psd
[2012.08.24 13:26:07 | 000,009,007 | ---- | M] () -- C:\Users\Felix\Desktop\WS 11.lnk
[2012.08.24 13:25:51 | 004,993,603 | ---- | M] () -- C:\Users\Felix\Desktop\af0100009162l2.jpg
[2012.08.15 17:43:45 | 002,443,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.06 17:19:09 | 000,000,000 | ---- | C] () -- C:\Users\Felix\defogger_reenable
[2012.09.04 21:36:55 | 000,001,846 | ---- | C] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.09.04 21:36:29 | 000,001,049 | ---- | C] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.09.04 21:36:15 | 000,001,118 | ---- | C] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.09.04 21:01:23 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.04 16:06:41 | 004,503,728 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.03 01:27:51 | 000,066,937 | ---- | C] () -- C:\Users\Felix\Desktop\419339_10151052606705735_1883277236_n.jpg
[2012.08.27 08:43:27 | 004,812,735 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l1.jpg
[2012.08.24 13:27:02 | 015,022,943 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l2AA.psd
[2012.08.24 13:25:26 | 004,993,603 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l2.jpg
[2012.08.24 13:08:53 | 004,030,766 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l.JPG
[2012.04.26 21:57:38 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2012.04.26 21:33:39 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2012.04.01 18:27:58 | 000,004,031 | ---- | C] () -- C:\Users\Felix\.TransferManager.db
[2012.01.11 13:43:47 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.01.11 13:43:43 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.12.27 20:01:02 | 000,283,659 | ---- | C] () -- C:\Users\Felix\schnee.jpg
[2011.11.29 01:13:30 | 000,003,584 | ---- | C] () -- C:\Users\Felix\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.18 20:32:02 | 183,510,862 | ---- | C] () -- C:\Users\Felix\The.Big.Bang.Theory.S05E03.HDTV.XviD.ASAP.avi
[2011.10.05 12:01:10 | 000,001,430 | ---- | C] () -- C:\Users\Felix\AppData\Local\RecConfig.xml
[2011.09.23 10:27:33 | 000,006,537 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.03.25 05:44:24 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011.03.17 17:27:21 | 612,282,368 | ---- | C] () -- C:\Users\Felix\gpceos1000d.bin
[2011.03.10 23:44:44 | 000,000,114 | ---- | C] () -- C:\Windows\wininit.ini
[2011.02.25 21:33:44 | 000,000,391 | ---- | C] () -- C:\Users\Felix\AppData\Roaming\burnaware.ini
[2011.02.20 22:59:44 | 000,000,318 | ---- | C] () -- C:\Windows\game.ini
[2011.02.06 13:10:11 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.02.06 13:10:11 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.02.04 22:46:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.01 17:34:46 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2011.02.01 17:08:56 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.08.30 11:12:22 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2012.04.27 09:50:32 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\AnvSoft
[2011.02.07 23:17:47 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\CC4 Internetfiles
[2012.02.28 12:23:08 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2012.05.07 22:54:20 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2011.10.05 12:36:59 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Cool Record Edit Pro
[2012.02.07 19:19:55 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DAEMON Tools Lite
[2011.10.17 16:20:53 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DL
[2011.02.18 20:42:32 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DVDVideoSoft
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.10.05 12:29:14 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Free Sound Recorder
[2011.10.09 17:37:00 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\GameRanger
[2011.11.20 22:08:49 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\GetRightToGo
[2012.07.31 19:10:50 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\HandBrake
[2011.04.29 10:07:44 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Lingo4u
[2012.07.26 16:26:05 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Liteon
[2012.04.27 10:05:05 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\MAGIX
[2012.07.07 16:36:33 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\OpenCandy
[2011.09.28 19:09:16 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\pdfforge
[2011.04.08 14:03:47 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Phase6
[2011.02.13 00:28:25 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Rainmeter
[2012.05.30 17:27:42 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TeamViewer
[2011.02.01 17:35:05 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Tobit
[2012.07.07 16:37:29 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TuneUp Software
[2012.09.06 15:33:00 | 000,001,116 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001Core.job
[2012.09.06 15:33:00 | 000,001,138 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001UA.job
[2012.07.27 13:44:49 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:E1F04E8D

< End of report >
--- --- ---

und hier noch der OTL Quick Scan:

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 06.09.2012 17:47:45 - Run 1
OTL by OldTimer - Version 3.2.61.0     Folder = C:\Users\Felix\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,68 Gb Total Physical Memory | 2,49 Gb Available Physical Memory | 67,76% Memory free
7,36 Gb Paging File | 6,05 Gb Available in Paging File | 82,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 452,66 Gb Total Space | 47,65 Gb Free Space | 10,53% Space Free | Partition Type: NTFS
Drive D: | 6,20 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 3,92 Gb Total Space | 3,25 Gb Free Space | 83,08% Space Free | Partition Type: FAT32
 
Computer Name: FELIX-PC | User Name: Felix | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.06 17:19:37 | 000,599,040 | ---- | M] (OldTimer Tools) -- C:\Users\Felix\Downloads\OTL.exe
PRC - [2012.07.12 15:26:27 | 000,138,096 | ---- | M] (Facebook Inc.) -- C:\Users\Felix\AppData\Local\Facebook\Update\FacebookUpdate.exe
PRC - [2012.06.27 13:01:14 | 000,096,768 | ---- | M] (Freemake) -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
PRC - [2012.05.31 14:33:56 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
PRC - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
PRC - [2012.01.18 11:44:32 | 002,057,048 | ---- | M] (Tobit.Software) -- C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
PRC - [2012.01.11 13:49:51 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.08.03 22:43:45 | 000,645,048 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
PRC - [2011.07.05 06:18:35 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.04.28 18:11:49 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010.05.27 04:41:24 | 000,349,552 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
PRC - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
PRC - [2010.04.13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009.05.12 03:05:52 | 000,247,808 | ---- | M] (Winstep Software Technologies) -- C:\Program Files (x86)\Winstep\WsxService.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.26 13:39:32 | 009,560,576 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Client\TOBITCLT.dll
MOD - [2012.01.26 12:13:36 | 000,215,552 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client$.ger
 
 
========== Services (SafeList) ==========
 
SRV - [2012.08.30 08:06:09 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.15 15:55:10 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.06.27 13:01:14 | 000,096,768 | ---- | M] (Freemake) [Auto | Running] -- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe -- (Freemake Improver)
SRV - [2012.06.15 12:26:32 | 000,103,472 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2012.05.31 14:33:56 | 000,385,416 | ---- | M] (BlueStack Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc)
SRV - [2012.05.31 14:33:10 | 000,397,704 | ---- | M] (BlueStack Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc)
SRV - [2012.03.11 21:13:24 | 002,815,496 | ---- | M] (COMODO) [Auto | Running] -- C:\Programme\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe -- (Radio.fx)
SRV - [2012.01.11 13:49:51 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.11.23 12:27:10 | 001,267,000 | ---- | M] (COMODO) [Auto | Running] -- C:\Programme\COMODO\COMODO GeekBuddy\CLPSLS.exe -- (CLPSLS)
SRV - [2011.08.03 22:43:45 | 000,645,048 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2011.07.05 06:18:35 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.04.28 18:11:49 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.11.06 07:59:23 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.08.10 11:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.06.11 15:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [Auto | Running] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.04.13 18:57:58 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 06:57:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.03.18 06:56:56 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.12 03:05:52 | 000,247,808 | ---- | M] (Winstep Software Technologies) [Auto | Running] -- C:\Program Files (x86)\Winstep\WsxService.exe -- (Winstep Xtreme Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.01.24 13:36:54 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.08.03 22:27:28 | 000,022,264 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpnva64.sys -- (vpnva)
DRV:64bit: - [2011.07.05 06:18:36 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.05 06:18:36 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.10.22 03:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2010.10.22 03:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010.08.25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.07.09 05:51:50 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2010.06.21 11:45:56 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2010.06.17 11:18:28 | 000,246,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010.05.15 14:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010.05.11 12:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010.04.20 04:35:14 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2010.04.13 18:44:22 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.02.27 01:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.12.10 13:25:10 | 000,301,104 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.09.17 07:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2012.05.31 14:33:50 | 000,075,144 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Aktuelle Nachrichten - Inland Ausland Wirtschaft Kultur Sport - ARD Tagesschau
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\URLSearchHook: {32b29df0-2237-4370-9a29-37cebb730e9b} - No CLSID value found
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "tagesthemen.de"
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.2
FF - prefs.js..extensions.enabledAddons: support@lastpass.com:2.0.0
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://start.facemoods.com/results.php?f=5&a=ddr&q="
FF - prefs.js..network.proxy.http: "84.53.240.61"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Felix\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.05.17 10:22:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.05.17 10:22:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2012.08.23 13:30:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 08:06:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.30 17:11:37 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.30 08:06:09 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.06.30 17:11:37 | 000,000,000 | ---D | M]
 
[2011.02.01 17:09:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\bookmarkbackups\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\bookmarkbackups\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\chrome\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\chrome\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\minidumps\extensions
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\minidumps\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.07.25 08:15:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qyegxxs9.default\extensions
[2012.05.21 15:16:44 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qyegxxs9.default\extensions\ich@maltegoetz.de
[2012.07.25 08:15:16 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\Felix\AppData\Roaming\mozilla\Firefox\Profiles\qyegxxs9.default\extensions\support@lastpass.com
[2012.07.24 23:45:29 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Felix\AppData\Roaming\mozilla\firefox\profiles\qyegxxs9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.05.02 12:41:26 | 000,000,834 | ---- | M] () -- C:\Users\Felix\AppData\Roaming\mozilla\firefox\profiles\qyegxxs9.default\searchplugins\lonely-planet-online.xml
[2012.01.17 03:59:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.18 18:23:48 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] (Memory Fox) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\firefox@tvunetworks.com
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Personas) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Nero Toolbar) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\vshare@toolbar
[2012.08.30 08:06:09 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.12.07 00:03:18 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.22 08:03:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 08:06:08 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.22 08:03:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.12.13 14:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2012.06.22 08:03:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.22 08:03:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.22 08:03:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [COMODO] C:\Programme\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
O4 - HKLM..\Run: [CPA] C:\Programme\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001..\Run: [Facebook Update] C:\Users\Felix\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001..\Run: [RfxSrvTray] C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe (Tobit.Software)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4A693AF5-DD4B-4711-9628-95FD0D213972}: DhcpNameServer = 192.168.20.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F132E583-5FAF-44EE-9630-C6CDB4887DB5}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\guard64.dll) - C:\Windows\SysNative\guard64.dll (COMODO)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\guard32.dll) - C:\Windows\SysWOW64\guard32.dll (COMODO)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.03.07 05:31:42 | 000,000,000 | R--D | M] - D:\Autorun -- [ UDF ]
O32 - AutoRun File - [2007.02.25 06:23:24 | 000,000,047 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O32 - AutoRun File - [2007.03.02 11:31:43 | 000,162,880 | R--- | M] () - D:\autorun.exe -- [ UDF ]
O32 - AutoRun File - [2010.09.09 13:08:10 | 000,000,054 | ---- | M] () - F:\autorun.bat -- [ FAT32 ]
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe -- [2007.03.02 11:31:43 | 000,162,880 | R--- | M] ()
O33 - MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\Shell\AutoRun\command - "" = E:\autorun.exe
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell\AutoRun\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell\install\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\Shell\AutoRun\command - "" = E:\start.exe
O33 - MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\Shell - "" = AutoRun
O33 - MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\Shell\AutoRun\command - "" = E:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.04 21:36:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2012.09.04 21:36:23 | 000,000,000 | ---D | C] -- C:\Program Files\COMODO
[2012.09.04 21:36:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
[2012.09.04 21:36:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Comodo
[2012.09.04 21:01:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.04 21:01:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.06 17:55:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.06 17:52:56 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.06 17:52:56 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.06 17:45:30 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.06 17:45:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.06 17:45:08 | 2962,259,968 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.06 17:33:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.06 17:19:09 | 000,000,000 | ---- | M] () -- C:\Users\Felix\defogger_reenable
[2012.09.06 15:48:02 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.06 15:48:02 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.06 15:48:02 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.06 15:48:02 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.06 15:48:02 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.06 15:33:00 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001UA.job
[2012.09.06 15:33:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001Core.job
[2012.09.04 21:36:55 | 000,001,846 | ---- | M] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.09.04 21:36:29 | 000,001,049 | ---- | M] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.09.04 21:36:15 | 000,001,118 | ---- | M] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.09.04 21:01:59 | 004,503,728 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.04 21:01:23 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.03 01:27:53 | 000,066,937 | ---- | M] () -- C:\Users\Felix\Desktop\419339_10151052606705735_1883277236_n.jpg
[2012.08.27 08:43:30 | 004,812,735 | ---- | M] () -- C:\Users\Felix\Desktop\af0100009162l1.jpg
[2012.08.24 13:27:03 | 015,022,943 | ---- | M] () -- C:\Users\Felix\Desktop\af0100009162l2AA.psd
[2012.08.24 13:26:07 | 000,009,007 | ---- | M] () -- C:\Users\Felix\Desktop\WS 11.lnk
[2012.08.24 13:25:51 | 004,993,603 | ---- | M] () -- C:\Users\Felix\Desktop\af0100009162l2.jpg
[2012.08.15 17:43:45 | 002,443,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.06 17:19:09 | 000,000,000 | ---- | C] () -- C:\Users\Felix\defogger_reenable
[2012.09.04 21:36:55 | 000,001,846 | ---- | C] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.09.04 21:36:29 | 000,001,049 | ---- | C] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.09.04 21:36:15 | 000,001,118 | ---- | C] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.09.04 21:01:23 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.04 16:06:41 | 004,503,728 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.09.03 01:27:51 | 000,066,937 | ---- | C] () -- C:\Users\Felix\Desktop\419339_10151052606705735_1883277236_n.jpg
[2012.08.27 08:43:27 | 004,812,735 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l1.jpg
[2012.08.24 13:27:02 | 015,022,943 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l2AA.psd
[2012.08.24 13:25:26 | 004,993,603 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l2.jpg
[2012.08.24 13:08:53 | 004,030,766 | ---- | C] () -- C:\Users\Felix\Desktop\af0100009162l.JPG
[2012.04.26 21:57:38 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2012.04.26 21:33:39 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2012.04.01 18:27:58 | 000,004,031 | ---- | C] () -- C:\Users\Felix\.TransferManager.db
[2012.01.11 13:43:47 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.01.11 13:43:43 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.12.27 20:01:02 | 000,283,659 | ---- | C] () -- C:\Users\Felix\schnee.jpg
[2011.11.29 01:13:30 | 000,003,584 | ---- | C] () -- C:\Users\Felix\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.18 20:32:02 | 183,510,862 | ---- | C] () -- C:\Users\Felix\The.Big.Bang.Theory.S05E03.HDTV.XviD.ASAP.avi
[2011.10.05 12:01:10 | 000,001,430 | ---- | C] () -- C:\Users\Felix\AppData\Local\RecConfig.xml
[2011.09.23 10:27:33 | 000,006,537 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.03.25 05:44:24 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011.03.17 17:27:21 | 612,282,368 | ---- | C] () -- C:\Users\Felix\gpceos1000d.bin
[2011.03.10 23:44:44 | 000,000,114 | ---- | C] () -- C:\Windows\wininit.ini
[2011.02.25 21:33:44 | 000,000,391 | ---- | C] () -- C:\Users\Felix\AppData\Roaming\burnaware.ini
[2011.02.20 22:59:44 | 000,000,318 | ---- | C] () -- C:\Windows\game.ini
[2011.02.06 13:10:11 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.02.06 13:10:11 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.02.04 22:46:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.01 17:34:46 | 000,554,496 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2011.02.01 17:08:56 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.08.30 11:12:22 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2012.04.27 09:50:32 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\AnvSoft
[2011.02.07 23:17:47 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\CC4 Internetfiles
[2012.02.28 12:23:08 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2012.05.07 22:54:20 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2011.10.05 12:36:59 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Cool Record Edit Pro
[2012.02.07 19:19:55 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DAEMON Tools Lite
[2011.10.17 16:20:53 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DL
[2011.02.18 20:42:32 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DVDVideoSoft
[2011.02.18 20:45:19 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.10.05 12:29:14 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Free Sound Recorder
[2011.10.09 17:37:00 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\GameRanger
[2011.11.20 22:08:49 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\GetRightToGo
[2012.07.31 19:10:50 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\HandBrake
[2011.04.29 10:07:44 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Lingo4u
[2012.07.26 16:26:05 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Liteon
[2012.04.27 10:05:05 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\MAGIX
[2012.07.07 16:36:33 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\OpenCandy
[2011.09.28 19:09:16 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\pdfforge
[2011.04.08 14:03:47 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Phase6
[2011.02.13 00:28:25 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Rainmeter
[2012.05.30 17:27:42 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TeamViewer
[2011.02.01 17:35:05 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\Tobit
[2012.07.07 16:37:29 | 000,000,000 | ---D | M] -- C:\Users\Felix\AppData\Roaming\TuneUp Software
[2012.09.06 15:33:00 | 000,001,116 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001Core.job
[2012.09.06 15:33:00 | 000,001,138 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3524628543-2900427197-3898624987-1001UA.job
[2012.07.27 13:44:49 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:E1F04E8D

< End of report >
--- --- ---

Alt 06.09.2012, 20:01   #2
t'john
/// Helfer-Team
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen




Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
ATTFilter
:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\URLSearchHook: {32b29df0-2237-4370-9a29-37cebb730e9b} - No CLSID value found 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..keyword.URL: "http://start.facemoods.com/results.php?f=5&a=ddr&q=" 
FF - prefs.js..network.proxy.http: "84.53.240.61" 
FF - prefs.js..network.proxy.http_port: 3128 
FF - prefs.js..network.proxy.type: 0 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found 
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found 
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found 
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1) 
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2007.02.25 06:23:24 | 000,000,047 | R--- | M] () - D:\Autorun.inf -- [ UDF ] 
O32 - AutoRun File - [2007.03.02 11:31:43 | 000,162,880 | R--- | M] () - D:\autorun.exe -- [ UDF ] 
O32 - AutoRun File - [2010.09.09 13:08:10 | 000,000,054 | ---- | M] () - F:\autorun.bat -- [ FAT32 ] 
O33 - MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe -- [2007.03.02 11:31:43 | 000,162,880 | R--- | M] () 
O33 - MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\Shell - "" = AutoRun 
O33 - MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\Shell\AutoRun\command - "" = F:\pushinst.exe 
O33 - MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\Shell - "" = AutoRun 
O33 - MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\Shell\AutoRun\command - "" = E:\autorun.exe 
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell - "" = AutoRun 
O33 - MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\Shell\AutoRun\command - "" = F:\SETUP.EXE 
O33 - MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\Shell - "" = AutoRun 
O33 - MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\Shell\AutoRun\command - "" = E:\start.exe 
O33 - MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\Shell - "" = AutoRun 
O33 - MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\Shell\AutoRun\command - "" = E:\autorun.exe 

[2012.09.04 21:01:59 | 004,503,728 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad 

@Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:5D7E5A8F 
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:E1F04E8D 
[2011.05.02 12:41:26 | 000,000,834 | ---- | M] () -- C:\Users\Felix\AppData\Roaming\mozilla\firefox\profiles\qyegxxs9.default\searchplugins\lonely-planet-online.xml 
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} 
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} 
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] (Memory Fox) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B} 
[2011.02.01 17:22:19 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\firefox@tvunetworks.com 
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Personas) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard 
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (Nero Toolbar) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com 
[2011.02.01 17:22:21 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\vshare@toolbar 
[2012.06.22 08:03:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012.06.22 08:03:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml 
[2012.06.22 08:03:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012.06.22 08:03:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012.06.22 08:03:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml 

[2011.02.04 22:46:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat 

:Files

C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Felix\AppData\Local\{*}
C:\Users\Felix\AppData\Local\Temp\*.exe
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

3. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.



4. Schritt
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.
__________________

__________________
Alt 08.09.2012, 13:12   #3
Fragnax
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Hallo t' john,

vielen Dank erstmal für die Umfangreiche Anweisung.

Leider bricht dir Fix im OTL leider immer bei folgender Zeile ab:

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "tagesthemen.de"
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.2
FF - prefs.js..extensions.enabledAddons: support@lastpass.com:2.0.0
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1

Das Program hängt sich an dieser Stelle auf und reagiert nicht mehr?

Wie soll ich hier am besten weiterverfahren?
Danke nochmal!
__________________
Alt 09.09.2012, 02:02   #4
t'john
/// Helfer-Team
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Fix angepasst, nochmal probieren.
__________________
Mfg, t'john
Das TB unterstützen

Alt 10.09.2012, 14:21   #5
Fragnax
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


also ich hab nun alle drei Programme erfolgreich durchlaufen lassen, mit folgenden Textdatein:

OTL:

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Unable to set value : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Unable to set value : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E!
Unable to set value : HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E!
Registry delete failed. HKEY_USERS\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} scheduled to be deleted on reboot.
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}\ .
File c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll not found.
Registry delete failed. HKEY_USERS\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{32b29df0-2237-4370-9a29-37cebb730e9b} scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32b29df0-2237-4370-9a29-37cebb730e9b}\ not found.
HKEY_USERS\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D7562AE-8EF6-416d-A838-AB665251703A}\ not found.
Unable to set value : HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E!
Unable to set value : HKU\S-1-5-21-3524628543-2900427197-3898624987-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E!
Prefs.js: "hxxp://start.facemoods.com/results.php?f=5&a=ddr&q=" removed from keyword.URL
Prefs.js: "84.53.240.61" removed from network.proxy.http
Prefs.js: 3128 removed from network.proxy.http_port
Prefs.js: 0 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry delete failed. HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin scheduled to be deleted on reboot.
Registry delete failed. HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser scheduled to be deleted on reboot.
64bit-Registry delete failed. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote s&enden\ scheduled to be deleted on reboot.
64bit-Registry delete failed. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xcel exportieren\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote s&enden\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xcel exportieren\ scheduled to be deleted on reboot.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ scheduled to be deleted on reboot.
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ .
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}\ scheduled to be deleted on reboot.
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}\ .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}\ not found.
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}\ .
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ scheduled to be deleted on reboot.
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ .
64bit-Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile scheduled to be deleted on reboot.
64bit-Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck scheduled to be deleted on reboot.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry delete failed. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck scheduled to be deleted on reboot.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Unable to set value : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E!
File move failed. D:\Autorun.inf scheduled to be moved on reboot.
File move failed. D:\autorun.exe scheduled to be moved on reboot.
File F:\autorun.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a7e344f-e966-11df-b130-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a7e344f-e966-11df-b130-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a7e344f-e966-11df-b130-806e6f6e6963}\ not found.
File move failed. D:\autorun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9104e3ed-063a-11e1-9cb6-1c7508279f32}\ not found.
File F:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a07008bf-fdba-11e0-90c1-1c7508279f32}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a07008bf-fdba-11e0-90c1-1c7508279f32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a07008bf-fdba-11e0-90c1-1c7508279f32}\ not found.
File E:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c6a8ca0a-308c-11e0-ba9b-1c7508279f32}\ not found.
File F:\SETUP.EXE not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0388795-3d15-11e0-b008-1c7508279f32}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d0388795-3d15-11e0-b008-1c7508279f32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d0388795-3d15-11e0-b008-1c7508279f32}\ not found.
File E:\start.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edda6b61-4672-11e1-88c3-1c7508279f32}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edda6b61-4672-11e1-88c3-1c7508279f32}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edda6b61-4672-11e1-88c3-1c7508279f32}\ not found.
File E:\autorun.exe not found.
C:\ProgramData\dsgsdgdsgdsgw.pad moved successfully.
ADS C:\ProgramData\Temp:5D7E5A8F deleted successfully.
ADS C:\ProgramData\Temp:E1F04E8D deleted successfully.
C:\Users\Felix\AppData\Roaming\mozilla\firefox\profiles\qyegxxs9.default\searchplugins\lonely-planet-online.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}\chrome folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\modules folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\META-INF folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\defaults\preferences folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\defaults folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\components folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}\chrome folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\skin folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\locale\en-US folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\locale folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\defaults\preferences folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\defaults folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\content folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}\components folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B} folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\firefox@tvunetworks.com\plugins folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\firefox@tvunetworks.com folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard\modules folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard\defaults\preferences folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard\defaults folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard\components folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\personas@christopher.beard folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\searchplugins folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\logs folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\defaults\preferences folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\defaults folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\datastore folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-21-Dec-2010-18-06-31-GMT folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-25-Dec-2010-10-09-37-GMT folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\chrome\temp folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\chrome\skin folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\chrome\content folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com\chrome folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\toolbar@ask.com folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\vshare@toolbar\META-INF folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\vshare@toolbar\chrome folder moved successfully.
C:\Program Files (x86)\mozilla firefox\defaults\profile\91zm0lia.default\extensions\vshare@toolbar folder moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.
C:\ProgramData\ezsidmv.dat moved successfully.
========== FILES ==========
C:\ProgramData\FullRemove.exe moved successfully.
C:\ProgramData\Temp\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8} folder moved successfully.
C:\ProgramData\Temp folder moved successfully.
C:\Users\Felix\AppData\Local\{18A99160-D2F3-4388-B6D2-DEFBFC992AF9} folder moved successfully.
C:\Users\Felix\AppData\Local\{1BD2DC0E-05B9-4266-8A92-74390559510E} folder moved successfully.
C:\Users\Felix\AppData\Local\{1E222011-19D6-47E0-B860-E9C268D10056} folder moved successfully.
C:\Users\Felix\AppData\Local\{28AD6D00-88E4-4333-89F5-E02C16DDAE9E} folder moved successfully.
C:\Users\Felix\AppData\Local\{34A8D4AE-321A-42E7-A630-7A14EEC530C2} folder moved successfully.
C:\Users\Felix\AppData\Local\{4388A294-A482-4750-816C-4571AE2A2E1C} folder moved successfully.
C:\Users\Felix\AppData\Local\{658D0512-B6F9-4E80-8229-EE1ED7C411A6} folder moved successfully.
C:\Users\Felix\AppData\Local\{7C63A97C-2A7C-4A32-9D9F-0A9CBBB3CF18} folder moved successfully.
C:\Users\Felix\AppData\Local\{9CE6F130-141F-436F-9BAC-46241AB49901} folder moved successfully.
C:\Users\Felix\AppData\Local\{A851E985-8B84-48B7-BE47-DCA35AA06061} folder moved successfully.
C:\Users\Felix\AppData\Local\{BF4F8A14-5FD7-4F2B-A265-E217DF086388} folder moved successfully.
C:\Users\Felix\AppData\Local\{C72CF34D-1F55-409B-8507-6B0580819FD1} folder moved successfully.
C:\Users\Felix\AppData\Local\{D8AD374B-85D6-4788-BDFB-2415C071B684} folder moved successfully.
C:\Users\Felix\AppData\Local\Temp\contentDATs.exe moved successfully.
C:\Users\Felix\AppData\Local\Temp\FreemakeVideoConverter_3.0.2.15.exe moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\62e3c149-1294c041-n folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27\6aa83f9b-6f369be8-n folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Felix\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
< ipconfig /flushdns /c >
No captured output from command...
C:\Users\Felix\Desktop\cmd.bat deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Felix
->Temp folder emptied: 150854563 bytes
->Temporary Internet Files folder emptied: 242058344 bytes
->FireFox cache emptied: 108801907 bytes
->Flash cache emptied: 12548244 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7042289 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50501 bytes
RecycleBin emptied: 26430246683 bytes

Total Files Cleaned = 25.703,00 mb


OTL by OldTimer - Version 3.2.61.0 log created on 09102012_122446







Malewarebytes:


Malwarebytes Anti-Malware (Test) 1.62.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2012.09.10.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Felix :: FELIX-PC [Administrator]

Schutz: Deaktiviert

10.09.2012 13:08:30
mbam-log-2012-09-10 (13-08-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 468618
Laufzeit: 1 Stunde(n), 50 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)




adwcleaner:



# AdwCleaner v2.000 - Datei am 09/10/2012 um 15:04:20 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Felix - FELIX-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Felix\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\ProgramData\boost_interprocess
Ordner Gefunden : C:\Users\Felix\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Felix\AppData\LocalLow\boost_interprocess
Ordner Gefunden : C:\Users\Felix\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Felix\AppData\LocalLow\facemoods.com
Ordner Gefunden : C:\Users\Felix\AppData\Roaming\Mozilla\Firefox\Profiles\qyegxxs9.default\ConduitCommon
Ordner Gefunden : C:\Users\Felix\AppData\Roaming\OpenCandy
Ordner Gefunden : C:\Users\Felix\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Conduit
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2704262
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DDE2C74F-58CC-4D71-8CE1-09DEBB8CFB78}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ihflimipbcaljfnojhhknppphnnciiif
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4

-\\ Mozilla Firefox v15.0 (de)

Profilname : default
Datei : C:\Users\Felix\AppData\Roaming\Mozilla\Firefox\Profiles\qyegxxs9.default\prefs.js

Gefunden : user_pref("CT2704262..clientLogIsEnabled", true);
Gefunden : user_pref("CT2704262..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gefunden : user_pref("CT2704262..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gefunden : user_pref("CT2704262.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gefunden : user_pref("CT2704262.BrowserCompStateIsOpen_129531294267650900", true);
Gefunden : user_pref("CT2704262.CT2704262", "CT2704262");
Gefunden : user_pref("CT2704262.CurrentServerDate", "5-10-2011");
Gefunden : user_pref("CT2704262.DSInstall", false);
Gefunden : user_pref("CT2704262.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT2704262.DialogsGetterLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gefunden : user_pref("CT2704262.DownloadReferralCookieData", "");
Gefunden : user_pref("CT2704262.FeedLastCount129531287796537552", 193);
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162554", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162555", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162556", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162557", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162558", "Wed Oct 05 2011 18:23:59 GMT+0200");
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162559", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162560", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.FeedPollDate129531287797162561", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.FeedTTL129531287797162554", 40);
Gefunden : user_pref("CT2704262.FeedTTL129531287797162555", 40);
Gefunden : user_pref("CT2704262.FeedTTL129531287797162556", 40);
Gefunden : user_pref("CT2704262.FeedTTL129531287797162557", 40);
Gefunden : user_pref("CT2704262.FeedTTL129531287797162558", 40);
Gefunden : user_pref("CT2704262.FeedTTL129531287797162559", 40);
Gefunden : user_pref("CT2704262.FeedTTL129531287797162560", 40);
Gefunden : user_pref("CT2704262.FeedTTL129531287797162561", 40);
Gefunden : user_pref("CT2704262.FirstServerDate", "5-10-2011");
Gefunden : user_pref("CT2704262.FirstTime", true);
Gefunden : user_pref("CT2704262.FirstTimeFF3", true);
Gefunden : user_pref("CT2704262.FixPageNotFoundErrors", true);
Gefunden : user_pref("CT2704262.GroupingServerCheckInterval", 1440);
Gefunden : user_pref("CT2704262.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gefunden : user_pref("CT2704262.HPInstall", false);
Gefunden : user_pref("CT2704262.HasUserGlobalKeys", true);
Gefunden : user_pref("CT2704262.HomePageProtectorEnabled", false);
Gefunden : user_pref("CT2704262.HomepageBeforeUnload", "tagesthemen.de");
Gefunden : user_pref("CT2704262.Initialize", true);
Gefunden : user_pref("CT2704262.InitializeCommonPrefs", true);
Gefunden : user_pref("CT2704262.InstallationAndCookieDataSentCount", 1);
Gefunden : user_pref("CT2704262.InstallationId", "ConduitStubGeneric");
Gefunden : user_pref("CT2704262.InstallationType", "ConduitIntegration");
Gefunden : user_pref("CT2704262.InstalledDate", "Wed Oct 05 2011 16:23:38 GMT+0200");
Gefunden : user_pref("CT2704262.InvalidateCache", false);
Gefunden : user_pref("CT2704262.IsGrouping", false);
Gefunden : user_pref("CT2704262.IsInitSetupIni", true);
Gefunden : user_pref("CT2704262.IsMulticommunity", false);
Gefunden : user_pref("CT2704262.IsOpenThankYouPage", true);
Gefunden : user_pref("CT2704262.IsOpenUninstallPage", true);
Gefunden : user_pref("CT2704262.IsProtectorsInit", true);
Gefunden : user_pref("CT2704262.LanguagePackLastCheckTime", "Wed Oct 05 2011 16:23:38 GMT+0200");
Gefunden : user_pref("CT2704262.LanguagePackReloadIntervalMM", 1440);
Gefunden : user_pref("CT2704262.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gefunden : user_pref("CT2704262.LastLogin_3.7.0.6", "Wed Oct 05 2011 16:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.LatestVersion", "3.7.0.6");
Gefunden : user_pref("CT2704262.Locale", "en");
Gefunden : user_pref("CT2704262.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT2704262.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT2704262.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT2704262.MyStuffEnabledAtInstallation", true);
Gefunden : user_pref("CT2704262.OriginalFirstVersion", "3.7.0.6");
Gefunden : user_pref("CT2704262.RadioIsPodcast", false);
Gefunden : user_pref("CT2704262.RadioLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gefunden : user_pref("CT2704262.RadioLastUpdateIPServer", "3");
Gefunden : user_pref("CT2704262.RadioLastUpdateServer", "129242955136270000");
Gefunden : user_pref("CT2704262.RadioMediaID", "21037024");
Gefunden : user_pref("CT2704262.RadioMediaType", "Media Player");
Gefunden : user_pref("CT2704262.RadioMenuSelectedID", "EBRadioMenu_CT270426221037024");
Gefunden : user_pref("CT2704262.RadioShrinkedFromSetup", false);
Gefunden : user_pref("CT2704262.RadioStationName", "California%20Rock");
Gefunden : user_pref("CT2704262.RadioStationURL", "hxxp://feedlive.net/california.asx");
Gefunden : user_pref("CT2704262.SearchCaption", "FreeSoundRecorder Customized Web Search");
Gefunden : user_pref("CT2704262.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Gefunden : user_pref("CT2704262.SearchFromAddressBarIsInit", true);
Gefunden : user_pref("CT2704262.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT270[...]
Gefunden : user_pref("CT2704262.SearchInNewTabEnabled", true);
Gefunden : user_pref("CT2704262.SearchInNewTabIntervalMM", 1440);
Gefunden : user_pref("CT2704262.SearchInNewTabLastCheckTime", "Wed Oct 05 2011 16:23:58 GMT+0200");
Gefunden : user_pref("CT2704262.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gefunden : user_pref("CT2704262.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Gefunden : user_pref("CT2704262.SearchProtectorEnabled", false);
Gefunden : user_pref("CT2704262.SearchProtectorToolbarDisabled", true);
Gefunden : user_pref("CT2704262.SendProtectorDataViaLogin", true);
Gefunden : user_pref("CT2704262.ServiceMapLastCheckTime", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gefunden : user_pref("CT2704262.SettingsLastCheckTime", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gefunden : user_pref("CT2704262.SettingsLastUpdate", "1317630178");
Gefunden : user_pref("CT2704262.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2704262&SearchSource=13");
Gefunden : user_pref("CT2704262.ThirdPartyComponentsInterval", 504);
Gefunden : user_pref("CT2704262.ThirdPartyComponentsLastCheck", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gefunden : user_pref("CT2704262.ThirdPartyComponentsLastUpdate", "1312887586");
Gefunden : user_pref("CT2704262.ToolbarDisabled", true);
Gefunden : user_pref("CT2704262.ToolbarShrinkedFromSetup", false);
Gefunden : user_pref("CT2704262.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2704262");
Gefunden : user_pref("CT2704262.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Gefunden : user_pref("CT2704262.UserID", "UN83757342511266797");
Gefunden : user_pref("CT2704262.alertChannelId", "1096603");
Gefunden : user_pref("CT2704262.backendstorage.2704262a129531303481232105000000paramsgk0", "7B22757064617465526[...]
Gefunden : user_pref("CT2704262.backendstorage.appbuttondisablenull", "30");
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat0", "253542253742253232[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat1", "253542253742253232[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat2", "253542253742253232[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat3", "253542253742253232[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000embeddedversion", "312E312[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000feedsobj", "25374225323263[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000lastreporttime", "31333137[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000newfeeds", "6E657746656564[...]
Gefunden : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000readitemsarr", "2537422532[...]
Gefunden : user_pref("CT2704262.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Gefunden : user_pref("CT2704262.globalFirstTimeInfoLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gefunden : user_pref("CT2704262.homepageProtectorEnableByLogin", true);
Gefunden : user_pref("CT2704262.initDone", true);
Gefunden : user_pref("CT2704262.isAppTrackingManagerOn", true);
Gefunden : user_pref("CT2704262.isFirstRadioInstallation", false);
Gefunden : user_pref("CT2704262.myStuffEnabled", true);
Gefunden : user_pref("CT2704262.myStuffPublihserMinWidth", 400);
Gefunden : user_pref("CT2704262.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gefunden : user_pref("CT2704262.myStuffServiceIntervalMM", 1440);
Gefunden : user_pref("CT2704262.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gefunden : user_pref("CT2704262.revertSettingsEnabled", true);
Gefunden : user_pref("CT2704262.searchProtectorDialogDelayInSec", 10);
Gefunden : user_pref("CT2704262.searchProtectorEnableByLogin", true);
Gefunden : user_pref("CT2704262.testingCtid", "");
Gefunden : user_pref("CT2704262.toolbarAppMetaDataLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gefunden : user_pref("CT2704262.toolbarContextMenuLastCheckTime", "Wed Oct 05 2011 16:23:38 GMT+0200");
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1096603/1092307/DE", "\"0\"[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2704262", [...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2704262",[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2704262&octid=[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/1344951.xml", "\"7765c0d270c8c68235f9[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/14293310.xml", "\"1655423bb4223f26f93[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/16887175.xml", "\"3f5e4147843b9d541c0[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/17151925.xml", "\"9f33b597acedf78ecd5[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/20536157.xml", "\"f8aaff232415c5742a8[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/30261067.xml", "\"47a67b7be1bc82d847a[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/428333.xml", "\"75fdca4de3078fe378330[...]
Gefunden : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/816653.xml", "\"f72766c75ec586fa29493[...]
Gefunden : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Felix\\AppData\\Roaming\\Mozilla\\F[...]
Gefunden : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.7.0.6");
Gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://start.facemoods.com/results.php?f[...]
Gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2704262");
Gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2704262");
Gefunden : user_pref("CommunityToolbar.ToolbarsList4", "CT2704262");
Gefunden : user_pref("CommunityToolbar.globalUserId", "3cd2f4e7-d154-49cc-a59d-7fd262b7c496");
Gefunden : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gefunden : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gefunden : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Oct 05 2011 16:23:3[...]
Gefunden : user_pref("CommunityToolbar.notifications.alertEnabled", true);
Gefunden : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Gefunden : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Oct 05 2011 17:23:46 GMT+020[...]
Gefunden : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gefunden : user_pref("CommunityToolbar.notifications.locale", "en");
Gefunden : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Gefunden : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gefunden : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Gefunden : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Gefunden : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gefunden : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Gefunden : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Gefunden : user_pref("CommunityToolbar.notifications.userId", "a77fdce4-2f58-416e-89b4-447dcc62d9c3");
Gefunden : user_pref("CommunityToolbar.originalHomepage", "tagesthemen.de");
Gefunden : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_1344951.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200"[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_14293310.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_16887175.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_17151925.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_30261067.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_428333.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200")[...]
Gefunden : user_pref("CommunityToolbar.twitter.user_816653.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200")[...]

*************************

AdwCleaner[R1].txt - [18375 octets] - [10/09/2012 15:04:20]

########## EOF - C:\AdwCleaner[R1].txt - [18436 octets] ##########





und nach dem Neustart:



# AdwCleaner v2.000 - Datei am 09/10/2012 um 15:07:26 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Felix - FELIX-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Felix\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\Felix\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Felix\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Felix\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Felix\AppData\LocalLow\facemoods.com
Ordner Gelöscht : C:\Users\Felix\AppData\Roaming\Mozilla\Firefox\Profiles\qyegxxs9.default\ConduitCommon
Ordner Gelöscht : C:\Users\Felix\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Felix\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\facemoods.facemoodsHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2704262
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{64182481-4F71-486B-A045-B233BD0DA8FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DDE2C74F-58CC-4D71-8CE1-09DEBB8CFB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ihflimipbcaljfnojhhknppphnnciiif
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4 --> hxxp://www.google.com

-\\ Mozilla Firefox v15.0 (de)

Profilname : default
Datei : C:\Users\Felix\AppData\Roaming\Mozilla\Firefox\Profiles\qyegxxs9.default\prefs.js

Gelöscht : user_pref("CT2704262..clientLogIsEnabled", true);
Gelöscht : user_pref("CT2704262..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gelöscht : user_pref("CT2704262..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gelöscht : user_pref("CT2704262.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT2704262.BrowserCompStateIsOpen_129531294267650900", true);
Gelöscht : user_pref("CT2704262.CT2704262", "CT2704262");
Gelöscht : user_pref("CT2704262.CurrentServerDate", "5-10-2011");
Gelöscht : user_pref("CT2704262.DSInstall", false);
Gelöscht : user_pref("CT2704262.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2704262.DialogsGetterLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gelöscht : user_pref("CT2704262.DownloadReferralCookieData", "");
Gelöscht : user_pref("CT2704262.FeedLastCount129531287796537552", 193);
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162554", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162555", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162556", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162557", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162558", "Wed Oct 05 2011 18:23:59 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162559", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162560", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedPollDate129531287797162561", "Wed Oct 05 2011 18:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162554", 40);
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162555", 40);
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162556", 40);
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162557", 40);
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162558", 40);
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162559", 40);
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162560", 40);
Gelöscht : user_pref("CT2704262.FeedTTL129531287797162561", 40);
Gelöscht : user_pref("CT2704262.FirstServerDate", "5-10-2011");
Gelöscht : user_pref("CT2704262.FirstTime", true);
Gelöscht : user_pref("CT2704262.FirstTimeFF3", true);
Gelöscht : user_pref("CT2704262.FixPageNotFoundErrors", true);
Gelöscht : user_pref("CT2704262.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT2704262.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT2704262.HPInstall", false);
Gelöscht : user_pref("CT2704262.HasUserGlobalKeys", true);
Gelöscht : user_pref("CT2704262.HomePageProtectorEnabled", false);
Gelöscht : user_pref("CT2704262.HomepageBeforeUnload", "tagesthemen.de");
Gelöscht : user_pref("CT2704262.Initialize", true);
Gelöscht : user_pref("CT2704262.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT2704262.InstallationAndCookieDataSentCount", 1);
Gelöscht : user_pref("CT2704262.InstallationId", "ConduitStubGeneric");
Gelöscht : user_pref("CT2704262.InstallationType", "ConduitIntegration");
Gelöscht : user_pref("CT2704262.InstalledDate", "Wed Oct 05 2011 16:23:38 GMT+0200");
Gelöscht : user_pref("CT2704262.InvalidateCache", false);
Gelöscht : user_pref("CT2704262.IsGrouping", false);
Gelöscht : user_pref("CT2704262.IsInitSetupIni", true);
Gelöscht : user_pref("CT2704262.IsMulticommunity", false);
Gelöscht : user_pref("CT2704262.IsOpenThankYouPage", true);
Gelöscht : user_pref("CT2704262.IsOpenUninstallPage", true);
Gelöscht : user_pref("CT2704262.IsProtectorsInit", true);
Gelöscht : user_pref("CT2704262.LanguagePackLastCheckTime", "Wed Oct 05 2011 16:23:38 GMT+0200");
Gelöscht : user_pref("CT2704262.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT2704262.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT2704262.LastLogin_3.7.0.6", "Wed Oct 05 2011 16:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.LatestVersion", "3.7.0.6");
Gelöscht : user_pref("CT2704262.Locale", "en");
Gelöscht : user_pref("CT2704262.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2704262.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2704262.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2704262.MyStuffEnabledAtInstallation", true);
Gelöscht : user_pref("CT2704262.OriginalFirstVersion", "3.7.0.6");
Gelöscht : user_pref("CT2704262.RadioIsPodcast", false);
Gelöscht : user_pref("CT2704262.RadioLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gelöscht : user_pref("CT2704262.RadioLastUpdateIPServer", "3");
Gelöscht : user_pref("CT2704262.RadioLastUpdateServer", "129242955136270000");
Gelöscht : user_pref("CT2704262.RadioMediaID", "21037024");
Gelöscht : user_pref("CT2704262.RadioMediaType", "Media Player");
Gelöscht : user_pref("CT2704262.RadioMenuSelectedID", "EBRadioMenu_CT270426221037024");
Gelöscht : user_pref("CT2704262.RadioShrinkedFromSetup", false);
Gelöscht : user_pref("CT2704262.RadioStationName", "California%20Rock");
Gelöscht : user_pref("CT2704262.RadioStationURL", "hxxp://feedlive.net/california.asx");
Gelöscht : user_pref("CT2704262.SearchCaption", "FreeSoundRecorder Customized Web Search");
Gelöscht : user_pref("CT2704262.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
Gelöscht : user_pref("CT2704262.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT2704262.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT270[...]
Gelöscht : user_pref("CT2704262.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT2704262.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT2704262.SearchInNewTabLastCheckTime", "Wed Oct 05 2011 16:23:58 GMT+0200");
Gelöscht : user_pref("CT2704262.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gelöscht : user_pref("CT2704262.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Gelöscht : user_pref("CT2704262.SearchProtectorEnabled", false);
Gelöscht : user_pref("CT2704262.SearchProtectorToolbarDisabled", true);
Gelöscht : user_pref("CT2704262.SendProtectorDataViaLogin", true);
Gelöscht : user_pref("CT2704262.ServiceMapLastCheckTime", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gelöscht : user_pref("CT2704262.SettingsLastCheckTime", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gelöscht : user_pref("CT2704262.SettingsLastUpdate", "1317630178");
Gelöscht : user_pref("CT2704262.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2704262&SearchSource=13");
Gelöscht : user_pref("CT2704262.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT2704262.ThirdPartyComponentsLastCheck", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gelöscht : user_pref("CT2704262.ThirdPartyComponentsLastUpdate", "1312887586");
Gelöscht : user_pref("CT2704262.ToolbarDisabled", true);
Gelöscht : user_pref("CT2704262.ToolbarShrinkedFromSetup", false);
Gelöscht : user_pref("CT2704262.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2704262");
Gelöscht : user_pref("CT2704262.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Gelöscht : user_pref("CT2704262.UserID", "UN83757342511266797");
Gelöscht : user_pref("CT2704262.alertChannelId", "1096603");
Gelöscht : user_pref("CT2704262.backendstorage.2704262a129531303481232105000000paramsgk0", "7B22757064617465526[...]
Gelöscht : user_pref("CT2704262.backendstorage.appbuttondisablenull", "30");
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat0", "253542253742253232[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat1", "253542253742253232[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat2", "253542253742253232[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000cat3", "253542253742253232[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000embeddedversion", "312E312[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000feedsobj", "25374225323263[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000lastreporttime", "31333137[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000newfeeds", "6E657746656564[...]
Gelöscht : user_pref("CT2704262.backendstorage.rssapp2704262a129531303481232105000000readitemsarr", "2537422532[...]
Gelöscht : user_pref("CT2704262.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Gelöscht : user_pref("CT2704262.globalFirstTimeInfoLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gelöscht : user_pref("CT2704262.homepageProtectorEnableByLogin", true);
Gelöscht : user_pref("CT2704262.initDone", true);
Gelöscht : user_pref("CT2704262.isAppTrackingManagerOn", true);
Gelöscht : user_pref("CT2704262.isFirstRadioInstallation", false);
Gelöscht : user_pref("CT2704262.myStuffEnabled", true);
Gelöscht : user_pref("CT2704262.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT2704262.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gelöscht : user_pref("CT2704262.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT2704262.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT2704262.revertSettingsEnabled", true);
Gelöscht : user_pref("CT2704262.searchProtectorDialogDelayInSec", 10);
Gelöscht : user_pref("CT2704262.searchProtectorEnableByLogin", true);
Gelöscht : user_pref("CT2704262.testingCtid", "");
Gelöscht : user_pref("CT2704262.toolbarAppMetaDataLastCheckTime", "Wed Oct 05 2011 16:23:37 GMT+0200");
Gelöscht : user_pref("CT2704262.toolbarContextMenuLastCheckTime", "Wed Oct 05 2011 16:23:38 GMT+0200");
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1096603/1092307/DE", "\"0\"[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2704262", [...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2704262",[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2704262&octid=[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/1344951.xml", "\"7765c0d270c8c68235f9[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/14293310.xml", "\"1655423bb4223f26f93[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/16887175.xml", "\"3f5e4147843b9d541c0[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/17151925.xml", "\"9f33b597acedf78ecd5[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/20536157.xml", "\"f8aaff232415c5742a8[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/30261067.xml", "\"47a67b7be1bc82d847a[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/428333.xml", "\"75fdca4de3078fe378330[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/816653.xml", "\"f72766c75ec586fa29493[...]
Gelöscht : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Felix\\AppData\\Roaming\\Mozilla\\F[...]
Gelöscht : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.7.0.6");
Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://start.facemoods.com/results.php?f[...]
Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2704262");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2704262");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList4", "CT2704262");
Gelöscht : user_pref("CommunityToolbar.globalUserId", "3cd2f4e7-d154-49cc-a59d-7fd262b7c496");
Gelöscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Oct 05 2011 16:23:3[...]
Gelöscht : user_pref("CommunityToolbar.notifications.alertEnabled", true);
Gelöscht : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Gelöscht : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Oct 05 2011 17:23:46 GMT+020[...]
Gelöscht : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.locale", "en");
Gelöscht : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Oct 05 2011 16:23:36 GMT+0200");
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Gelöscht : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Gelöscht : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Gelöscht : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Gelöscht : user_pref("CommunityToolbar.notifications.userId", "a77fdce4-2f58-416e-89b4-447dcc62d9c3");
Gelöscht : user_pref("CommunityToolbar.originalHomepage", "tagesthemen.de");
Gelöscht : user_pref("CommunityToolbar.originalSearchEngine", "chrome://browser-region/locale/region.properties[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_1344951.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200"[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_14293310.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_16887175.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_17151925.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_20536157.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_30261067.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_428333.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200")[...]
Gelöscht : user_pref("CommunityToolbar.twitter.user_816653.LastCheckTime", "Wed Oct 05 2011 16:23:40 GMT+0200")[...]

*************************

AdwCleaner[R1].txt - [18502 octets] - [10/09/2012 15:04:20]
AdwCleaner[S1].txt - [19177 octets] - [10/09/2012 15:07:26]

########## EOF - C:\AdwCleaner[S1].txt - [19238 octets] ##########



So das wars erstmal von mir? Oder gibt es noch weitere Schritte einzuleiten?


Alt 11.09.2012, 00:11   #6
t'john
/// Helfer-Team
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Sehr gut!

Wie laeuft der Rechner?

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> Variante des Bundespilzei Trojaner mit Webcam eingefangen

Alt 24.09.2012, 15:23   #7
Fragnax
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Emsisoft Anti-Malware - Version 7.0
Letztes Update: 24.09.2012 01:12:41

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn: 24.09.2012 08:27:44

Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 1 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 10 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 2 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 4 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 5 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 6 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 7 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 9 gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> AdsLastKnownState gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> AppPath gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> id gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> InitialPort gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> InstallState gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> SL gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> TableType gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> useCount gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming -> AutoLoginToOtherGames gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming -> CFDialogShown gefunden: Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming -> FreshInstall gefunden: Trace.Registry.PartyPoker (A)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\1f2e9635.qua -> (Quarantine-8) -> rt0a/rt0b.class gefunden: Exploit.Java.Blacole.O (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\039dd25b.qua -> (Quarantine-8) gefunden: Trojan.Generic.6901727 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\1f2e9635.qua -> (Quarantine-8) -> rt0a/rt0c.class gefunden: Exploit.Java.Blacole.O (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\1f2e9635.qua -> (Quarantine-8) -> rt0a/rt0a.class gefunden: Exploit.Java.Blacole.O (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\13b7ad4b.qua -> (Quarantine-8) gefunden: Trojan.Generic.6717679 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\1f2e9635.qua -> (Quarantine-8) -> rt0a/rt0d.class gefunden: Exploit.Java.Blacole.O (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\3c52f4cc.qua -> (Quarantine-8) -> soika/soikd.class gefunden: Exploit.Java.Blacole.N (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\3c52f4cc.qua -> (Quarantine-8) -> soika/soika.class gefunden: Exploit.Java.Blacole.N (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\3c52f4cc.qua -> (Quarantine-8) -> soika/soikc.class gefunden: Exploit.Java.Blacole.N (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\3c52f4cc.qua -> (Quarantine-8) -> soika/soikb.class gefunden: Exploit.Java.Blacole.N (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\2002b089.qua -> (Quarantine-8) -> (gzip) gefunden: Trojan.Script.476053 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\48b70d9b.qua -> (Quarantine-8) gefunden: Gen:Variant.Kazy.39966 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\48df03a3.qua -> (Quarantine-8) gefunden: Gen:Variant.Kazy.39966 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4955a4d9.qua -> (Quarantine-8) -> report/Generator.class gefunden: Java.Exploit.CVE-2010-0840.H (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b1f7e1d.qua -> (Quarantine-8) gefunden: Trojan.JS.IFrame.ANM (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b27a6cd.qua -> (Quarantine-8) gefunden: Worm.Generic.254222 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b934026.qua -> (Quarantine-8) gefunden: Trojan.Generic.6717679 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\51da88b2.qua -> (Quarantine-8) gefunden: Trojan.Generic.6717679 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5629da2b.qua -> (Quarantine-8) gefunden: Gen:Variant.Symmi.592 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\65b29d98.qua -> (Quarantine-8) gefunden: Trojan.Generic.6901727 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\56e9cf40.qua -> (Quarantine-8) -> bkwa/bkwc.class gefunden: Exploit.Java.CVE-2012-1723.M (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\6fafed01.qua -> (Quarantine-8) gefunden: Trojan.Generic.6901727 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\56e9cf40.qua -> (Quarantine-8) -> bkwa/bkwf.class gefunden: Exploit.Java.CVE-2012-1723.M (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\56e9cf40.qua -> (Quarantine-8) -> bkwa/bkwb.class gefunden: Exploit.Java.CVE-2012-1723.M (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\56e9cf40.qua -> (Quarantine-8) -> bkwa/bkwa.class gefunden: Exploit.Java.CVE-2012-1723.M (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\56e9cf40.qua -> (Quarantine-8) -> bkwa/bkwe.class gefunden: Exploit.Java.CVE-2012-1723.M (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\56e9cf40.qua -> (Quarantine-8) -> bkwa/bkwd.class gefunden: Exploit.Java.CVE-2012-1723.M (B)

Gescannt 649455
Gefunden 46

Scan Ende: 24.09.2012 16:10:14
Scan Zeit: 7:42:30

C:\ProgramData\Avira\AntiVir Desktop\INFECTED\56e9cf40.qua -> (Quarantine-8) -> bkwa/bkwc.class Quarantäne Exploit.Java.CVE-2012-1723.M (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\5629da2b.qua -> (Quarantine-8) Quarantäne Gen:Variant.Symmi.592 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b27a6cd.qua -> (Quarantine-8) Quarantäne Worm.Generic.254222 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b1f7e1d.qua -> (Quarantine-8) Quarantäne Trojan.JS.IFrame.ANM (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4955a4d9.qua -> (Quarantine-8) -> report/Generator.class Quarantäne Java.Exploit.CVE-2010-0840.H (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\48b70d9b.qua -> (Quarantine-8) Quarantäne Gen:Variant.Kazy.39966 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\48df03a3.qua -> (Quarantine-8) Quarantäne Gen:Variant.Kazy.39966 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\2002b089.qua -> (Quarantine-8) -> (gzip) Quarantäne Trojan.Script.476053 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\3c52f4cc.qua -> (Quarantine-8) -> soika/soikd.class Quarantäne Exploit.Java.Blacole.N (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\13b7ad4b.qua -> (Quarantine-8) Quarantäne Trojan.Generic.6717679 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\4b934026.qua -> (Quarantine-8) Quarantäne Trojan.Generic.6717679 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\51da88b2.qua -> (Quarantine-8) Quarantäne Trojan.Generic.6717679 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\039dd25b.qua -> (Quarantine-8) Quarantäne Trojan.Generic.6901727 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\65b29d98.qua -> (Quarantine-8) Quarantäne Trojan.Generic.6901727 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\6fafed01.qua -> (Quarantine-8) Quarantäne Trojan.Generic.6901727 (B)
C:\ProgramData\Avira\AntiVir Desktop\INFECTED\1f2e9635.qua -> (Quarantine-8) -> rt0a/rt0b.class Quarantäne Exploit.Java.Blacole.O (B)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 1 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 10 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 2 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 4 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 5 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 6 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 7 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> 9 Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> AdsLastKnownState Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> AppPath Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> id Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> InitialPort Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> InstallState Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> SL Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> TableType Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming\partypoker -> useCount Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming -> AutoLoginToOtherGames Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming -> CFDialogShown Quarantäne Trace.Registry.PartyPoker (A)
Value: hkey_users\s-1-5-21-3524628543-2900427197-3898624987-1001\software\partygaming -> FreshInstall Quarantäne Trace.Registry.PartyPoker (A)

Quarantäne 35

Alt 25.09.2012, 10:24   #8
t'john
/// Helfer-Team
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 21.11.2012, 05:14   #9
t'john
/// Helfer-Team
 
Variante des Bundespilzei Trojaner mit Webcam eingefangen - Standard

Variante des Bundespilzei Trojaner mit Webcam eingefangen


Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu Variante des Bundespilzei Trojaner mit Webcam eingefangen
adblock, administrator, antivir, autostart, black, bluestacks, comodo, document, exp/2008-5353.ao.2, explorer, firewall, gelöscht, google earth, java, launch, limited.com/facebook, locker, löschen, malwarebytes, microsoft, msn deutschland, mywinlocker, netzwerk, neustart, plug-in, pmmupdate.exe, programm, pup.offerbundler.st, screenshot, trojan.agent.ge, trojan.agent.gen, trojan.fakems, trojan.pws, trojan.ransom.gen, trojaner, variante des bundespolizei-trojaners mit webcam eingefangen, webcam, wgsdgsdgdsgsd.exe


« BKA-Trojaner, und keine Ahnung wie es läuft | GVU-Trojaner mit Avira gelöscht - Symptome weg - Aber PC sauber? »

Ähnliche Themen: Variante des Bundespilzei Trojaner mit Webcam eingefangen


  1. Trojahner eingefangen mit Webcam funktion
    Plagegeister aller Art und deren Bekämpfung - 18.05.2013 (1)
  2. Neue Verschlüsselungs-Trojaner Variante im Umlauf
    Diskussionsforum - 10.04.2013 (1246)
  3. Variante des Win32/Spy.Zbot.ZR Trojaner
    Plagegeister aller Art und deren Bekämpfung - 13.12.2012 (43)
  4. GVU Trojaner mit Webcam eingefangen
    Plagegeister aller Art und deren Bekämpfung - 26.09.2012 (2)
  5. GVU Trojaner mit Webcam-Bild eingefangen
    Plagegeister aller Art und deren Bekämpfung - 07.09.2012 (14)
  6. GVU Webcam Trojaner eingefangen
    Log-Analyse und Auswertung - 02.09.2012 (13)
  7. GVU Trojaner - Variante vom 10.07.2012
    Log-Analyse und Auswertung - 19.08.2012 (11)
  8. GVU Trojaner Version mit Webcam eingefangen
    Log-Analyse und Auswertung - 16.08.2012 (1)
  9. neue Variante des GVU-Trojaners eingefangen
    Plagegeister aller Art und deren Bekämpfung - 14.08.2012 (12)
  10. GVU Trojaner mit Webcam eingefangen :-(
    Log-Analyse und Auswertung - 02.08.2012 (18)
  11. GVU-Trojaner mit Wasse(?)/Webcam eingefangen
    Plagegeister aller Art und deren Bekämpfung - 25.07.2012 (12)
  12. Verschlüsselungs Trojaner BKA GEMA Variante
    Plagegeister aller Art und deren Bekämpfung - 25.07.2012 (1)
  13. GVU-Trojaner mit Webcam eingefangen...
    Plagegeister aller Art und deren Bekämpfung - 17.07.2012 (11)
  14. GVU Trojaner - Variante vom 16.05.2012
    Log-Analyse und Auswertung - 11.07.2012 (7)
  15. Verschlüsselungs-Trojaner Variante
    Plagegeister aller Art und deren Bekämpfung - 03.06.2012 (1)
  16. BKA Trojaner variante
    Log-Analyse und Auswertung - 12.03.2012 (3)
  17. Variante von Win32/Kryptik.GYI Trojaner
    Plagegeister aller Art und deren Bekämpfung - 27.09.2010 (0)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Variante des Bundespilzei Trojaner mit Webcam eingefangen - Hallo Trojaner-Broad-Team, vorgestern Abend hab ich mir anscheinend auch eine Variante des Bundespolizei-Trojaners gefangen. Auf einer Seite öffnete sich auf einmal das typische Sperrfenster. Die kopfzeile war vom Bundesjustizministerium kopiert. - Variante des Bundespilzei Trojaner mit Webcam eingefangen...
Archiv
Du betrachtest: Variante des Bundespilzei Trojaner mit Webcam eingefangen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129