Hallo,
ich habe gerstern ausversehen ein unbekanter email geöffnet,leider hat der Kaspersky die datei HEUR:Exploit.Java.CVE-2012-0507.gen gefunden .aber leider kann er das nicht löschen?ich habe auch die java cache gelöscht leider passiert auch nichts.

wenn ich die datei direkt von den pfad löschen würde ,würde es klappen?

C:\dokumente und einstellungen\......\anwendungsdaten\sun\java\deployment\cache\6.0\55

bitte um hilfe......danke im vorraus

OTL EXTRAS Logfile:

OTL Extras logfile created on: 22.01.2013 00:36:10 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\tester\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1013,92 Mb Total Physical Memory | 143,62 Mb Available Physical Memory | 14,16% Memory free
2,38 Gb Paging File | 1,41 Gb Available in Paging File | 59,31% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 78,66 Gb Total Space | 39,34 Gb Free Space | 50,02% Space Free | Partition Type: NTFS
Drive D: | 70,39 Gb Total Space | 37,84 Gb Free Space | 53,76% Space Free | Partition Type: NTFS
Drive F: | 2,97 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: TESTER-FF2687B3 | User Name: tester | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_USERS\S-1-5-21-682003330-436374069-839522115-1004\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5055:TCP" = 5055:TCP:*:Enabled:KinoniSvc
"26654:UDP" = 26654:UDP:*:Enabled:UDP 26654
"28418:TCP" = 28418:TCP:*:Enabled:TCP 28418
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\Windows Live\Messenger\msnmsgr.exe" = C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\Windows Live\Messenger\msnmsgr.exe" = C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Programme\Voipwise.com\Voipwise\Voipwise.exe" = C:\Programme\Voipwise.com\Voipwise\Voipwise.exe:*:Enabled:Voipwise -- (Voipwise)
"C:\xampp\mysql\bin\mysqld.exe" = C:\xampp\mysql\bin\mysqld.exe:*:Enabled:The MySQL Server -- ()
"C:\xampp\apache\bin\httpd.exe" = C:\xampp\apache\bin\httpd.exe:*:Enabled:Apache HTTP Server -- (Apache Software Foundation)
"C:\Programme\Telbo.com\Telbo\Telbo.exe" = C:\Programme\Telbo.com\Telbo\Telbo.exe:*:Enabled:Telbo -- (Telbo)
"C:\Programme\FRITZ!DSL\IGDCTRL.EXE" = C:\Programme\FRITZ!DSL\IGDCTRL.EXE:*:Enabled:AVM FRITZ!DSL - igdctrl.exe -- (AVM Berlin)
"C:\Programme\Internet Explorer\iexplore.exe" = C:\Programme\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer -- (Microsoft Corporation)
"C:\Programme\Mobiola Web Camera for S60\webcam.exe" = C:\Programme\Mobiola Web Camera for S60\webcam.exe:*:Disabled:Mobiola Web Camera -- (Warelex LLC)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Disabled:Google Earth -- (Google)
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Disabled:iTunes -- (Apple Inc.)
"C:\Programme\Microsoft Office\Office12\GROOVE.EXE" = C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Disabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Disabled:Microsoft Office OneNote -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Disabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Programme\Gemeinsame Dateien\Nokia\Service Layer\A\nsl_host_process.exe:*:Disabled:Nokia Service Layer Host Process  -- (Nokia Corporation)
"C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Programme\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Disabled:Nokia Software Updater -- (Nokia Corporation)
"C:\WINDOWS\system32\sessmgr.exe" = C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\TVUPlayer\TVUPlayer.exe" = C:\Programme\TVUPlayer\TVUPlayer.exe:*:Disabled:TVUPlayer Component -- (TVU networks)
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" = C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Disabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Programme\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe" = C:\Programme\Camfrog\Camfrog Video Chat\Camfrog Video Chat.exe:*:Enabled:Camfrog Client Module
"C:\WINDOWS\system32\SUPDSvc2.exe" = C:\WINDOWS\system32\SUPDSvc2.exe:*:Enabled:Samsung UPD Service2 -- (Samsung Electronics)
"C:\Programme\Samsung\Samsung Universal Scan Driver\USDAgent.exe" = C:\Programme\Samsung\Samsung Universal Scan Driver\USDAgent.exe:*:Enabled:USDAgent -- (Samsung Electronics Co., Ltd.)
"C:\Programme\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe" = C:\Programme\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe:*:Enabled:ICCUpdater -- (Samsung Electronics Co., Ltd.)
"C:\Programme\Skype\Phone\Skype.exe" = C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
"C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)
"C:\Programme\Bonjour\mDNSResponder.exe" = C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Dienst "Bonjour" -- (Apple Inc.)
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player -- (Musiccity Co.Ltd.)
"C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin -- (Skype Limited)
"C:\Programme\Tango\Tango.exe" = C:\Programme\Tango\Tango.exe:*:Enabled:Tango -- (Tango Inc.)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer -- (Microsoft Corporation)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (JTLWAWI)
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{07EEE598-5F21-4B57-B40B-46592625B3D9}" = Zune Language Pack (PTB)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 30
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{299C0434-4F4E-341F-A916-4E07AEB35E79}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2A9DFFD8-4E09-4B91-B957-454805B0D7C4}" = Zune Language Pack (CHS)
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3589A659-F732-4E65-A89A-5438C332E59D}" = Zune Language Pack (ELL)
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{43D16DA8-BF42-3C62-89D3-3AD47829DC2E}" = Google Talk Plugin
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{51C839E1-2BE4-4E77-A1BA-CCEA5DAFA741}" = Zune Language Pack (KOR)
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Anti-Virus 2013
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57C51D56-B287-4C11-9192-EC3C46EF76A4}" = Zune Language Pack (RUS)
"{5C93E291-A1CC-4E51-85C6-E194209FCDB4}" = Zune Language Pack (PTG)
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5DEFD397-4012-46C3-B6DA-E8013E660772}" = Zune Language Pack (NOR)
"{5F8D931D-B230-47F3-A9C0-0C8CA459A332}" = Microsoft Expression Web 4
"{604CD5A1-4520-4844-B064-A3D884B77E91}" = SpeedyPC Pro
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6740BCB0-5863-47F4-80F4-44F394DE4FE2}" = Zune Language Pack (NLD)
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B33492E-FBBC-4EC3-8738-09E16E395A10}" = Zune Language Pack (ESP)
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6EB931CD-A7DA-4A44-B74A-89C8EB50086F}" = Zune Language Pack (SVE)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7239A06F-235B-43B1-970D-7A411FD95683}" = Nokia Software Updater
"{749A1EDD-16C2-4C63-B013-D38F0F953973}" = OviMPlatform
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{76BA306B-2AA0-47C0-AB6B-F313AB56C136}" = Zune Language Pack (MSL)
"{76DAEC83-AF7B-333C-8A53-83D7C7D39199}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{8112C6B3-91E1-4560-8AB9-876DADFA37C5}" = Ovi Desktop Sync Engine
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8960A0A1-BB5A-479E-92CF-65AB9D684B43}" = Zune Language Pack (PLK)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B112338-2B08-4851-AF84-E7CAD74CEB32}" = Zune Language Pack (DAN)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8E87B944-4815-3C5E-947F-5035C9F64362}" = Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92ECE3F9-591E-4C12-8A62-B9FCE38BF646}" = Zune Language Pack (IND)
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{9480CCD5-BB18-4DF3-AB18-04198B30DD62}" = DELISprint
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B75648B-6C30-4A0D-9DE6-0D09D20AF5A5}" = Zune
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A06FE62B-CEBC-4E94-AED8-92DCC33BC8EA}" = Microsoft Expression Studio 4
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5A53EA8-A11E-49F0-BDF5-AE536426A31A}" = Zune Language Pack (CHT)
"{A8F2E50B-86E2-4D96-9BD2-9758BCC6F9B3}" = Zune Language Pack (CSY)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B4870774-5F3A-46D9-9DFE-06FB5599E26B}" = Zune Language Pack (FIN)
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B8B4446F-87E1-4423-A47A-16832C24A199}" = Nokia Ovi Suite
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BBAAAD82-6242-420F-86D4-BD72BB5E6C86}" = Tools für Microsoft SQL Server 2005 Express Edition
"{BE236D9A-52EC-4A17-82DA-84B5EAD31E3E}" = Zune Language Pack (DEU)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5D37FFA-7483-410B-982B-91E93FD3B7DA}" = Zune Language Pack (ITA)
"{C68D33B1-0204-4EBE-BC45-A6E432B1D13A}" = Zune Language Pack (FRA)
"{C6BE19C6-B102-4038-B2A6-1C313872DBB4}" = Zune Language Pack (HUN)
"{C73CA646-73B3-4AEF-A136-C37505745174}" = iTunes
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D0A858BE-A665-4C0D-BC5F-C37E534B7669}" = PC Connectivity Solution
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D8A781C9-3892-4E2E-9320-480CF896CFBB}" = Zune Language Pack (JPN)
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EE5B5B24-EEFC-4C8B-BF8B-256D705BAD89}" = Nokia Ovi Suite Software Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1FDAA01-988C-423F-AC12-0D8F333943FD}" = Nokia Connectivity Cable Driver
"{F2CB8C3C-9C9E-4FAB-9067-655601C5F748}" = Windows Mobile Device Updater Component
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F5993FCC-DF5D-4879-B70D-AA1F379C5C6B}" = Microsoft Expression Web 4 Service Pack 2
"{F70D5D8C-C1AF-40B3-9E47-3BB5F19EEA3A}" = Atheros for Acer Driver 5.3.0.67_Foxconn Installation Program
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"AAA Logo 2008_is1" = AAA Logo 2008 2.10
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"CANONBJ_Deinstall_CNMCP5y.DLL" = Canon PIXMA iP1500
"CanonMyPrinter" = Canon My Printer
"DAEMON Tools Lite" = DAEMON Tools Lite
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ExpressionStudio_4.0.20525.0" = Microsoft Expression Studio 4
"FileZilla Client" = FileZilla Client 3.5.3
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Anti-Virus 2013
"JTL-Wawi_is1" = JTL-Wawi
"KinoniDrivers" = KinoniDrivers 2.7.1
"LManager" = Launch Manager
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mobiola Web Camera for S60_is1" = Mobiola Web Camera for S60 3.0
"Mozilla Firefox 8.0.1 (x86 de)" = Mozilla Firefox 8.0.1 (x86 de)
"Nokia Ovi Suite" = Nokia Ovi Suite
"Notepad++" = Notepad++
"PdaNet_is1" = PdaNet Desktop for iPhone 1.54
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PSPad editor_is1" = PSPad editor
"Reimage Repair" = Reimage Repair
"Samsung Universal Print Driver" = Samsung Universal Print Driver
"Samsung Universal Scan Driver" = Samsung Universal Scan Driver
"Security Task Manager" = Security Task Manager 1.8d
"Telbo_is1" = Telbo
"Trojan Remover_is1" = Trojan Remover 6.8.5
"TrojanHunter_is1" = TrojanHunter 5.5
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"TVUPlayer" = TVUPlayer 2.5.3.1
"VLC media player" = VLC media player 1.1.3
"Voipwise_is1" = Voipwise
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Web_4.0.1303.0" = Microsoft Expression Web 4
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01009" = Microsoft User-Mode Driver Framework Feature Pack 1.9
"xampp" = XAMPP 1.7.4
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yahoo! Messenger" = Yahoo! Messenger
"Your Uninstaller! 2008_is1" = Your Uninstaller! 2008 Version 6.0
"Zune" = Zune
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-682003330-436374069-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"b9df15fc60b2634b" = AliSetupInstaller
"d990f8e25ff1ef0b" = PayPal Optimizer
"Google Chrome" = Google Chrome
"InternalFrameDemo" = InternalFrameDemo
"Protect Disc License Helper" = Protect Disc License Helper 1.0.125 (IE)
"Tango" = Tango
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 21.01.2013 18:54:28 | Computer Name = TESTER-FF2687B3 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung msiexec.exe, Version 3.1.4001.5512, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 21.01.2013 18:54:38 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Produkt: SpyHunter -- Fehler 1500. Eine andere Installation wird durchgeführt.
 Schließen Sie erst die andere Installation ab, bevor Sie mit dieser Installation
 fortfahren.
 
Error - 21.01.2013 18:54:39 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Produkt: SpyHunter -- Fehler 1500. Eine andere Installation wird durchgeführt.
 Schließen Sie erst die andere Installation ab, bevor Sie mit dieser Installation
 fortfahren.
 
Error - 21.01.2013 18:54:44 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Produkt: SpyHunter -- Fehler 1500. Eine andere Installation wird durchgeführt.
 Schließen Sie erst die andere Installation ab, bevor Sie mit dieser Installation
 fortfahren.
 
Error - 21.01.2013 18:54:45 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Produkt: SpyHunter -- Fehler 1500. Eine andere Installation wird durchgeführt.
 Schließen Sie erst die andere Installation ab, bevor Sie mit dieser Installation
 fortfahren.
 
Error - 21.01.2013 18:54:47 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Produkt: SpyHunter -- Fehler 1500. Eine andere Installation wird durchgeführt.
 Schließen Sie erst die andere Installation ab, bevor Sie mit dieser Installation
 fortfahren.
 
Error - 21.01.2013 18:58:24 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Product: SpyHunter -- Error 1500. Another installation is in progress.
 You must complete that installation before continuing this one.
 
Error - 21.01.2013 18:58:24 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Product: SpyHunter -- Error 1500. Another installation is in progress.
 You must complete that installation before continuing this one.
 
Error - 21.01.2013 18:58:25 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Product: SpyHunter -- Error 1500. Another installation is in progress.
 You must complete that installation before continuing this one.
 
Error - 21.01.2013 18:58:26 | Computer Name = TESTER-FF2687B3 | Source = MsiInstaller | ID = 11500
Description = Product: SpyHunter -- Error 1500. Another installation is in progress.
 You must complete that installation before continuing this one.
 
[ System Events ]
Error - 17.01.2013 06:24:31 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 18.01.2013 04:17:28 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 18.01.2013 04:17:52 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 18.01.2013 10:51:23 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 19.01.2013 10:45:54 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 20.01.2013 13:17:06 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst W32Time.
 
Error - 20.01.2013 16:58:06 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 21.01.2013 04:41:20 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 21.01.2013 05:01:52 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
 von Dienst TuneUp.UtilitiesSvc.
 
Error - 21.01.2013 12:51:01 | Computer Name = TESTER-FF2687B3 | Source = Service Control Manager | ID = 7034
Description = Dienst "Dienst "Bonjour"" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
[ TuneUp Events ]
Error - 25.09.2011 07:27:23 | Computer Name = TESTER-FF2687B3 | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 22.02.2012 10:45:54 | Computer Name = TESTER-FF2687B3 | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
Error - 08.05.2012 09:51:26 | Computer Name = TESTER-FF2687B3 | Source = TuneUp.UtilitiesSvc | ID = 300
Description = 
 
 
< End of report >
         

--- --- ---

[/CODE]

OTL Logfile:

OTL logfile created on: 22.01.2013 00:36:10 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Dokumente und Einstellungen\tester\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1013,92 Mb Total Physical Memory | 143,62 Mb Available Physical Memory | 14,16% Memory free
2,38 Gb Paging File | 1,41 Gb Available in Paging File | 59,31% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 78,66 Gb Total Space | 39,34 Gb Free Space | 50,02% Space Free | Partition Type: NTFS
Drive D: | 70,39 Gb Total Space | 37,84 Gb Free Space | 53,76% Space Free | Partition Type: NTFS
Drive F: | 2,97 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: TESTER-FF2687B3 | User Name: tester | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\tester\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Programme\Kinoni\EpocCam_and_Barcode_drivers\KinoniSvc.exe ()
PRC - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\klwtblfs.exe (Kaspersky Lab ZAO)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Inter#\d1b7c4f7e4e2066a916d5d17e8855c90\Vodafone.Base.Internals.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Facto#\9fbded072a88001b2eaf9ede7ec474f2\Vodafone.Base.Factory.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.SmsProfile#\bc015d245490e18301843ece6439283c\Vodafone.SmsProfileManager.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.SettingsMa#\b42af20a1e9e74eaab92cd3e59d10c42\Vodafone.SettingsManager.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.DataAccess#\0e486c5ab9d89ca2d324a1fbbec3f66c\Vodafone.DataAccessor.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.NtServiceM#\f31abe1eb14390c177fe9b2e88005278\Vodafone.NtServiceMessaging.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\MobileBroadbandReso#\78e5e876040377dc36fac4b7d52e30cb\MobileBroadbandResources.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Win32\78871b9558d65835ff8d5e37011ccfed\Vodafone.Base.Win32.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.Common\dacee6c086ee0155d1d554e1612e2399\Vodafone.Common.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\f43e890d874ef521aba51f76f64cd97b\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.MobileBroa#\5ee7cb51ae37371b561bd87e9c36d32b\Vodafone.MobileBroadband.CallbackHandler.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\1a6f9e23985e3159e6dd9827fd81c2fd\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.Base.Contr#\7a314d9c0ad97e2e9015e4b3e69dcac0\Vodafone.Base.Contracts.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.Data\98498f2222b78851b0a7e0b1aff8888b\Vodafone.Data.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.Platform\17ca03ca822f43ceff529cd4d655a86c\Vodafone.Platform.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Vodafone.LogEngine\bb7f4a412578e23df457b66358531253\Vodafone.LogEngine.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\96b7a0136e9e72e8f4eb0230c20766d2\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\fe025743210c22bea2f009e1612c38bf\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\aeac298c43c77d8860db8e7634d9f2eb\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\eab2340ead8e1a84bdf1a87868659979\mscorlib.ni.dll ()
MOD - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\kpcengine.2.2.dll ()
MOD - C:\Programme\Kinoni\EpocCam_and_Barcode_drivers\KinoniSvc.exe ()
MOD - C:\Programme\Kinoni\EpocCam_and_Barcode_drivers\EpocCam.ax ()
MOD - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\dblite.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU ()
MOD - C:\Programme\Kinoni\EpocCam_and_Barcode_drivers\swscale-0.dll ()
MOD - C:\Programme\Kinoni\EpocCam_and_Barcode_drivers\avutil-51.dll ()
MOD - C:\Programme\Kinoni\EpocCam_and_Barcode_drivers\avcodec-53.dll ()
MOD - C:\WINDOWS\system32\spd__l.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll ()
MOD - C:\WINDOWS\system32\SNXPWIA.dll ()
MOD - C:\WINDOWS\system32\SNXPEH.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AVP) -- C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe (Kaspersky Lab ZAO)
SRV - (KinoniSvc) -- C:\Programme\Kinoni\EpocCam_and_Barcode_drivers\KinoniSvc.exe ()
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Samsung UPD Service2) -- C:\WINDOWS\system32\SUPDSvc2.exe (Samsung Electronics)
SRV - (ZuneWlanCfgSvc) -- c:\Programme\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (WMZuneComm) -- c:\Programme\Zune\WMZuneComm.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) -- c:\Programme\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (ZuneBusEnum) -- c:\Programme\Zune\ZuneBusEnum.exe (Microsoft Corporation)
SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (VmbService) -- C:\Programme\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (IGDCTRL) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (UIUSys) -- system32\DRIVERS\UIUSYS.SYS File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (PCASp50) -- System32\Drivers\PCASp50.sys File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (cpuz134) -- C:\DOKUME~1\tester\LOKALE~1\Temp\cpuz134\cpuz134_x32.sys File not found
DRV - (Changer) --  File not found
DRV - (aswMBR) -- C:\DOKUME~1\tester\LOKALE~1\Temp\aswMBR.sys File not found
DRV - (as8lg45i) --  File not found
DRV - (AgereSoftModem) -- system32\DRIVERS\AGRSM.sys File not found
DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (kltdi) -- C:\WINDOWS\system32\drivers\kltdi.sys (Kaspersky Lab)
DRV - (klmouflt) -- C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (klkbdflt) -- C:\WINDOWS\system32\drivers\klkbdflt.sys (Kaspersky Lab)
DRV - (kinonivd) -- C:\WINDOWS\system32\drivers\kinonivd.sys (Windows (R) Win 7 DDK provider)
DRV - (KINONI_Wave) -- C:\WINDOWS\system32\drivers\kinonivad.sys (Windows (R) Win 7 DDK provider)
DRV - (dgderdrv) -- C:\WINDOWS\system32\drivers\dgderdrv.sys (Devguru Co., Ltd)
DRV - (kneps) -- C:\WINDOWS\system32\drivers\kneps.sys (Kaspersky Lab)
DRV - (ssudmdm) -- C:\WINDOWS\system32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) -- C:\WINDOWS\system32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab ZAO)
DRV - (kl1) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (ew_usbenumfilter) -- C:\WINDOWS\system32\drivers\ew_usbenumfilter.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_enumerator) -- C:\WINDOWS\system32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (mobiolavs) -- C:\WINDOWS\system32\drivers\mobiolavs.sys (SHAPE Services GmbH)
DRV - (MOBIOLA_Wave) -- C:\WINDOWS\system32\drivers\mobiolawave.sys (SHAPE Services)
DRV - (avmaudio) -- C:\WINDOWS\system32\drivers\avmaudio.sys (AVM Berlin)
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (vodafone_K3805-z_dc_enum) -- C:\WINDOWS\system32\drivers\vodafone_K3805-z_dc_enum.sys (Vodafone)
DRV - (Netaapl) -- C:\WINDOWS\system32\drivers\netaapl.sys (Apple Inc.)
DRV - (tcpipBM) -- C:\WINDOWS\system32\drivers\tcpipBM.sys (Bytemobile, Inc.)
DRV - (BMLoad) -- C:\WINDOWS\system32\drivers\BMLoad.sys (Bytemobile, Inc.)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (acedrv11) -- C:\WINDOWS\system32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (pavboot) -- C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (DritekPortIO) -- C:\Programme\Launch Manager\DPortIO.sys (Dritek System Inc.)
DRV - (WinUSB) -- C:\WINDOWS\system32\drivers\winusb.sys (Microsoft Corporation)
DRV - (pnetmdm) -- C:\WINDOWS\system32\drivers\pnetmdm.sys (June Fabrics Technology)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\..\SearchScopes,DefaultScope = {F5F2E5D1-2489-479E-917A-BEB3EE735314}
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\..\SearchScopes\{F5F2E5D1-2489-479E-917A-BEB3EE735314}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-682003330-436374069-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = hxxp://http=127.0.0.1:61414
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledAddons: firebug@software.joehewitt.com:1.9.2
FF - prefs.js..extensions.enabledAddons: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.2.2
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 61414
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Programme\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Programme\TVUPlayer\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Programme\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@protectdisc.com/NPMPDRM: C:\Programme\Gemeinsame Dateien\mpDRM\Binaries\NPMPDRM.dll ( )
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Dokumente und Einstellungen\tester\Anwendungsdaten\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.10.06 19:03:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Programme\Vodafone\Vodafone Mobile Broadband\Optimization Client\addon\ [2012.07.03 10:20:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\url_advisor@kaspersky.com [2012.12.20 19:05:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\virtual_keyboard@kaspersky.com [2012.12.20 19:05:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\content_blocker@kaspersky.com [2012.12.20 19:05:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.02.09 15:51:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.01.23 16:15:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.10.06 19:03:45 | 000,000,000 | ---D | M]
 
[2010.11.24 17:27:16 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\Extensions
[2013.01.21 20:59:49 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\Firefox\Profiles\l3nu9j8v.default\extensions
[2010.11.24 17:30:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\Firefox\Profiles\l3nu9j8v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.06.20 16:11:55 | 001,335,949 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\Firefox\Profiles\l3nu9j8v.default\extensions\firebug@software.joehewitt.com.xpi
[2012.11.05 23:07:04 | 001,268,546 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\Firefox\Profiles\l3nu9j8v.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi
[2013.01.21 20:59:45 | 000,189,829 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\Firefox\Profiles\l3nu9j8v.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
[2013.01.21 20:59:55 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\Firefox\Profiles\l3nu9j8v.default\searchplugins\sweetim.xml
[2012.02.09 15:51:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.05.03 19:41:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011.12.16 10:57:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
[2012.02.09 15:51:39 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.11.10 05:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.05.06 10:47:26 | 000,106,232 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\npww.dll
[2011.11.16 16:27:50 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.16 16:27:50 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.11.16 16:27:50 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.16 16:27:50 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.16 16:27:50 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.16 16:27:50 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: about:blank
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: about:blank
CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\24.0.1312.52\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\24.0.1312.52\pdf.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U30 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: alibaba setup one click (Enabled) = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Alibaba\AliSetup\0.1.0.52\npAliSetupOneClick.dll
CHR - plugin: Google Update (Enabled) = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Programme\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: TVU Web Player for FireFox (Enabled) = C:\Programme\TVUPlayer\npTVUAx.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Modul zur Link-Untersuchung = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\
CHR - Extension: Modul f\u00FCr das Blockieren gef\u00E4hrlicher Webseiten = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0\
CHR - Extension: Virtuelle Tastatur = C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4190_0\
 
O1 HOSTS File: ([2012.08.08 17:12:33 | 000,000,883 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1        magento.localhost.com www.localhost.com
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (no name) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - No CLSID value found.
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [THGuard] C:\Programme\TrojanHunter 5.5\THGuard.exe (Mischel Internet Security)
O4 - HKLM..\Run: [TrojanScanner] C:\Programme\Trojan Remover\Trjscan.exe (Simply Super Software)
O4 - HKU\.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Gerhard Schlager)
O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] C:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\.DEFAULT..\Run: [FRITZ!protect] FwebProt.exe File not found
O4 - HKU\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Gerhard Schlager)
O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] C:\Programme\Gemeinsame Dateien\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKU\S-1-5-18..\Run: [FRITZ!protect] FwebProt.exe File not found
O4 - HKU\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Gerhard Schlager)
O4 - HKU\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (Gerhard Schlager)
O4 - HKU\S-1-5-21-682003330-436374069-839522115-1004..\Run: [DAEMON Tools Lite] C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-682003330-436374069-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - Reg Error: Key error. File not found
O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\FRITZ!DSL\\sarah.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1351083618625 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1282444596968 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {A4150320-98EC-4DB6-9BFB-EBF4B6FBEB16} hxxp://telepalast.dyndns.org/codebase/DVM_IPCam2.ocx (DVM_IPCam2 Control)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab (EPUImageControl Class)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D659DB84-B5A3-4B97-98D1-297D4C2E6E6D}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - c:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-682003330-436374069-839522115-1004 Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010.08.22 03:42:48 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2007.06.13 10:12:34 | 000,000,043 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{1afe6442-c063-11e1-865b-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{1afe6442-c063-11e1-865b-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{1afe6442-c063-11e1-865b-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{21fde0a6-0a0a-11e1-879e-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{21fde0a6-0a0a-11e1-879e-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{21fde0a6-0a0a-11e1-879e-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{21fde0a7-0a0a-11e1-879e-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{21fde0a7-0a0a-11e1-879e-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{21fde0a7-0a0a-11e1-879e-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{21fde0a8-0a0a-11e1-879e-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{21fde0a8-0a0a-11e1-879e-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{21fde0a8-0a0a-11e1-879e-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{30bd8970-7d6d-11e0-873b-001b3877e097}\Shell - "" = AutoRun
O33 - MountPoints2\{30bd8970-7d6d-11e0-873b-001b3877e097}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{30bd8970-7d6d-11e0-873b-001b3877e097}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{30bd8971-7d6d-11e0-873b-001b3877e097}\Shell - "" = AutoRun
O33 - MountPoints2\{30bd8971-7d6d-11e0-873b-001b3877e097}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{30bd8971-7d6d-11e0-873b-001b3877e097}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{3940f572-6119-11e0-872b-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{3940f572-6119-11e0-872b-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3940f572-6119-11e0-872b-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{3940f575-6119-11e0-872b-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{3940f575-6119-11e0-872b-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3940f575-6119-11e0-872b-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{3a83be41-2b26-11e2-89a9-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{3a83be41-2b26-11e2-89a9-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3a83be41-2b26-11e2-89a9-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{61d9cd00-0c7b-11e1-87a3-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{61d9cd00-0c7b-11e1-87a3-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{61d9cd00-0c7b-11e1-87a3-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{82852a62-eaa5-11e0-878d-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{82852a62-eaa5-11e0-878d-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{82852a62-eaa5-11e0-878d-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{9212da41-2772-11e2-9bae-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{9212da41-2772-11e2-9bae-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9212da41-2772-11e2-9bae-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{9212da42-2772-11e2-9bae-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{9212da42-2772-11e2-9bae-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9212da42-2772-11e2-9bae-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a25e875a-ad33-11e0-8762-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{a25e875a-ad33-11e0-8762-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a25e875a-ad33-11e0-8762-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a25e875b-ad33-11e0-8762-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{a25e875b-ad33-11e0-8762-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a25e875b-ad33-11e0-8762-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a28bd2d1-a26e-11e1-8a66-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{a28bd2d1-a26e-11e1-8a66-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a28bd2d1-a26e-11e1-8a66-001e4caab107}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{adfc676c-0a1c-11e1-879f-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{adfc676c-0a1c-11e1-879f-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{adfc676c-0a1c-11e1-879f-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{b1308b40-c05f-11e1-9dfc-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{b1308b40-c05f-11e1-9dfc-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b1308b40-c05f-11e1-9dfc-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{b1308b43-c05f-11e1-9dfc-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{b1308b43-c05f-11e1-9dfc-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b1308b43-c05f-11e1-9dfc-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{b1308b45-c05f-11e1-9dfc-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{b1308b45-c05f-11e1-9dfc-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b1308b45-c05f-11e1-9dfc-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{b519d732-a9e2-11e0-875d-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{b519d732-a9e2-11e0-875d-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b519d732-a9e2-11e0-875d-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{d3a16554-ef59-11e0-878f-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{d3a16554-ef59-11e0-878f-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d3a16554-ef59-11e0-878f-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{d3a52740-c4eb-11e1-88ad-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{d3a52740-c4eb-11e1-88ad-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d3a52740-c4eb-11e1-88ad-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{d3a52741-c4eb-11e1-88ad-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{d3a52741-c4eb-11e1-88ad-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d3a52741-c4eb-11e1-88ad-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{d3a52746-c4eb-11e1-88ad-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{d3a52746-c4eb-11e1-88ad-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d3a52746-c4eb-11e1-88ad-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{dbac2140-80cc-11e1-aaef-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{dbac2140-80cc-11e1-aaef-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dbac2140-80cc-11e1-aaef-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e33c6969-7ba6-11e1-b51b-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{e33c6969-7ba6-11e1-b51b-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e33c6969-7ba6-11e1-b51b-001e4caab107}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{e33c696e-7ba6-11e1-b51b-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{e33c696e-7ba6-11e1-b51b-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e33c696e-7ba6-11e1-b51b-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{f6e48bc3-40b4-11e2-9d69-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{f6e48bc3-40b4-11e2-9d69-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f6e48bc3-40b4-11e2-9d69-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{f6e48bc4-40b4-11e2-9d69-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{f6e48bc4-40b4-11e2-9d69-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f6e48bc4-40b4-11e2-9d69-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{fa38134a-0afa-11e1-87a2-001e4caab107}\Shell - "" = AutoRun
O33 - MountPoints2\{fa38134a-0afa-11e1-87a2-001e4caab107}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fa38134a-0afa-11e1-87a2-001e4caab107}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.22 00:35:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\tester\Desktop\OTL.exe
[2013.01.22 00:09:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Reimage Repair
[2013.01.22 00:09:29 | 000,000,000 | ---D | C] -- C:\rei
[2013.01.22 00:09:21 | 000,000,000 | ---D | C] -- C:\Programme\Reimage
[2013.01.21 23:51:17 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\DriverCure
[2013.01.21 23:51:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\SpeedyPC Software
[2013.01.21 23:51:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Startmenü\Programme\SpeedyPC Software
[2013.01.21 23:51:02 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\SpeedyPC Software
[2013.01.21 23:50:56 | 000,000,000 | ---D | C] -- C:\Programme\SpeedyPC Software
[2013.01.21 23:50:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SpeedyPC Software
[2013.01.21 23:36:19 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\tester\Recent
[2013.01.21 23:32:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CCleaner
[2013.01.21 23:32:52 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2013.01.21 23:32:19 | 004,178,040 | ---- | C] (Piriform Ltd) -- C:\Dokumente und Einstellungen\tester\Desktop\ccsetup326.exe
[2013.01.21 22:33:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2013.01.21 22:27:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TrojanHunter
[2013.01.21 22:27:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TrojanHunter
[2013.01.21 22:18:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Simply Super Software
[2013.01.21 22:17:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Trojan Remover
[2013.01.21 22:17:48 | 000,605,968 | ---- | C] (Igor Pavlov) -- C:\WINDOWS\System32\ztv7z.dll
[2013.01.21 22:17:47 | 000,077,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll
[2013.01.21 21:31:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\TrojanHunter
[2013.01.21 21:30:49 | 000,000,000 | ---D | C] -- C:\Programme\Trojan Remover
[2013.01.21 21:25:56 | 000,000,000 | ---D | C] -- C:\Programme\TrojanHunter 5.5
[2013.01.19 00:09:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\Neuer Ordner
[2013.01.14 15:33:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Desktop\Neuer Ordner (2)
[2013.01.11 22:29:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\Hz-Dateien
[2013.01.02 21:16:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\tester\Desktop\ebay en son 02022113
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.22 00:44:01 | 000,001,214 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-682003330-436374069-839522115-1004UA.job
[2013.01.22 00:42:34 | 001,110,476 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\7z920.exe
[2013.01.22 00:40:32 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\Defogger.exe
[2013.01.22 00:38:36 | 000,365,568 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\gmer-2.0.18444.exe
[2013.01.22 00:36:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.22 00:35:16 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\tester\Desktop\OTL.exe
[2013.01.22 00:10:35 | 000,000,162 | ---- | M] () -- C:\WINDOWS\reimage.ini
[2013.01.22 00:10:17 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\Reimage Reminder.job
[2013.01.22 00:09:30 | 000,001,713 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PC Scan & Repair by Reimage.lnk
[2013.01.21 23:51:24 | 000,000,478 | ---- | M] () -- C:\WINDOWS\tasks\SpeedyPC Registration3.job
[2013.01.21 23:51:08 | 000,000,826 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\SpeedyPC Pro.lnk
[2013.01.21 23:51:08 | 000,000,502 | ---- | M] () -- C:\WINDOWS\tasks\SpeedyPC Update Version3 Startup Task.job
[2013.01.21 23:51:08 | 000,000,450 | ---- | M] () -- C:\WINDOWS\tasks\SpeedyPC Update Version3.job
[2013.01.21 23:51:06 | 000,000,382 | ---- | M] () -- C:\WINDOWS\tasks\SpeedyPC Pro.job
[2013.01.21 23:39:17 | 000,001,022 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-682003330-436374069-839522115-1004UA.job
[2013.01.21 23:38:04 | 000,081,164 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\cc_20130121_233753.reg
[2013.01.21 23:36:00 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013.01.21 23:13:45 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.01.21 23:12:27 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.21 23:12:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.01.21 22:37:41 | 000,574,315 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\adwcleaner.exe
[2013.01.21 22:32:29 | 013,462,931 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\mbar-1.01.0.1016.zip
[2013.01.21 22:27:24 | 000,059,392 | R--- | M] () -- C:\WINDOWS\System32\streamhlp.dll
[2013.01.21 22:27:20 | 000,000,672 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\TrojanHunter.lnk
[2013.01.21 20:39:39 | 000,001,000 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-682003330-436374069-839522115-1004Core.job
[2013.01.21 19:51:42 | 000,104,396 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\Unbenannt111.JPG
[2013.01.21 18:59:46 | 000,104,396 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\Unbenanntaaaa.JPG
[2013.01.21 12:44:03 | 000,001,162 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-682003330-436374069-839522115-1004Core.job
[2013.01.20 14:51:14 | 001,228,504 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\mtopcuaraaba.rar
[2013.01.20 14:51:00 | 000,129,948 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\Unbenannt.JPG
[2013.01.17 21:09:40 | 000,856,753 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\Hotmail.zip
[2013.01.17 12:09:26 | 000,831,514 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\2013-01-17_16-59-11_643.jpg
[2013.01.16 14:55:41 | 000,021,341 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\Varinat überweisung.pdf
[2013.01.16 13:22:54 | 000,021,434 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\PB_Auslandsüberweisung_KtoNr0944398308_16-01-2013_1322.pdf
[2013.01.12 16:50:50 | 000,131,061 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\1.JPG
[2013.01.11 22:29:24 | 000,024,348 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\Hz.htm
[2013.01.09 22:59:27 | 000,608,052 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013.01.09 22:59:27 | 000,569,006 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013.01.09 22:59:27 | 000,139,418 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013.01.09 22:59:27 | 000,114,162 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013.01.08 14:37:10 | 000,196,607 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\Herunterladen.pdf
[2013.01.06 06:33:34 | 006,009,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2013.01.01 00:17:53 | 025,731,190 | ---- | M] () -- C:\Dokumente und Einstellungen\tester\Desktop\01spie.rar
[2012.12.23 12:45:17 | 003,622,304 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[12 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
File not found -- C:\Dokumente und Einstellungen\tester\Desktop\MBR.dat
[2013.01.22 00:42:34 | 001,110,476 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\7z920.exe
[2013.01.22 00:40:26 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\Defogger.exe
[2013.01.22 00:38:36 | 000,365,568 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\gmer-2.0.18444.exe
[2013.01.22 00:10:16 | 000,000,276 | ---- | C] () -- C:\WINDOWS\tasks\Reimage Reminder.job
[2013.01.22 00:09:37 | 000,000,162 | ---- | C] () -- C:\WINDOWS\reimage.ini
[2013.01.22 00:09:30 | 000,001,713 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\PC Scan & Repair by Reimage.lnk
[2013.01.21 23:51:23 | 000,000,478 | ---- | C] () -- C:\WINDOWS\tasks\SpeedyPC Registration3.job
[2013.01.21 23:51:08 | 000,000,826 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\SpeedyPC Pro.lnk
[2013.01.21 23:51:07 | 000,000,502 | ---- | C] () -- C:\WINDOWS\tasks\SpeedyPC Update Version3 Startup Task.job
[2013.01.21 23:51:06 | 000,000,450 | ---- | C] () -- C:\WINDOWS\tasks\SpeedyPC Update Version3.job
[2013.01.21 23:51:04 | 000,000,382 | ---- | C] () -- C:\WINDOWS\tasks\SpeedyPC Pro.job
[2013.01.21 23:37:59 | 000,081,164 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\cc_20130121_233753.reg
[2013.01.21 23:32:53 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2013.01.21 22:37:37 | 000,574,315 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\adwcleaner.exe
[2013.01.21 22:32:19 | 013,462,931 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\mbar-1.01.0.1016.zip
[2013.01.21 22:27:20 | 000,000,672 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\TrojanHunter.lnk
[2013.01.21 22:27:09 | 000,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll
[2013.01.21 22:17:48 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2013.01.21 22:17:47 | 000,185,616 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar39.dll
[2013.01.21 22:17:47 | 000,169,744 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2013.01.21 22:17:47 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2013.01.21 22:17:46 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll
[2013.01.21 19:51:41 | 000,104,396 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\Unbenannt111.JPG
[2013.01.21 18:59:41 | 000,104,396 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\Unbenanntaaaa.JPG
[2013.01.20 14:51:00 | 000,129,948 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\Unbenannt.JPG
[2013.01.17 21:09:58 | 000,831,514 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\2013-01-17_16-59-11_643.jpg
[2013.01.17 21:09:37 | 000,856,753 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\Hotmail.zip
[2013.01.16 14:55:40 | 000,021,341 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\Varinat überweisung.pdf
[2013.01.16 13:22:52 | 000,021,434 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\PB_Auslandsüberweisung_KtoNr0944398308_16-01-2013_1322.pdf
[2013.01.12 16:50:50 | 000,131,061 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\1.JPG
[2013.01.11 22:29:24 | 000,024,348 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Eigene Dateien\Hz.htm
[2013.01.08 14:37:09 | 000,196,607 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\Herunterladen.pdf
[2013.01.01 00:17:52 | 025,731,190 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\01spie.rar
[2012.12.24 05:10:58 | 001,228,504 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Desktop\mtopcuaraaba.rar
[2012.11.26 15:46:50 | 000,004,747 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\.recently-used.xbel
[2012.08.28 09:04:34 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2012.08.28 09:04:34 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2012.08.28 09:04:34 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2012.08.28 09:04:34 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2012.08.28 09:04:32 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2012.04.02 10:55:22 | 000,317,952 | R--- | C] () -- C:\WINDOWS\System32\SaXPWIA.dll
[2012.04.02 10:55:22 | 000,145,920 | R--- | C] () -- C:\WINDOWS\System32\SaXPUIEx.dll
[2012.04.02 10:53:59 | 000,120,112 | ---- | C] () -- C:\WINDOWS\Wiainst.exe
[2012.04.02 10:51:35 | 000,349,264 | ---- | C] () -- C:\WINDOWS\System32\UPDIO2.dll
[2012.04.02 10:51:35 | 000,261,712 | ---- | C] () -- C:\WINDOWS\SUPDRun.exe
[2012.04.02 10:51:34 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\spd__l.dll
[2012.04.02 10:51:33 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\spd__ci.exe
[2012.02.15 20:33:56 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.12.04 23:03:40 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BarCode.INI
[2011.08.01 21:18:06 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.04.27 21:50:00 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\{25B0A8F6-4754-48A6-B175-886F4BB11B6F}
[2011.04.18 14:39:56 | 000,226,364 | R--- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DeviceManager.xml.rc4
[2011.04.08 01:52:48 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\winscp.rnd
[2011.03.21 02:17:52 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.03.06 23:02:48 | 000,007,170 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\F4DE.CD7
[2011.01.24 12:46:20 | 000,000,265 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2010.11.30 09:09:15 | 008,806,614 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-682003330-436374069-839522115-1004-0.dat
[2010.11.30 09:09:10 | 000,397,582 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2010.09.16 16:03:10 | 000,002,828 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
[2010.09.16 16:03:10 | 000,000,088 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\A890439121.sys
[2010.08.22 04:48:02 | 000,011,776 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.22 03:55:00 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\tester\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
 
========== ZeroAccess Check ==========
 
[2010.08.22 03:44:46 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 03:22:25 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 03:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.03.28 15:12:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2012.12.04 19:45:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DATA BECKER Downloads
[2013.01.22 00:35:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Deutsche Post AG
[2011.10.25 20:04:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreeHideIP
[2010.10.04 00:43:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
[2010.12.02 14:01:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jtl-software
[2012.12.04 20:17:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mpDRM
[2010.10.04 00:47:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
[2010.10.06 19:00:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NokiaInstallerCache
[2010.10.06 19:32:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2012.01.08 19:47:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe
[2012.10.02 21:41:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Samsung
[2012.11.30 02:55:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2010.11.23 19:14:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software
[2013.01.21 23:51:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SpeedyPC Software
[2012.04.02 11:35:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScan
[2013.01.22 00:50:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2013.01.21 22:27:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TrojanHunter
[2010.11.23 18:54:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2012.07.03 10:21:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone
[2010.11.23 18:52:51 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2010.10.22 20:31:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.10.25 20:29:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{5F9E318F-6857-4A05-90D8-6E92501E2136}
[2012.12.04 20:16:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{9D32C6BC-9649-4BBB-B075-B26C6CA62F12}
[2012.07.03 09:53:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Vodafone
[2010.12.16 20:29:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\.los_reference
[2012.02.01 17:46:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Camfrog
[2013.01.21 23:35:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\DAEMON Tools Lite
[2012.12.04 20:16:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\DATA BECKER Shared
[2013.01.21 23:51:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\DriverCure
[2013.01.21 23:35:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\FileZilla
[2011.10.25 20:04:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\FreeHideIP
[2011.04.28 05:14:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\FRITZ!
[2012.11.26 15:46:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\gtk-2.0
[2010.10.06 19:32:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Nokia
[2012.02.25 23:39:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Notepad++
[2010.10.04 00:50:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\PC Suite
[2012.12.04 19:45:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\ProtectDisc
[2012.08.08 21:01:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\redsn0w
[2012.10.02 21:49:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Samsung
[2012.05.19 01:50:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Scribus
[2013.01.21 22:18:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Simply Super Software
[2013.01.21 23:51:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\SpeedyPC Software
[2011.09.12 17:55:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Telbo
[2013.01.21 21:31:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\TrojanHunter
[2010.11.23 18:53:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\TuneUp Software
[2010.08.22 03:00:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\URSoft
[2012.07.03 09:53:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Vodafone
[2011.07.11 13:21:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Vodafone Mobile Broadband
[2012.04.07 15:24:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Voipwise
[2012.12.07 22:28:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\tester\Anwendungsdaten\Wyotr
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 176 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9
@Alternate Data Stream - 174 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:B3D74A13
@Alternate Data Stream - 118 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:9D1B94FD

< End of report >
         

--- --- ---


[/CODE]

GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-22 01:17:47
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e WDC_WD1600BEVS-00VAT0 rev.11.01A11 149,05GB
Running: gmer-2.0.18444.exe; Driver: C:\DOKUME~1\tester\LOKALE~1\Temp\kwdcqaob.sys


---- System - GMER 2.0 ----

SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwAdjustPrivilegesToken [0xA9A8A55C]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwClose [0xA9A26A82]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwConnectPort [0xA9A3D962]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateEvent [0xA9A26FFA]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateMutant [0xA9A26EE0]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreatePort [0xA9A3DC88]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateProcess [0xA9A8C4D6]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateProcessEx [0xA9A8C6F2]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateSection [0xA9A8D5B2]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateSemaphore [0xA9A2711A]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateSymbolicLinkObject [0xA9A4DAC0]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateThread [0xA9A8CBB6]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwCreateWaitablePort [0xA9A3DD56]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwDebugActiveProcess [0xA9A8C37C]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwDeleteKey [0xA9A379E2]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwDeleteValueKey [0xA9A391CA]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwDeviceIoControlFile [0xA9A26AC6]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwDuplicateObject [0xA9A8A69E]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwEnumerateKey [0xA9A389D6]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwEnumerateValueKey [0xA9A3936A]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwLoadDriver [0xA9A8A306]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwLoadKey [0xA9A3851A]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwLoadKey2 [0xA9A38772]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwMapViewOfSection [0xA9A4DAE0]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwNotifyChangeKey [0xA9A3C126]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwOpenEvent [0xA9A27090]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwOpenMutant [0xA9A26F70]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwOpenProcess [0xA9A8BF24]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwOpenSection [0xA9A8D85E]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwOpenSemaphore [0xA9A271B0]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwOpenThread [0xA9A8C912]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwPlugPlayControl [0xA9A4DAD0]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwQueryKey [0xA9A37816]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwQueryMultipleValueKey [0xA9A38FD8]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwQueryObject [0xA9A3C332]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwQueryValueKey [0xA9A38DCC]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwQueueApcThread [0xA9A8D260]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwRenameKey [0xA9A37AF6]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwReplaceKey [0xA9A38168]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwReplyPort [0xA9A3DF96]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwReplyWaitReceivePort [0xA9A3DE24]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwReplyWaitReceivePortEx [0xA9A3DEDA]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwRequestWaitReplyPort [0xA9A3E006]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwRestoreKey [0xA9A3836E]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwResumeThread [0xA9A8CF8C]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSaveKey [0xA9A37C9A]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSaveKeyEx [0xA9A37E30]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSaveMergedKeys [0xA9A37FCC]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSecureConnectPort [0xA9A3DAF0]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSetContextThread [0xA9A8D0E8]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSetInformationToken [0xA9A2723A]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSetSystemInformation [0xA9A8A410]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSetValueKey [0xA9A38B96]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSuspendProcess [0xA9A8C0C4]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSuspendThread [0xA9A8CE34]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwSystemDebugControl [0xA9A2724C]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwTerminateProcess [0xA9A8C224]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwTerminateThread [0xA9A8CAB2]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwUnmapViewOfSection [0xA9A8D9C6]
SSDT   \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                               ZwWriteVirtualMemory [0xA9A8D6F0]

---- Kernel code sections - GMER 2.0 ----

.text  ntkrnlpa.exe!ZwCallbackReturn + 2434                                                                                80501C84 12 Bytes  [88, DC, A3, A9, D6, C4, A8, ...] {MOV AH, BL; MOV [0xa8c4d6a9], EAX; TEST EAX, 0xa9a8c6f2}
.text  ntkrnlpa.exe!ZwCallbackReturn + 2444                                                                                80501C94 16 Bytes  [B2, D5, A8, A9, 1A, 71, A2, ...] {MOV DL, 0xd5; TEST AL, 0xa9; SBB DH, [ECX-0x5e]; TEST EAX, 0xa9a4dac0; MOV DH, 0xcb; TEST AL, 0xa9}
.text  ntkrnlpa.exe!ZwCallbackReturn + 2500                                                                                80501D50 12 Bytes  [06, A3, A8, A9, 1A, 85, A3, ...]
.text  ntkrnlpa.exe!ZwCallbackReturn + 267C                                                                                80501ECC 20 Bytes  [F6, 7A, A3, A9, 68, 81, A3, ...]
.text  ntkrnlpa.exe!ZwCallbackReturn + 26B4                                                                                80501F04 20 Bytes  [8C, CF, A8, A9, 9A, 7C, A3, ...]
.text  ...                                                                                                                 
.vmp2  C:\WINDOWS\system32\drivers\acedrv11.sys                                                                            entry point in ".vmp2" section [0xA913269D]

---- User code sections - GMER 2.0 ----

?      C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[240] C:\WINDOWS\system32\ntdll.dll                     time/date stamp mismatch; 
.text  C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[240] ntdll.dll!NtProtectVirtualMemory                  7C91D6EE 5 Bytes  JMP 6CD01A54 C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\ushata.dll (Ushata module/Kaspersky Lab ZAO)
?      C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[240] C:\WINDOWS\system32\kernel32.dll                  time/date stamp mismatch; 
.text  C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[240] USER32.dll!AlignRects                             7E362A78 4 Bytes  [53, 2A, D0, 6C] {PUSH EBX; SUB DL, AL; INS BYTE [ES:EDI], DX}
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!DialogBoxParamW                                         7E3747AB 5 Bytes  JMP 41195505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!SetWindowsHookExW                                       7E37820F 5 Bytes  JMP 41269AB5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!CallNextHookEx                                          7E37B3C6 5 Bytes  JMP 4125D12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!CreateWindowExW                                         7E37D0A3 5 Bytes  JMP 4126DB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!UnhookWindowsHookEx                                     7E37D5F3 5 Bytes  JMP 411D466C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!DialogBoxIndirectParamW                                 7E382072 5 Bytes  JMP 4136725F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!MessageBoxIndirectA                                     7E38A082 5 Bytes  JMP 41367191 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!DialogBoxParamA                                         7E38B144 5 Bytes  JMP 413671FC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!MessageBoxExW                                           7E3A0838 5 Bytes  JMP 41367062 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!MessageBoxExA                                           7E3A085C 5 Bytes  JMP 413670C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!DialogBoxIndirectParamA                                 7E3A6D7D 5 Bytes  JMP 413672C2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] USER32.dll!MessageBoxIndirectW                                     7E3B64D5 5 Bytes  JMP 41367126 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] ole32.dll!CoCreateInstance                                         774CF1BC 5 Bytes  JMP 4126DB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[492] ole32.dll!OleLoadFromStream                                        774F983B 5 Bytes  JMP 413675C7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
?      C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1408] C:\WINDOWS\system32\ntdll.dll                    time/date stamp mismatch; 
.text  C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1408] ntdll.dll!NtProtectVirtualMemory                 7C91D6EE 5 Bytes  JMP 6CD01A54 C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\ushata.dll (Ushata module/Kaspersky Lab ZAO)
?      C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1408] C:\WINDOWS\system32\kernel32.dll                 time/date stamp mismatch; 
.text  C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1408] USER32.dll!AlignRects                            7E362A78 4 Bytes  [53, 2A, D0, 6C] {PUSH EBX; SUB DL, AL; INS BYTE [ES:EDI], DX}
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!DialogBoxParamW                                        7E3747AB 5 Bytes  JMP 41195505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!CreateWindowExW                                        7E37D0A3 5 Bytes  JMP 4126DB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!DialogBoxIndirectParamW                                7E382072 5 Bytes  JMP 4136725F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!MessageBoxIndirectA                                    7E38A082 5 Bytes  JMP 41367191 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!DialogBoxParamA                                        7E38B144 5 Bytes  JMP 413671FC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!MessageBoxExW                                          7E3A0838 5 Bytes  JMP 41367062 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!MessageBoxExA                                          7E3A085C 5 Bytes  JMP 413670C4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!DialogBoxIndirectParamA                                7E3A6D7D 5 Bytes  JMP 413672C2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Programme\Internet Explorer\iexplore.exe[2608] USER32.dll!MessageBoxIndirectW                                    7E3B64D5 5 Bytes  JMP 41367126 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- Registry - GMER 2.0 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001060aab93a                                         
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x20 0x85 0xE5 0xC6 ...
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Programme\DAEMON Tools Lite\
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x19 0xA5 0xED 0xE5 ...
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0xA0 0x02 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      
Reg    HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x2D 0x8C 0x96 0xAA ...
Reg    HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001060aab93a (not active ControlSet)                     
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x20 0x85 0xE5 0xC6 ...
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Programme\DAEMON Tools Lite\
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x19 0xA5 0xED 0xE5 ...
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  
Reg    HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x2D 0x8C 0x96 0xAA ...

---- EOF - GMER 2.0 ----
         

screensshot

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 01:02 on 22/01/2013 (tester)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-