JS/Ransom-ABJ Trojaner

knax · 04.05.2013, 00:20

Hoi zäme

Ich hoffe Ihr könnt mir helfen mit einem Trojaner, welchen ich mir eingefangen habe und welcher mich aus dem System aussperrt. Ich bin zufällig beim stöbern heute über euer Board gestossen und bin sehr beeindruckt von eurer Unterstüzung in den vielen Beiträgen bzgl.Trojaner und anderen Schädlingen.
Nach meiner Meinung habe ich mir einen GVU Trojaner eingefangen. Dieser sperrt den Bildschirm und will einen Geldbetrag für das Entsperren innerhalb 72h. Der PC lässt sich noch im abgesicherten Modus, mit Netzwerktreiber und Eingabeaufforderung starten. Ich habe schon mehrer Versuche unternommen diesem Trojaner vom System zu entfernen, jedoch waren bisher meine Versuche ziemlich erfolglos.
Vorweg hatte ich mit einzelnen Male Säuberungsprogrammen versucht diesen Sperrbildschirm wegzu bekommen. Der auf dem System installierte Virenscanner von MC Afee hatte folgenden Trojaner erkannt und angezeigt: dzvoir.js; Speicherort C:\PROGRA~3; Endeckte Bedrohungen JS/Ransom-ABJ (Trojaner) und dzvoir.js; Speicherort C:\ProgramData; Endeckte Bedrohungen JS/Ransom-ABJ (Trojaner)
Bin im Board auf ein ähnliches Thema gestossen und habe als erstes den Scan mit Farbars im abgesicherten Modus durchgeführt.

Danke euch vorab für eure Unterstüzung und Hilfe.
knax

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2013
Ran by SYSTEM on 04-05-2013 00:14:36
Running from R:\
Windows 7 Professional (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.


ATTENTION!:=====> THE OPERATING SYSTEM IS A X86 SYSTEM BUT THE BOOT DISK THAT IS USED TO BOOT TO RECOVERY ENVIRONMENT IS A X64 SYSTEM DISK.
==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Ocs_SM] C:\Users\****\AppData\Roaming\OCS\SM\SearchAnonymizer.exe                                                                                                                                                                                                                [106496 2011-08-31] (OCS)
HKLM\...\Run: [EvtMgr6] C:\Programme (neu)\Logitech\SetPointP\SetPoint.exe /launchGaming [1744152 2011-10-07] (Logitech, Inc.)
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM-x32\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43608 2010-09-07] ()
HKLM-x32\...\Run: [CLMLServer] "C:\Programme (neu)\Cyberlink BD Solution\Power2Go\CLMLSvc.exe"                                                                                                                                                                                                           [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [UpdatePSTShortCut] "C:\Programme (neu)\Cyberlink BD Solution\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" "C:\Programme (neu)\Cyberlink BD Solution\Blu-ray Disc Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"                                                           [222504 2010-01-05] (CyberLink Corp.)
HKLM-x32\...\Run: [LWS] C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\LWS.exe -hide [205336 2011-08-12] (Logitech Inc.)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [BCSSync] "C:\Programme (neu)\MS Office 2010 Professional\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-10-21] (NEC Electronics Corporation)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1534504 2013-01-14] (McAfee, Inc.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" [197288 2011-11-15] (Lavasoft)
HKLM-x32\...\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" [375000 2009-10-15] (DeviceVM, Inc.)
HKU\HNPC1\...\Run: [HP Photosmart 6520 series (NET)] "C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN29A1618V05TZ:NW" -scfn "HP Photosmart 6520 series (NET)" -AutoStart 1 [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\HNPC1\...\Run: []  [x]
HKU\HNPC1\...\Run: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\riovzd.dat,FG00 [159744 2013-05-03] ()
Startup: C:ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
ShortcutTarget: msconfig.lnk -> C:\PROGRA~3\riovzd.dat ()
Startup: C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 6520 series (Netzwerk).lnk
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} -  No File

==================== Services (Whitelisted) =================

S3 FastUserSwitchingCompatibility; C:\Windows\System32\shsvcs.dll [370688 2010-11-20] (Microsoft Corporation)
S3 FastUserSwitchingCompatibility; C:\Windows\SysWow64\shsvcs.dll [328192 2010-11-20] (Microsoft Corporation)
S3 Nla; C:\Windows\System32\mswsock.dll [326144 2010-11-20] (Microsoft Corporation)
S3 Nla; C:\Windows\SysWow64\mswsock.dll [232448 2010-11-20] (Microsoft Corporation)
S3 NtLmSsp; C:\Windows\system32\lsass.exe [31232 2011-11-17] (Microsoft Corporation)
S2 PlugPlay; C:\Windows\system32\services.exe [328704 2009-07-14] (Microsoft Corporation)
S3 PolicyAgent; C:\Windows\system32\lsass.exe [31232 2011-11-17] (Microsoft Corporation)
S3 Wmi; C:\Windows\System32\advapi32.dll [877056 2009-07-14] (Microsoft Corporation)
S3 Wmi; C:\Windows\SysWow64\advapi32.dll [640512 2010-11-20] (Microsoft Corporation)
S3 Adobe LM Service; "G:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe" [x]
S4 Alerter; %SystemRoot%\system32\alrsvc.dll [x]
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [x]
S2 BITS; G:\WINDOWS\system32\qmgr.dll [x]
S4 CiSvc; %SystemRoot%\system32\cisvc.exe [x]
S4 ClipSrv; %SystemRoot%\system32\clipsrv.exe [x]
S3 clr_optimization_v2.0.50727_32; G:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [x]
S3 COMSysApp; G:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} [x]
S3 dmadmin; %SystemRoot%\System32\dmadmin.exe /com [x]
S2 dmserver; %SystemRoot%\System32\dmserver.dll [x]
S2 ERSvc; %SystemRoot%\System32\ersvc.dll [x]
S2 Eventlog;  [x]
S3 EventSystem; G:\WINDOWS\system32\es.dll [x]
S3 FontCache3.0.0.0; G:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [x]
S2 gupdate; "G:\Programme\Google\Update\GoogleUpdate.exe" /svc [x]
S2 helpsvc; %WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll [x]
S3 HTTPFilter; %SystemRoot%\System32\w3ssl.dll [x]
S3 idsvc; "G:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" [x]
S3 ImapiService; G:\WINDOWS\system32\imapi.exe [x]
S3 JavaQuickStarterService; "G:\Programme\Java\jre6\bin\jqs.exe" -service -config "G:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf" [x]
S2 LVPrcSrv; "G:\Programme\Gemeinsame Dateien\Logishrd\LVMVFM\LVPrcSrv.exe" [x]
S2 MDM; "G:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe" [x]
S4 Messenger; %SystemRoot%\System32\msgsvc.dll [x]
S3 mnmsrvc; G:\WINDOWS\system32\mnmsrvc.exe [x]
S3 MSDTC; G:\WINDOWS\system32\msdtc.exe [x]
S3 MSIServer; G:\WINDOWS\system32\msiexec.exe /V [x]
S4 NetDDE; %SystemRoot%\system32\netdde.exe [x]
S4 NetDDEdsdm; %SystemRoot%\system32\netdde.exe [x]
S4 NetTcpPortSharing; "G:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" [x]
S3 NtmsSvc; %SystemRoot%\system32\ntmssvc.dll [x]
S2 NVSvc; %SystemRoot%\system32\nvsvc32.exe [x]
S3 RDSessMgr; G:\WINDOWS\system32\sessmgr.exe [x]
S3 RSVP; %SystemRoot%\system32\rsvp.exe [x]
S3 SCardSvr; %SystemRoot%\System32\SCardSvr.exe [x]
S2 srservice; G:\WINDOWS\system32\srsvc.dll [x]
S3 SwPrv; G:\WINDOWS\system32\dllhost.exe /Processid:{B83E1EC8-722E-46A8-B7E8-62813374A376} [x]
S3 SysmonLog; %SystemRoot%\system32\smlogsvc.exe [x]
S4 TlntSvr; G:\WINDOWS\system32\tlntsvr.exe [x]
S3 TuneUp.Defrag; C:\TuneUP2010\TuneUpDefragService.exe [x]
S2 TuneUp.UtilitiesSvc; "C:\TuneUP2010\TuneUpUtilitiesService32.exe" [x]
S3 UPS; %SystemRoot%\System32\ups.exe [x]
S3 W32Time; G:\WINDOWS\system32\w32time.dll [x]
S3 WmdmPmSN; G:\WINDOWS\system32\MsPMSNSv.dll [x]
S3 WmiApSrv; G:\WINDOWS\system32\wbem\wmiapsrv.exe [x]
S3 WMPNetworkSvc; "G:\Programme\Windows Media Player\WMPNetwk.exe" [x]
S2 wuauserv; G:\WINDOWS\system32\wuauserv.dll [x]
S2 WZCSVC; %SystemRoot%\System32\wzcsvc.dll [x]
S3 xmlprov; %SystemRoot%\System32\xmlprov.dll [x]

==================== Drivers (Whitelisted) ====================

S4 Abiosdsk; No ImagePath
S4 abp480n5; No ImagePath
S4 ACPIEC; No ImagePath
S4 adpu160m; No ImagePath
S3 aec; system32\drivers\aec.sys [x]
S4 Aha154x; No ImagePath
S4 aic78u2; No ImagePath
S4 aic78xx; No ImagePath
S4 amsint; No ImagePath
S3 Arp1394; system32\DRIVERS\arp1394.sys [x]
S4 asc; No ImagePath
S4 asc3350p; No ImagePath
S4 asc3550; No ImagePath
S4 Atdisk; No ImagePath
S3 ati2mtag; system32\DRIVERS\ati2mtag.sys [x]
S3 Atmarpc; system32\DRIVERS\atmarpc.sys [x]
S3 audstub; system32\DRIVERS\audstub.sys [x]
S4 cbidf2k; No ImagePath
S3 CCDECODE; system32\DRIVERS\CCDECODE.sys [x]
S4 cd20xrnt; No ImagePath
S1 Cdaudio; No ImagePath
S1 Changer; No ImagePath
S3 cmuda; system32\drivers\cmuda.sys [x]
S4 Cpqarray; No ImagePath
S4 dac2w2k; No ImagePath
S4 dac960nt; No ImagePath
S4 dmboot; System32\drivers\dmboot.sys [x]
S0 dmio; System32\drivers\dmio.sys [x]
S0 dmload; System32\drivers\dmload.sys [x]
S3 DMusic; system32\drivers\DMusic.sys [x]
S4 dpti2o; No ImagePath
S3 FilterService; system32\DRIVERS\lvuvcflt.sys [x]
S1 Fips; No ImagePath
S0 Ftdisk; system32\DRIVERS\ftdisk.sys [x]
S3 gameenum; system32\DRIVERS\gameenum.sys [x]
S3 Gpc; system32\DRIVERS\msgpc.sys [x]
S4 hpn; No ImagePath
S1 i2omgmt; No ImagePath
S4 i2omp; No ImagePath
S1 Imapi; system32\DRIVERS\imapi.sys [x]
S4 ini910u; No ImagePath
S3 Ip6Fw; system32\DRIVERS\Ip6Fw.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S1 IPSec; system32\DRIVERS\ipsec.sys [x]
S3 kmixer; system32\drivers\kmixer.sys [x]
S1 lbrtfdc; No ImagePath
S3 LVMVDrv; system32\DRIVERS\LVMVDrv.sys [x]
S3 lvpopflt; system32\DRIVERS\lvpopflt.sys [x]
S3 LVPr2Mon; system32\DRIVERS\LVPr2Mon.sys [x]
S3 LVUSBSta; system32\drivers\LVUSBSta.sys [x]
S3 LVUVC; system32\DRIVERS\lvuvc.sys [x]
S1 mnmdd; No ImagePath
S4 mraid35x; No ImagePath
S3 ms_mpu401; system32\drivers\msmpu401.sys [x]
S3 NABTSFEC; system32\DRIVERS\NABTSFEC.sys [x]
S3 NdisIP; system32\DRIVERS\NdisIP.sys [x]
S3 NIC1394; system32\DRIVERS\nic1394.sys [x]
S3 nv; system32\DRIVERS\nv4_mini.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S2 ParVdm; No ImagePath
S1 PCIDump; No ImagePath
S3 PDCOMP; No ImagePath
S3 PDFRAME; No ImagePath
S3 PDRELI; No ImagePath
S3 PDRFRAME; No ImagePath
S4 perc2; No ImagePath
S4 perc2hib; No ImagePath
S3 PSched; system32\DRIVERS\psched.sys [x]
S3 Ptilink; system32\DRIVERS\ptilink.sys [x]
S0 PxHelp20; System32\Drivers\PxHelp20.sys [x]
S4 ql1080; No ImagePath
S4 Ql10wnt; No ImagePath
S4 ql12160; No ImagePath
S4 ql1240; No ImagePath
S4 ql1280; No ImagePath
S3 Raspti; system32\DRIVERS\raspti.sys [x]
S1 redbook; system32\DRIVERS\redbook.sys [x]
S4 Simbad; No ImagePath
S3 SISNIC; system32\DRIVERS\sisnic.sys [x]
S3 SLIP; system32\DRIVERS\SLIP.sys [x]
S3 SONYPVU1; system32\DRIVERS\SONYPVU1.SYS [x]
S4 Sparrow; No ImagePath
S3 splitter; system32\drivers\splitter.sys [x]
S0 sr; system32\DRIVERS\sr.sys [x]
S3 streamip; system32\DRIVERS\StreamIP.sys [x]
S3 swmidi; system32\drivers\swmidi.sys [x]
S4 symc810; No ImagePath
S4 symc8xx; No ImagePath
S4 sym_hi; No ImagePath
S4 sym_u3; No ImagePath
S3 sysaudio; system32\drivers\sysaudio.sys [x]
S4 TosIde; No ImagePath
S3 TuneUpUtilitiesDrv; \??\C:\TuneUP2010\TuneUpUtilitiesDriver32.sys [x]
S4 ultra; No ImagePath
S3 Update; system32\DRIVERS\update.sys [x]
S3 usbscan; system32\DRIVERS\usbscan.sys [x]
S3 WDICA; No ImagePath
S3 wdmaud; system32\drivers\wdmaud.sys [x]
S1 WS2IFSL; 
S3 WSTCODEC; system32\DRIVERS\WSTCODEC.SYS [x]

========================== Drivers MD5 =======================

C:\Windows\System32\DRIVERS\ACPI.sys ==> MD5 is legit
C:\Windows\System32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\System32\Drivers\AliIde.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atapi.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\System32\Drivers\CmdIde.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fastfat.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fltMgr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\Drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\IntelIde.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipnat.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\irenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\isapnp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\KSecDD.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\DRIVERS\LHidFilt.Sys 241F2648ADF090E2A10095BD6D6F5DCB
C:\Windows\System32\DRIVERS\LMouFilt.Sys 342ED5A4B3326014438F36D22D803737
C:\Windows\System32\Drivers\Modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MountMgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Mup.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDIS.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PartMgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\DRIVERS\pci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pciide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Pcmcia.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\DRIVERS\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tcpip.sys B62A953F2BF3922C8764A29C34A22899
C:\Windows\System32\Drivers\TDPIPE.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TDTCP.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Udfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\usbaudio.sys 82E8F44688E6FAC57B5B7C6FC7ADBC2A
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\System32\DRIVERS\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\System32\DRIVERS\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ViaIde.sys ==> MD5 is legit
C:\Windows\System32\Drivers\VolSnap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\wudfrd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-05-04 00:14 - 2013-05-04 00:14 - 00000000 ____D C:\FRST
2013-05-03 22:31 - 2013-05-03 22:31 - 03795288 ____A (McAfee, Inc.) C:\Users\HNPC1\Desktop\SecurityScan_Release.exe
2013-05-03 22:31 - 2013-05-03 22:31 - 00002160 ____A C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-05-03 22:31 - 2013-05-03 22:31 - 00000000 ____D C:ProgramData\McAfee Security Scan
2013-05-03 22:31 - 2013-05-03 22:31 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-05-03 22:20 - 2013-05-03 22:20 - 00044544 ____A (Microsoft Corporation) C:ProgramData\rundll32.exe
2013-05-03 21:49 - 2013-05-03 21:49 - 00001130 ____A C:\Users\Public\Desktop\FileASSASSIN.lnk
2013-05-03 21:41 - 2013-05-03 21:41 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\Malwarebytes
2013-05-03 21:40 - 2013-05-03 21:40 - 00001025 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-05-03 21:40 - 2013-05-03 21:40 - 00000000 ____D C:ProgramData\Malwarebytes
2013-05-03 21:40 - 2013-04-04 13:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-05-03 21:39 - 2013-05-03 21:39 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\HNPC1\Desktop\mbam-setup-1.75.0.1300.exe
2013-05-03 21:18 - 2013-05-03 21:36 - 00000000 ____D C:\Windows\6B6C4C461B7E4A419E70ACFBB22B1D81.TMP
2013-05-03 21:18 - 2013-05-03 21:18 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-05-03 21:17 - 2013-05-03 21:17 - 00726464 ____A (Enigma Software Group USA, LLC.) C:\Users\HNPC1\Desktop\SpyHunter-Installer.exe
2013-05-03 21:14 - 2013-05-03 21:36 - 00000000 ____D C:ProgramData\SpeedyPC Software
2013-05-03 21:14 - 2013-05-03 21:14 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\SpeedyPC Software
2013-05-03 21:14 - 2013-05-03 21:14 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\DriverCure
2013-05-03 21:12 - 2013-05-03 21:13 - 05706680 ____A (SpeedyPC Software) C:\Users\HNPC1\Desktop\SpeedyPC Pro Installer.exe
2013-05-03 21:12 - 2013-05-03 21:12 - 00001205 ____A C:\Users\HNPC1\Desktop\FixNCR.reg
2013-05-03 20:50 - 2013-05-03 20:50 - 00013453 ____A C:\AdwCleaner[R1].txt
2013-05-03 20:49 - 2013-05-03 20:49 - 00628743 ____A C:\Users\HNPC1\Desktop\adwcleaner.exe
2013-05-03 20:48 - 2013-05-03 20:48 - 00684480 ____A C:\Users\HNPC1\Desktop\DownloadManagerSetup(1).exe
2013-05-03 20:47 - 2013-05-03 20:47 - 00684480 ____A C:\Users\HNPC1\Desktop\DownloadManagerSetup.exe
2013-05-03 20:47 - 2013-05-03 20:47 - 00001120 ____A C:\Users\HNPC1\Desktop\Continue Mipony Download Manager Installation.lnk
2013-05-03 19:28 - 2013-05-03 19:28 - 00002635 ____A C:ProgramData\dzvoir.js
2013-05-03 13:44 - 2013-05-03 23:08 - 95023320 ___AT C:ProgramData\dzvoir.pad
2013-05-03 13:44 - 2013-05-03 23:08 - 00000000 ____A C:ProgramData\as98213.txt
2013-05-03 13:44 - 2013-05-03 13:44 - 00159744 ____A C:ProgramData\riovzd.dat
2013-05-03 13:44 - 2013-05-03 13:44 - 00000152 ____A C:ProgramData\dzvoir.reg
2013-05-03 13:44 - 2013-05-03 13:44 - 00000056 ____A C:ProgramData\dzvoir.bat
2013-05-03 13:31 - 2013-05-03 21:43 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\WinHost
2013-04-30 19:45 - 2013-04-30 19:45 - 00000000 ____D C:\Users\HNPC1\Documents\CyberLink
2013-04-27 16:16 - 2013-04-27 16:16 - 01769674 ____A C:\Users\HNPC1\Desktop\5012413_20130427_1716_13_attachments.zip
2013-04-27 16:16 - 2013-04-27 16:16 - 00061627 ____A C:\Users\HNPC1\Desktop\5012413_20130427_1716_02_attachments.zip
2013-04-24 07:11 - 2013-04-12 15:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2013-04-11 08:36 - 2013-02-21 11:30 - 01766912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-04-11 08:36 - 2013-02-21 11:30 - 01129984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 14323200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 02046464 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-04-11 08:36 - 2013-02-21 11:29 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-04-11 08:36 - 2013-02-21 11:15 - 02240512 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-04-11 08:36 - 2013-02-21 11:15 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-04-11 08:36 - 2013-02-21 11:14 - 19230208 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-04-11 08:36 - 2013-02-21 11:14 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-04-11 08:36 - 2013-02-19 13:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-04-11 08:36 - 2013-02-19 12:42 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-04-11 08:36 - 2013-02-19 12:10 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-04-11 08:36 - 2013-02-19 11:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-04-11 07:30 - 2013-04-11 07:30 - 01443770 ____A C:\Users\HNPC1\Desktop\documents.zip
2013-04-11 07:26 - 2013-03-01 04:36 - 03153408 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-04-11 07:25 - 2013-03-19 07:04 - 05550424 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-04-11 07:25 - 2013-03-19 06:46 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2013-04-11 07:25 - 2013-03-19 06:04 - 03968856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-04-11 07:25 - 2013-03-19 06:04 - 03913560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-04-11 07:25 - 2013-03-19 05:47 - 00006656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-04-11 07:25 - 2013-03-19 04:06 - 00112640 ____A (Microsoft Corporation) C:\Windows\System32\smss.exe
2013-04-11 07:25 - 2013-01-24 07:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys
2013-04-07 21:14 - 2013-04-12 16:23 - 00000000 ____D C:\Users\HNPC1\Desktop\Vater

==================== One Month Modified Files and Folders =======

2013-05-04 00:14 - 2013-05-04 00:14 - 00000000 ____D C:\FRST
2013-05-03 23:08 - 2013-05-03 13:44 - 95023320 ___AT C:ProgramData\dzvoir.pad
2013-05-03 23:08 - 2013-05-03 13:44 - 00000000 ____A C:ProgramData\as98213.txt
2013-05-03 23:08 - 2010-10-02 22:51 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-03 23:06 - 2012-12-29 20:53 - 00012075 ____A C:\Windows\setupact.log
2013-05-03 23:06 - 2011-12-21 17:24 - 00092887 ____A C:\aaw7boot.log
2013-05-03 23:06 - 2009-07-14 06:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-05-03 22:49 - 2009-07-14 18:58 - 00657660 ____A C:\Windows\System32\perfh007.dat
2013-05-03 22:49 - 2009-07-14 18:58 - 00131032 ____A C:\Windows\System32\perfc007.dat
2013-05-03 22:49 - 2009-07-14 06:13 - 01507342 ____A C:\Windows\System32\PerfStringBackup.INI
2013-05-03 22:31 - 2013-05-03 22:31 - 03795288 ____A (McAfee, Inc.) C:\Users\HNPC1\Desktop\SecurityScan_Release.exe
2013-05-03 22:31 - 2013-05-03 22:31 - 00002160 ____A C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-05-03 22:31 - 2013-05-03 22:31 - 00000000 ____D C:ProgramData\McAfee Security Scan
2013-05-03 22:31 - 2013-05-03 22:31 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-05-03 22:20 - 2013-05-03 22:20 - 00044544 ____A (Microsoft Corporation) C:ProgramData\rundll32.exe
2013-05-03 21:49 - 2013-05-03 21:49 - 00001130 ____A C:\Users\Public\Desktop\FileASSASSIN.lnk
2013-05-03 21:44 - 2012-12-29 20:53 - 00137790 ____A C:\Windows\PFRO.log
2013-05-03 21:43 - 2013-05-03 13:31 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\WinHost
2013-05-03 21:41 - 2013-05-03 21:41 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\Malwarebytes
2013-05-03 21:40 - 2013-05-03 21:40 - 00001025 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-05-03 21:40 - 2013-05-03 21:40 - 00000000 ____D C:ProgramData\Malwarebytes
2013-05-03 21:40 - 2010-10-02 16:44 - 00000000 ____D C:\Programme (neu)
2013-05-03 21:39 - 2013-05-03 21:39 - 10285040 ____A (Malwarebytes Corporation                                    ) C:\Users\HNPC1\Desktop\mbam-setup-1.75.0.1300.exe
2013-05-03 21:36 - 2013-05-03 21:18 - 00000000 ____D C:\Windows\6B6C4C461B7E4A419E70ACFBB22B1D81.TMP
2013-05-03 21:36 - 2013-05-03 21:14 - 00000000 ____D C:ProgramData\SpeedyPC Software
2013-05-03 21:36 - 2010-10-02 19:23 - 00000000 ____D C:\Windows\System32\appmgmt
2013-05-03 21:18 - 2013-05-03 21:18 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-05-03 21:17 - 2013-05-03 21:17 - 00726464 ____A (Enigma Software Group USA, LLC.) C:\Users\HNPC1\Desktop\SpyHunter-Installer.exe
2013-05-03 21:14 - 2013-05-03 21:14 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\SpeedyPC Software
2013-05-03 21:14 - 2013-05-03 21:14 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\DriverCure
2013-05-03 21:13 - 2013-05-03 21:12 - 05706680 ____A (SpeedyPC Software) C:\Users\HNPC1\Desktop\SpeedyPC Pro Installer.exe
2013-05-03 21:12 - 2013-05-03 21:12 - 00001205 ____A C:\Users\HNPC1\Desktop\FixNCR.reg
2013-05-03 20:50 - 2013-05-03 20:50 - 00013453 ____A C:\AdwCleaner[R1].txt
2013-05-03 20:49 - 2013-05-03 20:49 - 00628743 ____A C:\Users\HNPC1\Desktop\adwcleaner.exe
2013-05-03 20:48 - 2013-05-03 20:48 - 00684480 ____A C:\Users\HNPC1\Desktop\DownloadManagerSetup(1).exe
2013-05-03 20:47 - 2013-05-03 20:47 - 00684480 ____A C:\Users\HNPC1\Desktop\DownloadManagerSetup.exe
2013-05-03 20:47 - 2013-05-03 20:47 - 00001120 ____A C:\Users\HNPC1\Desktop\Continue Mipony Download Manager Installation.lnk
2013-05-03 20:06 - 2011-12-21 08:50 - 00000064 ____A C:\Windows\SysWOW64\rp_stats.dat
2013-05-03 20:06 - 2011-12-21 08:50 - 00000044 ____A C:\Windows\SysWOW64\rp_rules.dat
2013-05-03 19:28 - 2013-05-03 19:28 - 00002635 ____A C:ProgramData\dzvoir.js
2013-05-03 15:08 - 2009-08-19 12:46 - 01718124 ____A C:\Windows\WindowsUpdate.log
2013-05-03 15:08 - 2009-07-14 05:45 - 00010256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-05-03 15:08 - 2009-07-14 05:45 - 00010256 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-05-03 15:00 - 2012-12-29 20:32 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-03 14:39 - 2010-10-02 22:51 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-03 13:44 - 2013-05-03 13:44 - 00159744 ____A C:ProgramData\riovzd.dat
2013-05-03 13:44 - 2013-05-03 13:44 - 00000152 ____A C:ProgramData\dzvoir.reg
2013-05-03 13:44 - 2013-05-03 13:44 - 00000056 ____A C:ProgramData\dzvoir.bat
2013-05-02 19:45 - 2013-01-08 19:26 - 00000000 ____D C:\Users\HNPC1\Documents\Outlook-Dateien
2013-05-02 19:44 - 2011-11-15 22:36 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-04-30 19:45 - 2013-04-30 19:45 - 00000000 ____D C:\Users\HNPC1\Documents\CyberLink
2013-04-28 15:53 - 2013-01-05 16:25 - 00000000 ____D C:\Users\HNPC1\AppData\Roaming\HpUpdate
2013-04-28 15:33 - 2012-11-17 23:27 - 00000000 ____D C:\Users\HNPC1\Desktop\Malediven
2013-04-27 16:16 - 2013-04-27 16:16 - 01769674 ____A C:\Users\HNPC1\Desktop\5012413_20130427_1716_13_attachments.zip
2013-04-27 16:16 - 2013-04-27 16:16 - 00061627 ____A C:\Users\HNPC1\Desktop\5012413_20130427_1716_02_attachments.zip
2013-04-24 07:10 - 2013-01-01 13:06 - 00000000 ____D C:\Users\HNPC1\Desktop\CKW
2013-04-21 20:19 - 2013-01-23 21:06 - 00000000 ____D C:\Users\HNPC1\Desktop\Ant
2013-04-15 19:37 - 2012-07-05 20:22 - 00000000 ____D C:\Users\HNPC1\Desktop\Sansan
2013-04-12 16:23 - 2013-04-07 21:14 - 00000000 ____D C:\Users\HNPC1\Desktop\Vater
2013-04-12 15:45 - 2013-04-24 07:11 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2013-04-12 15:12 - 2012-12-29 20:32 - 00691592 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-04-12 15:12 - 2012-12-29 20:11 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-04-12 15:12 - 2010-10-02 17:52 - 00000000 ____D C:ProgramData\Adobe
2013-04-12 14:59 - 2012-12-29 20:53 - 03030032 ____A C:\Windows\System32\FNTCACHE.DAT
2013-04-11 08:37 - 2010-10-06 17:52 - 00000000 ____D C:ProgramData\Microsoft Help
2013-04-11 08:37 - 2010-10-02 01:06 - 72702784 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-04-11 07:37 - 2011-09-25 17:53 - 00000000 ____D C:\Users\HNPC1\Desktop\SBB
2013-04-11 07:30 - 2013-04-11 07:30 - 01443770 ____A C:\Users\HNPC1\Desktop\documents.zip
2013-04-11 07:26 - 2011-09-18 14:42 - 00000000 ____D C:\Users\HNPC1\Desktop\Swisscom
2013-04-07 21:14 - 2013-03-27 21:41 - 00000000 ____D C:\Users\HNPC1\Desktop\Thailand
2013-04-07 20:02 - 2012-12-29 21:08 - 00019938 ____A C:\Windows\IE10_main.log
2013-04-04 13:50 - 2013-05-03 21:40 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

Other Malware:
===========
C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\msconfig.lnk

==================== Known DLLs (Whitelisted) ================

C:\Windows\System32\olecli32.dll IS MISSING <==== ATTENTION!
[2009-07-14 00:44] - [2009-07-14 02:16] - 0080384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\olecli32.dll
C:\Windows\System32\olecnv32.dll IS MISSING <==== ATTENTION!
C:\Windows\SysWOW64\olecnv32.dll IS MISSING <==== ATTENTION!
C:\Windows\System32\olesvr32.dll IS MISSING <==== ATTENTION!
[2009-07-14 00:43] - [2009-07-14 02:16] - 0028672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\olesvr32.dll
C:\Windows\System32\olethk32.dll IS MISSING <==== ATTENTION!
[2011-05-02 09:06] - [2010-11-20 13:20] - 0077824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\olethk32.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================


==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {default}
resumeobject            {fd5a51a0-cdbd-11df-8573-f58f51f0d469}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 3

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {fd5a51a0-cdbd-11df-8573-f58f51f0d469}
nx                      OptIn
detecthal               Yes

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[C:]\Recovery\fd5a51a2-cdbd-11df-8573-f58f51f0d469\Winre.wim,{fd5a51a3-cdbd-11df-8573-f58f51f0d469}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\fd5a51a2-cdbd-11df-8573-f58f51f0d469\Winre.wim,{fd5a51a3-cdbd-11df-8573-f58f51f0d469}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {fd5a51a0-cdbd-11df-8573-f58f51f0d469}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {fd5a51a3-cdbd-11df-8573-f58f51f0d469}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\fd5a51a2-cdbd-11df-8573-f58f51f0d469\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 3831.49 MB
Available physical RAM: 3172.82 MB
Total Pagefile: 3829.64 MB
Available Pagefile: 3188.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (WinPro) (Fixed) (Total:111.79 GB) (Free:37.45 GB) NTFS (Disk=3 Partition=1) ==>[Drive with boot components (obtained from BCD)]
Drive e: ((XP) Programme ) (Fixed) (Total:29.29 GB) (Free:21.36 GB) NTFS (Disk=2 Partition=1)
Drive g: ((XP) Dateien II ) (Fixed) (Total:95.33 GB) (Free:59.81 GB) NTFS (Disk=1 Partition=2)
Drive h: ((XP) Dateien ) (Fixed) (Total:82.49 GB) (Free:64.61 GB) NTFS (Disk=2 Partition=2)
Drive i: (Dateien (I)) (Fixed) (Total:440.2 GB) (Free:377.08 GB) NTFS (Disk=0 Partition=2)
Drive j: (Dateien (II)) (Fixed) (Total:491.21 GB) (Free:444.1 GB) NTFS (Disk=0 Partition=3)
Drive r: () (Removable) (Total:3.8 GB) (Free:3.8 GB) FAT32 (Disk=9 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.08 GB) NTFS (Disk=0 Partition=1)

  Datentr„ger ###  Status         Gr”áe    Frei     Dyn  GPT
  ---------------  -------------  -------  -------  ---  ---
  Datentr„ger 0    Online          931 GB      0 B         
  Datentr„ger 1    Online          149 GB     8 MB         
  Datentr„ger 2    Online          111 GB     8 MB         
  Datentr„ger 3    Online          111 GB      0 B         
  Datentr„ger 4    Kein Medium        0 B      0 B         
  Datentr„ger 5    Kein Medium        0 B      0 B         
  Datentr„ger 6    Kein Medium        0 B      0 B         
  Datentr„ger 7    Kein Medium        0 B      0 B         
  Datentr„ger 8    Kein Medium        0 B      0 B         
  Datentr„ger 9    Online         3900 MB      0 B         

Partitions of Disk 0:
===============

Datentr„ger-ID: 71ED8D7B

  Partition ###  Typ               Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r             100 MB  1024 KB
  Partition 2    Prim„r             440 GB   101 MB
  Partition 3    Prim„r             491 GB   440 GB

==================================================================================

Disk: 0
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Ja

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 2     Y   System-rese  NTFS   Partition    100 MB  Fehlerfre          

=========================================================

Disk: 0
Partition 2
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 3     I   Dateien (I)  NTFS   Partition    440 GB  Fehlerfre          

=========================================================

Disk: 0
Partition 3
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 4     J   Dateien (II  NTFS   Partition    491 GB  Fehlerfre          

=========================================================

Partitions of Disk 1:
===============

Datentr„ger-ID: 18B918B8

  Partition ###  Typ               Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r              53 GB    31 KB
  Partition 0    Erweitert           95 GB    53 GB
  Partition 2    Logisch             95 GB    53 GB

==================================================================================

Disk: 1
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Ja

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 5         (XP) Window  NTFS   Partition     53 GB  Fehlerfre          

=========================================================

Disk: 1
Partition 2
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 6     G   (XP) Dateie  NTFS   Partition     95 GB  Fehlerfre          

=========================================================

Partitions of Disk 2:
===============

Datentr„ger-ID: F681F681

  Partition ###  Typ               Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r              29 GB    31 KB
  Partition 0    Erweitert           82 GB    29 GB
  Partition 2    Logisch             82 GB    29 GB

==================================================================================

Disk: 2
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 7     E   (XP) Progra  NTFS   Partition     29 GB  Fehlerfre          

=========================================================

Disk: 2
Partition 2
Typ      : 07
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 8     H   (XP) Dateie  NTFS   Partition     82 GB  Fehlerfre          

=========================================================

Partitions of Disk 3:
===============

Datentr„ger-ID: E9A523B4

  Partition ###  Typ               Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r             111 GB  1024 KB

==================================================================================

Disk: 3
Partition 1
Typ      : 07
Versteckt: Nein
Aktiv    : Ja

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 9     C   WinPro       NTFS   Partition    111 GB  Fehlerfre          

=========================================================

Partitions of Disk 9:
===============

Datentr„ger-ID: 00000000

  Partition ###  Typ               Gr”áe    Offset
  -------------  ----------------  -------  -------
  Partition 1    Prim„r            3899 MB   380 KB

==================================================================================

Disk: 9
Partition 1
Typ      : 0B
Versteckt: Nein
Aktiv    : Nein

  Volume ###  Bst  Bezeichnung  DS     Typ         Gr”áe    Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
* Volume 15    R                FAT32  Wechselmed  3899 MB  Fehlerfre          

=========================================================
============================== MBR & Partition Table ==================

====================================================================
Disk: 0 (Size: 932 GB) (Disk ID: 71ED8D7B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=440 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=491 GB) - (Type=07 NTFS)

====================================================================
Disk: 1 (Size: 149 GB) (Disk ID: 18B918B8)
Partition 1: (Active) - (Size=54 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=95 GB) - (Type=OF Extended)

====================================================================
Disk: 2 (Size: 112 GB) (Disk ID: F681F681)
Partition 1: (Not Active) - (Size=29 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=82 GB) - (Type=OF Extended)

====================================================================
Disk: 3 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: E9A523B4)
Partition 1: (Active) - (Size=112 GB) - (Type=07 NTFS)

====================================================================
Disk: 9 (Size: 4 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)


Last Boot: 2013-04-22 07:45

==================== End Of Log ============================

t'john · 04.05.2013, 09:00

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Code:

ATTFilter

HKLM\...\Run: [Ocs_SM] C:\Users\****\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2011-08-31] (OCS) 
HKU\HNPC1\...\Run: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\riovzd.dat,FG00 [159744 2013-05-03] () 
C:\PROGRA~3\rundll32.exe
C:\PROGRA~3\riovzd.dat
Startup: C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk 
C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk
C:ProgramData\rundll32.exe 
C:\Users\HNPC1\Desktop\SpeedyPC Pro Installer.exe 
C:ProgramData\dzvoir.pad 
C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\msconfig.lnk

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

dann:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

dann:

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

knax · 04.05.2013, 16:50

Hallo t'john

Vielen Dank für deine kurzfristige Unterstüzung, Hilfe und Support.

Ich habe die Aktionen der Reihe nach ausgeführt und folgende Logfiles erhalten.

Farbar Recovery Scan Tool:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-05-2013
Ran by SYSTEM at 2013-05-04 16:57:39 Run:1
Running from R:\
Boot Mode: Recovery
==============================================

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Ocs_SM => Value deleted successfully.
HKEY_USERS\HNPC1\Software\Microsoft\Windows\CurrentVersion\Run\\ctfmon.exe => Value not found.
C:\PROGRA~3\rundll32.exe => Moved successfully.
C:\PROGRA~3\riovzd.dat => Moved successfully.
C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk  => Moved successfully.
C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msconfig.lnk => File/Directory not found.
C:\Users\HNPC1\Desktop\SpeedyPC Pro Installer.exe  => Moved successfully.
C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\msconfig.lnk => File/Directory not found.

==== End of Fixlog ====

Malwareybytes Anti-Malware:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.03.08

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 10.0.9200.16540
HNPC1 :: HNPC1-PC [Administrator]

Schutz: Deaktiviert

04.05.2013 17:06:14
mbam-log-2013-05-04 (17-06-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 446517
Laufzeit: 17 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent) -> Daten: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\riovzd.dat,FG00 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

adwcleaner:

Code:

ATTFilter

# AdwCleaner v2.300 - Datei am 04/05/2013 um 17:28:32 erstellt
# Aktualisiert am 28/04/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : HNPC1 - HNPC1-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\HNPC1\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : SearchAnonymizer

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk
Datei Gelöscht : C:\Users\HNPC1\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\Uninstall.exe
Datei Gelöscht : C:\Users\HNPC1\searchplugins\Babylon.xml
Ordner Gelöscht : C:\Program Files (x86)\adawaretb
Ordner Gelöscht : C:\Program Files (x86)\Claro LTD
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\DeviceVM
Ordner Gelöscht : C:\Program Files (x86)\softonic-de3
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\HNPC1\AppData\Local\Ilivid
Ordner Gelöscht : C:\Users\HNPC1\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\HNPC1\AppData\LocalLow\adawaretb
Ordner Gelöscht : C:\Users\HNPC1\AppData\LocalLow\Claro LTD
Ordner Gelöscht : C:\Users\HNPC1\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\HNPC1\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\HNPC1\AppData\LocalLow\softonic-de3
Ordner Gelöscht : C:\Users\HNPC1\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\HNPC1\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\HNPC1\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\HNPC1\AppData\Roaming\SenselessTV

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\softonic-de3
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\Claro LTD
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{991D97B8-F0D8-4EA1-9100-7A65EA2D3A63}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{991D97B8-F0D8-4EA1-9100-7A65EA2D3A63}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Claro LTD
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CCC3E766-7BA9-4629-AC1A-7F4B7F362E65}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\claro.claroappCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\claro.claroappCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\claro.clarodskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\claro.clarodskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\claro.claroHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\claro.claroHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.claroESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.claroESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2431245
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A903AC15-686E-4D67-A355-86FCBE9F60DA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{CCC3E766-7BA9-4629-AC1A-7F4B7F362E65}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{188F28B4-7FA0-48C0-BA54-0058B8FD9EF7}
Schlüssel Gelöscht : HKLM\Software\softonic-de3
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{05340575-7D2A-4266-9A84-7EEBDC476884}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{188F28B4-7FA0-48C0-BA54-0058B8FD9EF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97C47A30-3CFB-474B-94E3-6019A7EE0610}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{991D97B8-F0D8-4EA1-9100-7A65EA2D3A63}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9E131A93-EED7-4BEB-B015-A0ADB30B5646}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EE4FC43F-84CE-4E20-88C2-2188525B47FB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F398D871-ED00-42A8-BEAA-0209E9E59FCC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{16466D47-74A8-4928-B8B2-07CD79ABFC9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{26D5CC0A-7A46-4D86-AF45-2EFA320B0C54}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2D13AC8F-037E-40C5-ADA6-231BA74EA2F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{322EDCF5-9E7D-4021-8C67-F3FFE4961A38}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3E254398-828F-4D51-A39E-3F6B6D96A12C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{442DAF0C-7EAD-48D9-ABEA-E0036470D6D5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{58EB187D-24F8-4423-BD6C-655CE4C416BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6BEB066C-A791-4A21-B934-7783533FE888}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A07612DF-B1DD-484F-A1C3-36CA4CE919D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A76F97B2-2C56-456A-A29E-72741595C2E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B19D9D96-E59C-4936-B283-8A831CDB3A53}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC8AAABA-3F8B-4866-8B3A-D9368133A478}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E15519AE-99BE-42DD-BE60-FFC3C183F443}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jlicihemmeabfjhdckhpkmopojohlkab
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{60295942-9E5F-4EE8-B785-3A655904D24F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000F18F2-09EB-4A59-82B2-5AE4184C39C3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{991D97B8-F0D8-4EA1-9100-7A65EA2D3A63}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\claro
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ilivid
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Senseless.TV Video Plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\softonic-de3 Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{16466D47-74A8-4928-B8B2-07CD79ABFC9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{26D5CC0A-7A46-4D86-AF45-2EFA320B0C54}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2D13AC8F-037E-40C5-ADA6-231BA74EA2F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{322EDCF5-9E7D-4021-8C67-F3FFE4961A38}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3E254398-828F-4D51-A39E-3F6B6D96A12C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{442DAF0C-7EAD-48D9-ABEA-E0036470D6D5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{58EB187D-24F8-4423-BD6C-655CE4C416BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6BEB066C-A791-4A21-B934-7783533FE888}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A07612DF-B1DD-484F-A1C3-36CA4CE919D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A76F97B2-2C56-456A-A29E-72741595C2E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B19D9D96-E59C-4936-B283-8A831CDB3A53}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC8AAABA-3F8B-4866-8B3A-D9368133A478}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E15519AE-99BE-42DD-BE60-FFC3C183F443}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [support@Senseless.TV]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [support@Senseless.TV]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{9E131A93-EED7-4BEB-B015-A0ADB30B5646}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v17.0.1 (de)

Datei : C:\Users\HNPC1\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\prefs.js

C:\Users\HNPC1\AppData\Roaming\Mozilla\Firefox\Profiles\JonDoFox\user.js ... Gelöscht !

Gelöscht : user_pref("pttl.menu-search-groups-tab", false);
Gelöscht : user_pref("pttl.menu-search-groups-win", false);

Datei : C:\Users\HNPC1\AppData\Roaming\Mozilla\Firefox\Profiles\p633c3e1.default-1356808552607\prefs.js

C:\Users\HNPC1\AppData\Roaming\Mozilla\Firefox\Profiles\p633c3e1.default-1356808552607\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [13453 octets] - [03/05/2013 21:50:20]
AdwCleaner[S1].txt - [13199 octets] - [04/05/2013 17:28:32]

########## EOF - C:\AdwCleaner[S1].txt - [13260 octets] ##########

Der Sperrbildschirm ist weg und Mc Afee arbeitet auch wieder korrekt.

next steps?

Herzlichen Danke und Gruss
knax

t'john · 04.05.2013, 19:49

Sehr gut!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

danach:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

danach:

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

knax · 05.05.2013, 14:10

Hallo t'john

...das säubern funktioniert sehr gut mit deiner Hilfe und Anleitung. Besten Dank dafür.

Hier das aswMBR text file:

Code:

ATTFilter

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-05 11:33:05
-----------------------------
11:33:05.454    OS Version: Windows x64 6.1.7601 Service Pack 1
11:33:05.454    Number of processors: 4 586 0x2502
11:33:05.454    ComputerName: HNPC1-PC  UserName: HNPC1
11:33:05.625    Initialize success
11:33:12.708    AVAST engine defs: 13050500
11:33:28.386    Disk 0  \Device\Harddisk0\DR0 -> \Device\Scsi\JRAID1Port0Path0Target0Lun0
11:33:28.386    Disk 0 Vendor: WDC_____ 850. Size: 152627MB BusType: 8
11:33:28.386    Disk 1  \Device\Harddisk1\DR1 -> \Device\Scsi\JRAID1Port0Path0Target1Lun0
11:33:28.386    Disk 1 Vendor: ________ .360 Size: 114473MB BusType: 8
11:33:28.386    Disk 2 (boot) \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP0T0L0-0
11:33:28.386    Disk 2 Vendor: Corsair_CSSD-F120GB2 1.1 Size: 114473MB BusType: 3
11:33:28.386    Disk 3  \Device\Harddisk3\DR3 -> \Device\Ide\IdeDeviceP1T0L0-1
11:33:28.386    Disk 3 Vendor: SAMSUNG_HD103SJ 1AJ10001 Size: 953869MB BusType: 3
11:33:28.401    Disk 2 MBR read successfully
11:33:28.401    Disk 2 MBR scan
11:33:28.401    Disk 2 Windows 7 default MBR code
11:33:28.401    Disk 2 Partition 1 80 (A) 07    HPFS/NTFS NTFS       114471 MB offset 2048
11:33:28.417    Disk 2 scanning C:\Windows\system32\drivers
11:33:34.204    Service scanning
11:33:44.438    Modules scanning
11:33:44.438    Disk 2 trace - called modules:
11:33:44.438    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys 
11:33:44.438    1 nt!IofCallDriver -> \Device\Harddisk2\DR2[0xfffffa8004615060]
11:33:44.438    3 CLASSPNP.SYS[fffff88001a7a43f] -> nt!IofCallDriver -> [0xfffffa800437a520]
11:33:44.438    5 ACPI.sys[fffff88000f027a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800435c060]
11:33:44.438    Scan finished successfully
11:36:46.098    Disk 2 MBR has been saved successfully to "R:\MBR.dat"
11:36:46.098    The log file has been saved successfully to "R:\aswMBR.txt"

Das Programm ist beim ersten Versuch abgestürzt und hatte folgendes hinterlegt:

Code:

ATTFilter

Problemsignatur:
  Problemereignisname:	APPCRASH
  Anwendungsname:	aswMBR.exe
  Anwendungsversion:	0.9.9.1771
  Anwendungszeitstempel:	5147644e
  Fehlermodulname:	ntdll.dll
  Fehlermodulversion:	6.1.7601.17725
  Fehlermodulzeitstempel:	4ec49b8f
  Ausnahmecode:	c0000005
  Ausnahmeoffset:	0002e3be
  Betriebsystemversion:	6.1.7601.2.1.0.256.48
  Gebietsschema-ID:	2055
  Zusatzinformation 1:	0a9e
  Zusatzinformation 2:	0a9e372d3b4ad19135b953a78882e789
  Zusatzinformation 3:	0a9e
  Zusatzinformation 4:	0a9e372d3b4ad19135b953a78882e789

Lesen Sie unsere Datenschutzbestimmungen online:
  hxxp://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0407

Wenn die Onlinedatenschutzbestimmungen nicht verfügbar sind, lesen Sie unsere Datenschutzbestimmungen offline:
  C:\Windows\system32\de-DE\erofflps.txt

Nach einstellen von AV Scan (none) lief's ohne Probleme.

Der Eset Online Scanner hat folgendes notiert:
Gefundene threats...

Code:

ATTFilter

C:\FRST\Quarantine\msconfig.lnk	Win32/Reveton.M trojan
C:\FRST\Quarantine\riovzd.dat	a variant of Win32/Kryptik.BADU trojan
C:\ProgramData\dzvoir.bat	Win32/Reveton.M trojan
C:\Users\All Users\dzvoir.bat	Win32/Reveton.M trojan
C:\Users\HNPC1\AppData\Local\Temp\DCdJOya.exe	a variant of Win32/Kryptik.BADU trojan
C:\Users\HNPC1\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\733f1a11-4fb8ecca	multiple threats
C:\Users\HNPC1\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\1582a868-3394f31a	Java/Exploit.Agent.OBL trojan

und das zugehörige Logfile:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ee6d0a6d3aec944c81513b2a9a7a937e
# engine=13757
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-05 12:06:38
# local_time=2013-05-05 02:06:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Switzerland"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5122 16777213 100 90 163817 116538194 0 0
# compatibility_mode=5893 16776574 100 94 63429255 119385448 0 0
# scanned=333901
# found=7
# cleaned=0
# scan_time=8667
sh=1D329DA35FC6C2967886D67CED9FF1EB5C96D7E8 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\FRST\Quarantine\msconfig.lnk"
sh=896A97AE00CDE53364D277777168465CFCAFDE16 ft=1 fh=0314a0b0e642c6b2 vn="a variant of Win32/Kryptik.BADU trojan" ac=I fn="C:\FRST\Quarantine\riovzd.dat"
sh=6C899AC80490696851648EF1D44DD380AB301998 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\ProgramData\dzvoir.bat"
sh=6C899AC80490696851648EF1D44DD380AB301998 ft=0 fh=0000000000000000 vn="Win32/Reveton.M trojan" ac=I fn="C:\Users\All Users\dzvoir.bat"
sh=896A97AE00CDE53364D277777168465CFCAFDE16 ft=1 fh=0314a0b0e642c6b2 vn="a variant of Win32/Kryptik.BADU trojan" ac=I fn="C:\Users\HNPC1\AppData\Local\Temp\DCdJOya.exe"
sh=C6B7831DA8C149B6C6E89A5ECCAAEBB5BA79F43E ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\HNPC1\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\733f1a11-4fb8ecca"
sh=F7C631B31E5837CA4227437735DBF6C4C7B453D4 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.OBL trojan" ac=I fn="C:\Users\HNPC1\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\1582a868-3394f31a"

Der Security Check brachte folgendes Ergebnis:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.63  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 9  
``````````````Antivirus/Firewall Check:`````````````` 
McAfee  Anti-Virus und Anti-Spyware   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Ad-Aware 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 TuneUp Utilities 2013   
 TuneUp Utilities Language Pack (de-DE) 
 TuneUp Utilities 2013   
 TuneUp Utilities Language Pack (de-DE) 
 Java 7 Update 17  
 Java version out of Date! 
 Adobe Flash Player 11.7.700.169  
 Adobe Reader 9  
 Adobe Reader XI  
 Mozilla Firefox 17.0.1 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Ad-Aware AAWService.exe 
 Ad-Aware AAWTray.exe 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Maleware Malwarebytes' Anti-Malware mbamscheduler.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Firefox hatte ich kürzlich mit der Version 20.0.1 aktualisiert.
Er zeigt es unter "über firefox" an Warum er hier als 17 angezeigt wird???

Merci für das weitere Vorgehen...

Gruss knax

t'john · 05.05.2013, 14:26

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

:OTL
:Files
C:\ProgramData\dzvoir.bat
C:\Users\All Users\dzvoir.bat
C:\Users\HNPC1\AppData\Local\Temp\DCdJOya.exe

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

dann:

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die .exe-Datei
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 21 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: http://tools.trojaner-board.de/plugincheck.html

Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: http://tools.trojaner-board.de/plugincheck.html

Hinweis: Registry Cleaner

Ich sehe, dass du sogenannte Registry Cleaner installiert hast.
In deinem Fall TuneUp Utilities 2013, TuneUp Utilities Language Pack (de-DE).

Wir raten von der Verwendung jeglicher Art von Registry Cleaner ab.

Der Grund ist ganz einfach:
Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Man sollte nicht unnötigerweise an der Registry rumbasteln. Schon ein kleiner Fehler kann gravierende Folgen haben und auch Programme machen manchmal Fehler.
Zerstörst du die Registry, zerstörst du Windows.

Zudem ist der Nutzen zur Performancesteigerung umstritten und meist kaum im wahrnehmbaren Bereich.

Ich würde dir empfehlen, Registry Cleaner nicht weiterhin zu verwenden und über

Start --> Systemsteuerung --> Software (bei Windows XP)
Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Win 7)

zu deinstallieren.

knax · 05.05.2013, 19:12

Hallo t'john

Merci für deine schnelle Rückmeldung.

Die einzelnen Schritte habe ich soweit durchgeführt...
OTL files:

Code:

ATTFilter

========== OTL ==========
========== FILES ==========
C:\ProgramData\dzvoir.bat moved successfully.
File\Folder C:\Users\All Users\dzvoir.bat not found.
C:\Users\HNPC1\AppData\Local\Temp\DCdJOya.exe moved successfully.
 
OTL by OldTimer - Version 3.2.69.0 log created on 05052013_193343

OTL text:

Code:

ATTFilter

OTL logfile created on: 05.05.2013 19:20:59 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\HNPC1\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
3.74 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 51.75% Memory free
7.48 Gb Paging File | 5.25 Gb Available in Paging File | 70.19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111.79 Gb Total Space | 37.32 Gb Free Space | 33.39% Space Free | Partition Type: NTFS
Drive D: | 100.00 Mb Total Space | 84.71 Mb Free Space | 84.71% Space Free | Partition Type: NTFS
Drive E: | 440.20 Gb Total Space | 377.08 Gb Free Space | 85.66% Space Free | Partition Type: NTFS
Drive F: | 491.21 Gb Total Space | 444.10 Gb Free Space | 90.41% Space Free | Partition Type: NTFS
Drive H: | 53.71 Gb Total Space | 45.95 Gb Free Space | 85.54% Space Free | Partition Type: NTFS
Drive I: | 95.33 Gb Total Space | 59.81 Gb Free Space | 62.75% Space Free | Partition Type: NTFS
Drive J: | 29.29 Gb Total Space | 21.36 Gb Free Space | 72.93% Space Free | Partition Type: NTFS
Drive K: | 82.49 Gb Total Space | 64.61 Gb Free Space | 78.33% Space Free | Partition Type: NTFS
 
Computer Name: HNPC1-PC | User Name: HNPC1 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\HNPC1\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme (neu)\Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme (neu)\Maleware\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme (neu)\Maleware\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme (neu)\Maleware\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Google\Update\1.3.21.135\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Programme (neu)\MS Office 2010 Professional\Office14\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Programme (neu)\Adaware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Programme (neu)\Adaware\AAWService.exe (Lavasoft Limited)
PRC - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
PRC - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
PRC - C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe ()
PRC - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\LWS.exe (Logitech Inc.)
PRC - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\CameraHelperShell.exe ()
PRC - C:\Windows\SysWOW64\XSrvSetup.exe ()
PRC - C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme (neu)\Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll ()
MOD - C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe ()
MOD - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\CameraHelperShell.exe ()
MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Programme (neu)\MS Office 2010 Professional\Office14\ADDINS\UmOutlookAddin.dll ()
MOD - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\ImageFormats\QJpeg4.dll ()
MOD - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\ImageFormats\QGif4.dll ()
MOD - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\QTXml4.dll ()
MOD - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\QTGui4.dll ()
MOD - C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\QTCore4.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (mfevtp) -- C:\Windows\SysNative\mfevtps.exe (McAfee, Inc.)
SRV:64bit: - (mfefire) -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV:64bit: - (McShield) -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (MSK80Service) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McProxy) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McNASvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McNaiAnn) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (mcmscsvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McMPFSvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McAfee SiteAdvisor Service) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (AppleChargerSrv) -- C:\Windows\SysNative\AppleChargerSrv.exe ()
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Programme (neu)\Maleware\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Programme (neu)\Maleware\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe (McAfee, Inc.)
SRV - (TuneUp.UtilitiesSvc) -- C:\Programme (neu)\TuneUp\2013\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (McODS) -- C:\Programme\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme (neu)\MS Office 2010 Professional\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (Lavasoft Ad-Aware Service) -- C:\Programme (neu)\Adaware\AAWService.exe (Lavasoft Limited)
SRV - (UMVPFSrv) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (LBTServ) -- C:\Programme\Common Files\logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (FLEXnet Licensing Service 64) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (JMB36X) -- C:\Windows\SysWOW64\XSrvSetup.exe ()
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (Smart TimeLock) -- C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe (Gigabyte Technology CO., LTD.)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (cfwids) -- C:\Windows\SysNative\drivers\cfwids.sys (McAfee, Inc.)
DRV:64bit: - (mfewfpk) -- C:\Windows\SysNative\drivers\mfewfpk.sys (McAfee, Inc.)
DRV:64bit: - (mferkdet) -- C:\Windows\SysNative\drivers\mferkdet.sys (McAfee, Inc.)
DRV:64bit: - (mfehidk) -- C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
DRV:64bit: - (mfefirek) -- C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.)
DRV:64bit: - (mfeavfk) -- C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.)
DRV:64bit: - (mfeapfk) -- C:\Windows\SysNative\drivers\mfeapfk.sys (McAfee, Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (JRAID) -- C:\Windows\SysNative\drivers\jraid.sys (JMicron Technology Corp.)
DRV:64bit: - (McPvDrv) -- C:\Windows\SysNative\drivers\McPvDrv.sys (McAfee, Inc.)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (HipShieldK) -- C:\Windows\SysNative\drivers\HipShieldK.sys (McAfee, Inc.)
DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (LVUVC64) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (Lbd) -- C:\Windows\SysNative\drivers\Lbd.sys (Lavasoft AB)
DRV:64bit: - (cbfs3) -- C:\Windows\SysNative\drivers\cbfs3.sys (EldoS Corporation)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (FETNDIS) -- C:\Windows\SysNative\drivers\fetn62a.sys (VIA Technologies, Inc.              )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcuxd) -- C:\Windows\SysNative\drivers\vpcuxd.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (adfs) -- C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)
DRV:64bit: - (LVPr2Mon) -- C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (LVPr2M64) -- C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (AppleCharger) -- C:\Windows\SysNative\drivers\AppleCharger.sys ()
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (NEC Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (NEC Electronics Corporation)
DRV:64bit: - (OXSDIDRV_x64) -- C:\Windows\SysNative\drivers\OXSDIDRV_x64.sys ()
DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (e1express) -- C:\Windows\SysNative\drivers\e1e6032e.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (TuneUpUtilitiesDrv) -- C:\Programme (neu)\TuneUp\2013\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (Lavasoft Kernexplorer) -- C:\Programme (neu)\Adaware\kernexplorer64.sys ()
DRV - (adfs) -- C:\Windows\SysWow64\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (GVTDrv64) -- C:\Windows\GVTDrv64.sys ()
DRV - ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}) -- C:\Programme (neu)\Cyberlink BD Solution\Update\PowerDVD8\000.fcl (CyberLink Corp.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.ch/
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/default.aspx
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-ch
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C5 D7 19 AF 51 62 CB 01  [binary data]
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\URLSearchHook: {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - SOFTWARE\Classes\CLSID\{BC86E1AB-EDA5-4059-938F-CE307B0C6F0A}\InprocServer32 File not found
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=26adc437-58c4-4a1a-b218-1afd2c900b76&pid=freewarede&k=0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{13EF2A37-5A77-49EC-87CB-6663BFE20E26}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=26adc437-58c4-4a1a-b218-1afd2c900b76&pid=freewarede&mode=bounce&k=0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{6E9A7C38-A772-4cc3-9870-7A95217F1153}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{7D7A7B64-9F6B-44ea-9659-6C5B86777572}: "URL" = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=1975384696&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{AB6E7745-38F1-40F9-B896-6166091A2534}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=26adc437-58c4-4a1a-b218-1afd2c900b76&pid=freewarede&mode=bounce&k=0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{B1AF0140-5274-4754-A194-94DEEFC670C5}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=26adc437-58c4-4a1a-b218-1afd2c900b76&pid=freewarede&mode=bounce&k=0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{B2654240-514B-4DED-803B-87CD3BA71F70}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=26adc437-58c4-4a1a-b218-1afd2c900b76&pid=freewarede&mode=bounce&k=0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{CAFD9BC3-0687-4FBB-ABF6-931EA1365600}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=26adc437-58c4-4a1a-b218-1afd2c900b76&pid=freewarede&mode=bounce&k=0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\SearchScopes\{CD00F341-AF8D-48F0-93A3-F0526078753F}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=26adc437-58c4-4a1a-b218-1afd2c900b76&pid=freewarede&mode=bounce&k=0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: anttoolbar%40ant.com:2.4.7.8
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme (neu)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Programme (neu)\Java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PR20C1~1\MSOFFI~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PR20C1~1\MSOFFI~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.4.53: C:\Programme (neu)\Real Player\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.4.53: C:\Programme (neu)\Real Player\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.4.53: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.4.53: C:\Programme (neu)\Real Player\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Programme (neu)\Adobe\Adobe CS\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor [2013.02.09 16:46:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012.06.25 22:03:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2013.03.10 15:55:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Programme (neu)\Firefox\components [2013.04.12 16:28:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\msktbird@mcafee.com: C:\Program Files\McAfee\MSK [2013.05.04 17:34:17 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Programme (neu)\Firefox\components [2013.04.12 16:28:24 | 000,000,000 | ---D | M]
 
[2010.10.02 23:03:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HNPC1\AppData\Roaming\mozilla\Extensions
[2012.11.18 21:26:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HNPC1\AppData\Roaming\mozilla\Firefox\Profiles\JonDoFox\extensions
[2012.11.18 21:26:55 | 000,000,000 | ---D | M] (Cookie Monster) -- C:\Users\HNPC1\AppData\Roaming\mozilla\Firefox\Profiles\JonDoFox\extensions\{45d8ff86-d909-11db-9705-005056c00008}
[2012.11.18 21:26:56 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\HNPC1\AppData\Roaming\mozilla\Firefox\Profiles\JonDoFox\extensions\https-everywhere@eff.org
[2012.11.18 21:26:56 | 000,000,000 | ---D | M] ("UnPlug") -- C:\Users\HNPC1\AppData\Roaming\mozilla\Firefox\Profiles\JonDoFox\extensions\unplug@compunach
[2013.04.26 18:42:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HNPC1\AppData\Roaming\mozilla\Firefox\Profiles\p633c3e1.default-1356808552607\extensions
[2013.04.26 18:42:16 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Users\HNPC1\AppData\Roaming\mozilla\Firefox\Profiles\p633c3e1.default-1356808552607\extensions\anttoolbar@ant.com
[2012.10.09 09:31:50 | 000,709,451 | ---- | M] () (No name found) -- C:\Users\HNPC1\AppData\Roaming\mozilla\firefox\profiles\JonDoFox\extensions\{437be45a-4114-11dd-b9ab-71d256d89593}.xpi
[2012.10.09 08:49:22 | 000,529,316 | ---- | M] () (No name found) -- C:\Users\HNPC1\AppData\Roaming\mozilla\firefox\profiles\JonDoFox\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.09.10 08:39:20 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\HNPC1\AppData\Roaming\mozilla\firefox\profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.10.09 08:49:22 | 000,048,875 | ---- | M] () (No name found) -- C:\Users\HNPC1\AppData\Roaming\mozilla\firefox\profiles\JonDoFox\extensions\{fa8476cf-a98c-4e08-99b4-65a69cb4b7d4}.xpi
 
O1 HOSTS File: ([2010.10.07 21:23:50 | 000,001,390 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       activate.adobe.com
O1 - Hosts: 127.0.0.1       practivate.adobe.com
O1 - Hosts: 127.0.0.1       ereg.adobe.com
O1 - Hosts: 127.0.0.1       activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1       wip3.adobe.com
O1 - Hosts: 127.0.0.1       3dns-3.adobe.com
O1 - Hosts: 127.0.0.1       3dns-2.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1       ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1       activate-sea.adobe.com
O1 - Hosts: 127.0.0.1       wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1       activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1       wwis-dubc1-vip60.adobe.com
O2:64bit: - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\McAfee\SystemCore\ScriptSn.20120628072140.dll (McAfee, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Virtual Storage Mount Notification) - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme (neu)\MS Office 2010 Professional\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme (neu)\Java\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120628072141.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme (neu)\MS Office 2010 Professional\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme (neu)\Java\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Programme (neu)\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BCSSync] C:\Programme (neu)\MS Office 2010 Professional\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [BCU] "C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe" File not found
O4 - HKLM..\Run: [CLMLServer] C:\Programme (neu)\Cyberlink BD Solution\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [LWS] C:\Programme (neu)\Logitech\Webcam\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Programme (neu)\Cyberlink BD Solution\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3396227017-4180034831-218732410-1000..\Run: []  File not found
O4 - HKU\S-1-5-21-3396227017-4180034831-218732410-1000..\Run: [HP Photosmart 6520 series (NET)] C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKU\.DEFAULT..\RunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f File not found
O4 - HKU\.DEFAULT..\RunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f File not found
O4 - HKU\S-1-5-18..\RunOnce: [adaware] reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f File not found
O4 - HKU\S-1-5-18..\RunOnce: [adaware_XP] reg.exe delete "HKCU\Software\adaware" /f File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 6520 series (Netzwerk).lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\S-1-5-21-3396227017-4180034831-218732410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: TaskbarNoNotification = 0
O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme (neu)\MS Office 2010 Professional\Office14\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme (neu)\MS Office 2010 Professional\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: An OneNote s&enden - C:\Programme (neu)\MS Office 2010 Professional\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme (neu)\MS Office 2010 Professional\Office14\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme (neu)\MS Office 2010 Professional\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme (neu)\MS Office 2010 Professional\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme (neu)\MS Office 2010 Professional\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme (neu)\MS Office 2010 Professional\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab (Reg Error: Key error.)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab (Reg Error: Key error.)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{545CB43A-7726-4684-9C1B-72218275AA4F}: DhcpNameServer = 164.128.36.34 164.128.76.39
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{687598C1-6392-4E89-B091-2CE3BD305F48}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:64bit: - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Programme (neu)\Fences\Stardock\Fences\FencesMenu64.dll (Stardock)
O22:64bit: - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysNative\CbFsMntNtf3.dll (EldoS Corporation)
O22 - SharedTaskScheduler: {5FF49FE8-B332-4CB9-B102-FB6951629E55} - Virtual Storage Mount Notification - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme (neu)\MS Office 2010 Professional\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.10.20 20:47:40 | 000,000,000 | ---- | M] () - J:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.05 19:16:37 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\HNPC1\Desktop\OTL.exe
[2013.05.05 11:17:36 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\HNPC1\Desktop\aswMBR.exe
[2013.05.04 01:14:30 | 000,000,000 | ---D | C] -- C:\FRST
[2013.05.03 23:31:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2013.05.03 23:31:46 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee Security Scan
[2013.05.03 23:31:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\McAfee Security Scan
[2013.05.03 23:31:30 | 003,795,288 | ---- | C] (McAfee, Inc.) -- C:\Users\HNPC1\Desktop\SecurityScan_Release.exe
[2013.05.03 22:49:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileASSASSIN
[2013.05.03 22:41:01 | 000,000,000 | ---D | C] -- C:\Users\HNPC1\AppData\Roaming\Malwarebytes
[2013.05.03 22:40:56 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.05.03 22:40:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.05.03 22:40:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.05.03 22:39:57 | 000,000,000 | ---D | C] -- C:\Users\HNPC1\AppData\Local\Programs
[2013.05.03 22:39:26 | 010,285,040 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\HNPC1\Desktop\mbam-setup-1.75.0.1300.exe
[2013.05.03 22:18:45 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.05.03 22:18:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013.05.03 22:17:14 | 000,726,464 | ---- | C] (Enigma Software Group USA, LLC.) -- C:\Users\HNPC1\Desktop\SpyHunter-Installer.exe
[2013.05.03 22:14:30 | 000,000,000 | ---D | C] -- C:\Users\HNPC1\AppData\Roaming\SpeedyPC Software
[2013.05.03 22:14:30 | 000,000,000 | ---D | C] -- C:\Users\HNPC1\AppData\Roaming\DriverCure
[2013.05.03 22:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\SpeedyPC Software
[2013.05.03 14:31:09 | 000,000,000 | ---D | C] -- C:\Users\HNPC1\AppData\Roaming\WinHost
[2013.04.30 20:45:40 | 000,000,000 | ---D | C] -- C:\Users\HNPC1\Documents\CyberLink
[2013.04.11 09:36:34 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.04.11 09:36:34 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.04.11 09:36:33 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.04.11 09:36:33 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.04.11 09:36:33 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.04.11 09:36:33 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.04.11 09:36:33 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.04.11 09:36:33 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.04.11 09:36:33 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.04.11 09:36:33 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.04.11 09:36:33 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.04.11 09:36:33 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.04.11 09:36:31 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.04.11 09:36:31 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.04.11 09:36:31 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.04.11 08:25:04 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.04.11 08:25:04 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.04.11 08:25:03 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.04.11 08:25:03 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
[2013.04.11 08:25:02 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2013.04.11 08:25:02 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
[2013.04.07 22:14:10 | 000,000,000 | ---D | C] -- C:\Users\HNPC1\Desktop\Vater
[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.05 19:19:54 | 000,010,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.05 19:19:54 | 000,010,256 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.05 19:17:36 | 001,507,342 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.05 19:17:36 | 000,659,554 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.05 19:17:36 | 000,619,494 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.05 19:17:36 | 000,131,686 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.05 19:17:36 | 000,107,814 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.05 19:16:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\HNPC1\Desktop\OTL.exe
[2013.05.05 19:12:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.05 15:00:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.05 14:39:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.05 14:33:05 | 000,890,825 | ---- | M] () -- C:\Users\HNPC1\Desktop\SecurityCheck.exe
[2013.05.05 11:19:03 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\HNPC1\Desktop\aswMBR.exe
[2013.05.05 11:16:04 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.04 00:08:25 | 095,023,320 | ---- | M] () -- C:\ProgramData\dzvoir.pad
[2013.05.03 23:31:46 | 000,002,160 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.05.03 23:31:46 | 000,002,160 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.05.03 23:31:32 | 003,795,288 | ---- | M] (McAfee, Inc.) -- C:\Users\HNPC1\Desktop\SecurityScan_Release.exe
[2013.05.03 22:49:53 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\FileASSASSIN.lnk
[2013.05.03 22:40:56 | 000,001,025 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.03 22:39:40 | 010,285,040 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\HNPC1\Desktop\mbam-setup-1.75.0.1300.exe
[2013.05.03 22:17:14 | 000,726,464 | ---- | M] (Enigma Software Group USA, LLC.) -- C:\Users\HNPC1\Desktop\SpyHunter-Installer.exe
[2013.05.03 22:12:41 | 000,001,205 | ---- | M] () -- C:\Users\HNPC1\Desktop\FixNCR.reg
[2013.05.03 21:49:41 | 000,628,743 | ---- | M] () -- C:\Users\HNPC1\Desktop\adwcleaner.exe
[2013.05.03 21:48:10 | 000,684,480 | ---- | M] () -- C:\Users\HNPC1\Desktop\DownloadManagerSetup(1).exe
[2013.05.03 21:47:50 | 000,001,120 | ---- | M] () -- C:\Users\HNPC1\Desktop\Continue Mipony Download Manager Installation.lnk
[2013.05.03 21:47:41 | 000,684,480 | ---- | M] () -- C:\Users\HNPC1\Desktop\DownloadManagerSetup.exe
[2013.05.03 21:06:08 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2013.05.03 21:06:08 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2013.05.03 16:12:35 | 000,001,950 | ---- | M] () -- C:\Users\HNPC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 6520 series (Netzwerk).lnk
[2013.05.03 14:44:19 | 000,000,152 | ---- | M] () -- C:\ProgramData\dzvoir.reg
[2013.05.03 14:44:19 | 000,000,056 | ---- | M] () -- C:\ProgramData\dzvoir.bat
[2013.04.30 21:01:40 | 000,059,304 | ---- | M] () -- C:\Users\HNPC1\Desktop\Kreditkartenabrechnung-2013-04-29.pdf
[2013.04.27 17:16:12 | 001,769,674 | ---- | M] () -- C:\Users\HNPC1\Desktop\5012413_20130427_1716_13_attachments.zip
[2013.04.27 17:16:01 | 000,061,627 | ---- | M] () -- C:\Users\HNPC1\Desktop\5012413_20130427_1716_02_attachments.zip
[2013.04.15 20:43:53 | 000,023,241 | ---- | M] () -- C:\Users\HNPC1\Desktop\Miles & More - Meilenkonto.pdf
[2013.04.12 16:12:27 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.04.12 16:12:27 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.04.12 15:59:18 | 003,030,032 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.04.11 08:30:27 | 001,443,770 | ---- | M] () -- C:\Users\HNPC1\Desktop\documents.zip
[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.05 14:33:04 | 000,890,825 | ---- | C] () -- C:\Users\HNPC1\Desktop\SecurityCheck.exe
[2013.05.03 23:31:46 | 000,002,160 | ---- | C] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2013.05.03 23:31:38 | 000,002,160 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2013.05.03 22:49:53 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\FileASSASSIN.lnk
[2013.05.03 22:40:56 | 000,001,025 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.03 22:12:41 | 000,001,205 | ---- | C] () -- C:\Users\HNPC1\Desktop\FixNCR.reg
[2013.05.03 21:49:41 | 000,628,743 | ---- | C] () -- C:\Users\HNPC1\Desktop\adwcleaner.exe
[2013.05.03 21:48:10 | 000,684,480 | ---- | C] () -- C:\Users\HNPC1\Desktop\DownloadManagerSetup(1).exe
[2013.05.03 21:47:50 | 000,001,120 | ---- | C] () -- C:\Users\HNPC1\Desktop\Continue Mipony Download Manager Installation.lnk
[2013.05.03 21:47:41 | 000,684,480 | ---- | C] () -- C:\Users\HNPC1\Desktop\DownloadManagerSetup.exe
[2013.05.03 14:44:19 | 000,000,152 | ---- | C] () -- C:\ProgramData\dzvoir.reg
[2013.05.03 14:44:19 | 000,000,056 | ---- | C] () -- C:\ProgramData\dzvoir.bat
[2013.05.03 14:44:12 | 095,023,320 | ---- | C] () -- C:\ProgramData\dzvoir.pad
[2013.04.30 21:01:40 | 000,059,304 | ---- | C] () -- C:\Users\HNPC1\Desktop\Kreditkartenabrechnung-2013-04-29.pdf
[2013.04.27 17:16:10 | 001,769,674 | ---- | C] () -- C:\Users\HNPC1\Desktop\5012413_20130427_1716_13_attachments.zip
[2013.04.27 17:16:00 | 000,061,627 | ---- | C] () -- C:\Users\HNPC1\Desktop\5012413_20130427_1716_02_attachments.zip
[2013.04.15 20:43:53 | 000,023,241 | ---- | C] () -- C:\Users\HNPC1\Desktop\Miles & More - Meilenkonto.pdf
[2013.04.11 08:30:27 | 001,443,770 | ---- | C] () -- C:\Users\HNPC1\Desktop\documents.zip
[2013.01.05 17:25:39 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012.11.21 09:56:34 | 000,000,027 | ---- | C] () -- C:\Program Files\plugins.dat
[2012.08.09 16:21:04 | 013,913,600 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012.01.18 07:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012.01.18 07:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012.01.18 07:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011.12.21 09:50:01 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011.12.21 09:50:01 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011.10.21 18:27:54 | 000,867,020 | ---- | C] () -- C:\Windows\SysWow64\igkrng575.bin
[2011.10.21 18:27:54 | 000,128,204 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng575.bin
[2011.10.21 18:27:54 | 000,105,608 | ---- | C] () -- C:\Windows\SysWow64\igfcg575m.bin
[2011.02.14 12:29:29 | 000,003,584 | ---- | C] () -- C:\Users\HNPC1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.01.18 18:26:02 | 000,000,031 | ---- | C] () -- C:\Program Files\plugins-04041e-fe8.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.08.14 08:31:05 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\Ad-Aware Antivirus
[2010.10.07 22:59:04 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2013.05.03 22:14:30 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\DriverCure
[2011.09.09 06:34:54 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\DVDVideoSoft
[2011.02.01 15:23:44 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\Information Factory
[2012.11.18 21:22:01 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\JonDo
[2010.10.02 21:54:27 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\Leadertech
[2012.05.28 20:32:29 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\naviextras
[2011.08.31 19:48:58 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\Opera
[2012.07.02 21:31:11 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\Samsung
[2013.05.03 22:14:30 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\SpeedyPC Software
[2011.04.10 20:11:11 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\Stardock
[2012.09.20 20:59:22 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\TuneUp Software
[2013.05.03 22:43:46 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\WinHost
[2012.12.29 20:22:27 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\Wuala
[2011.05.22 19:42:50 | 000,000,000 | ---D | M] -- C:\Users\HNPC1\AppData\Roaming\XMedia Recode
 
========== Purity Check ==========
 
 

< End of report >

OTL Extra text:

Code:

ATTFilter

OTL Extras logfile created on: 05.05.2013 19:20:59 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\HNPC1\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
3.74 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 51.75% Memory free
7.48 Gb Paging File | 5.25 Gb Available in Paging File | 70.19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111.79 Gb Total Space | 37.32 Gb Free Space | 33.39% Space Free | Partition Type: NTFS
Drive D: | 100.00 Mb Total Space | 84.71 Mb Free Space | 84.71% Space Free | Partition Type: NTFS
Drive E: | 440.20 Gb Total Space | 377.08 Gb Free Space | 85.66% Space Free | Partition Type: NTFS
Drive F: | 491.21 Gb Total Space | 444.10 Gb Free Space | 90.41% Space Free | Partition Type: NTFS
Drive H: | 53.71 Gb Total Space | 45.95 Gb Free Space | 85.54% Space Free | Partition Type: NTFS
Drive I: | 95.33 Gb Total Space | 59.81 Gb Free Space | 62.75% Space Free | Partition Type: NTFS
Drive J: | 29.29 Gb Total Space | 21.36 Gb Free Space | 72.93% Space Free | Partition Type: NTFS
Drive K: | 82.49 Gb Total Space | 64.61 Gb Free Space | 78.33% Space Free | Partition Type: NTFS
 
Computer Name: HNPC1-PC | User Name: HNPC1 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3396227017-4180034831-218732410-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme (neu)\Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme (neu)\MS Office 2010 Professional\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme (neu)\MS Office 2010 Professional\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme (neu)\MS Office 2010 Professional\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme (neu)\MS Office 2010 Professional\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A1A5AB2-62B9-45C9-8533-6415CAA23649}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{0C584BED-7449-4022-83CB-F626951E7A05}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{1F4049A8-9EF7-4243-91AA-859758370FB9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{23BC0036-B875-4299-B5E7-4FB364542F3E}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{33F3DF1E-37A8-46D8-BD53-2B718A37CC7F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{43777122-FB5F-4C2E-BAE6-F6706C75637E}" = rport=445 | protocol=6 | dir=out | app=system | 
"{43A103C7-C97B-40E4-9A2F-FD9704DE1574}" = lport=139 | protocol=6 | dir=in | app=system | 
"{468D4BCE-8149-4426-A077-D648E0F15E2E}" = rport=138 | protocol=17 | dir=out | app=system | 
"{47BF270F-1632-4325-8B23-C81440AE3926}" = lport=445 | protocol=6 | dir=in | app=system | 
"{4E2ED22F-4636-4FEB-A238-3ED439342AAF}" = rport=137 | protocol=17 | dir=out | app=system | 
"{563CB0AC-9EC2-4169-A8BD-42BC69124BEE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{79364999-3585-4D62-B696-9AF5CF35D9C7}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{82DF6A1E-A5E8-4C78-B18A-31383E8B0947}" = lport=6004 | protocol=17 | dir=in | app=c:\programme (neu)\ms office 2010 professional\office14\outlook.exe | 
"{94492D2A-1482-4731-875F-6CBCF8B48F1D}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{A709103D-F378-48D1-8F6F-F397F6B957E4}" = lport=137 | protocol=17 | dir=in | app=system | 
"{B64F166F-7C13-4229-8233-FAA514955030}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C0844735-8498-4ECF-A6E9-2D1D3E431545}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{CA1C9967-1B64-4EE6-829B-2EB9049FA251}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CA692640-28AF-4B85-9495-DCCFF08AD791}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 
"{D0EEC347-9FA6-4411-872D-89A14F402071}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D7D17539-C9C0-46CD-BDC9-2803B2C0EE14}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{E1B15DB4-2BF6-4063-BCBF-B5FF915D2480}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E7886031-8EFF-4C16-BBDE-A9484B18796E}" = rport=139 | protocol=6 | dir=out | app=system | 
"{E8FF51E5-6D63-4B36-9D38-5951AA74FA0A}" = lport=138 | protocol=17 | dir=in | app=system | 
"{EA01F2A0-FCCE-435D-A78C-E1EC38EF001F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F715EE5D-B653-4BE6-B631-70C63B139F59}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FD5CF439-1062-4D2D-AF55-22624E51447A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0093AA0F-61D3-4111-83DC-D2795AA73B3F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{0ADEC58D-4BE1-4467-B9D4-A8727BDCF065}" = protocol=17 | dir=in | app=c:\program files (x86)\adawaretb\dtuser.exe | 
"{10DB1808-992C-488B-AD6A-A9ACFA1268BE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{13299313-23BB-4479-B5EF-7A9CD302DE23}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{161FCA76-B0D2-45E1-88AA-B43F89FBAB7F}" = protocol=6 | dir=out | app=system | 
"{1D4640E6-AEAB-480E-A8D8-744CCBD0EF3A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{22426473-3F07-47A6-A1A8-4E0EE46DD51F}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{2612B3AB-7DDD-4A70-9749-3633E3B9C67F}" = dir=in | app=c:\programme (neu)\cyberlink bd solution\update\powerdvd8\powerdvd8.exe | 
"{2DE8EC02-6C01-4E39-8A2B-CBA89BA64BF1}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{2F42BB4B-FF18-4F96-9756-27AC210E6691}" = dir=in | app=c:\program files\hp\hp photosmart 6520 series\bin\hpnetworkcommunicator.exe | 
"{33FD7F2C-7849-4E94-B425-D095779B4070}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{345710ED-013B-4084-A41A-41B5B38695F5}" = protocol=6 | dir=in | app=c:\program files (x86)\adawaretb\dtuser.exe | 
"{44A0883E-2BF9-4032-909E-F062DB5B7400}" = protocol=17 | dir=in | app=c:\programme (neu)\ms office 2010 professional\office14\groove.exe | 
"{51A3ACA5-8F6E-42A2-9CDB-F4CCF70F59D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{5BD02C06-CDC7-4CC4-8993-B0B90C2204FC}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{5C36FF7B-238D-40C9-ADF3-9C3E2ED78137}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{5E742888-D149-4375-A267-906DBBD148D2}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{610940DA-4F24-4DF3-BFFE-32B24A019FEC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{62649481-6F62-4339-BC8E-2C08DE3EF404}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{62CC5794-55B3-4215-ADE5-6B327424892A}" = protocol=17 | dir=in | app=c:\programme (neu)\ms office 2010 professional\office14\onenote.exe | 
"{6C5BE4DD-ADEC-4E1D-80D1-DB37D47222AE}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{6D663F38-7CA9-497A-890A-AA17F8CEBCBA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{74DB3EB0-E4D2-43A0-8F5D-05C4CF151D0F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{7A6E8E84-5A23-4017-9FD7-55DC35D26401}" = dir=in | app=c:\programme (neu)\itunes\itunes.exe | 
"{7EDE41F4-915D-491A-8484-ECCDBD86726F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{7F1D5345-5017-4376-A5EB-C1AB8F5A5435}" = protocol=6 | dir=in | app=c:\programme (neu)\ms office 2010 professional\office14\groove.exe | 
"{8510F69E-EA08-4476-8B43-07B7443EEFC1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8E8C1367-E530-4CC6-ADA4-996457E474F4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{9702CDB5-D2C6-4468-8A27-26308208E0AC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{972CF3D6-190F-48E6-9B3F-D08073C16F48}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{9993D984-701E-4A45-9DDA-D7490FF3F6E6}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{9AFF8E44-F312-4051-8714-21697007F7AA}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{9C70BDC0-379D-4CC4-95A3-0F1BCC66F556}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A1B8D6E5-0148-4C60-8B80-0B46BD83D541}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{AB6EBE77-8325-45F7-AB6F-2026DE0E5399}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe | 
"{AFE045AB-A159-4341-825C-92FEDB5C3BF3}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{B68E846E-BC7B-40BC-BBCD-73C63EA9BC7E}" = protocol=6 | dir=in | app=c:\programme (neu)\ms office 2010 professional\office14\onenote.exe | 
"{C27E23AC-E04F-4CD5-B107-335EBEBD0B0F}" = dir=in | app=c:\program files\hp\hp photosmart 6520 series\bin\devicesetup.exe | 
"{C5312958-8DE4-49B4-A7AD-77B52B2EA264}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{CE7F9E62-60F8-42A8-A8E6-8A14034BBC17}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{D00ABD08-3F81-4C5F-B422-BF6D53AD71BF}" = dir=in | app=c:\program files\hp\hp photosmart 6520 series\bin\hpnetworkcommunicatorcom.exe | 
"{DAC14D95-C851-40D9-AFE0-87591076EF56}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{EB762C9B-3650-48FD-8348-4AEFA6D54A6A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{F9FD9CBD-63B1-4452-8E39-6CD451B87BB5}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{08C3441C-4FAF-48D3-A551-70DD6031734F}" = Microsoft Baseline Security Analyzer 2.2
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{26A24AE4-039D-4CA4-87B4-2F86417013FF}" = Java 7 Update 13 (64-bit)
"{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64
"{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{5EB6F3CB-46F4-451F-A028-7F6D8D35D7D0}" = Windows Live Language Selector
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{704C0303-D20C-45AF-BD2B-556EAF31BE09}" = iCloud
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64
"{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97771E91-1EF5-4EAA-B19E-94901CF363AA}" = HP Photosmart 6520 series - Grundlegende Software für das Gerät
"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4
"{EF79C448-6946-4D71-8134-03407888C054}" = Shared C Run-time for x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"sp6" = Logitech SetPoint 6.32
"VN_VUIns_Rhine_VIA" = VIA Rhine Family Fast Ethernet Adapter
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{10CD364B-FFCC-48BE-B469-B9622A033075}" = Fences
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3B35725F-C623-4A1E-B5CC-99C0868679E3}" = Smart 6 B10.0422.1
"{3BEF9769-BA52-18F7-1D02-2362F6A27E38}" = Adobe Media Player
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3DECD372-76A1-4483-BF10-B547790A3261}" = ON_OFF Charge B10.0427.1
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{415FA9AD-DA10-4ABE-97B6-5051D4795C90}" = HP FWUpdateEDO2
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{43BEEE26-01A8-4EEE-8632-2353261E3B55}" = RemoteComms driver
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{468D22C0-8080-11E2-B86E-B8AC6F98CCE3}" = Google Earth
"{47C6F987-685A-41AE-B092-E75B277AEE39}" = Adobe Flash CS4 Extension - Flash Lite STI others
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{52232EF4-CC12-4C21-ABCF-ADB79618302D}" = Adobe Soundbooth CS4 Codecs
"{537575D6-3B96-474C-BD8F-DFF667363DBD}" = Naviextras Toolbox Prerequesities
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}" = HP Update
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.1.3.1
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz
"{97BD5533-8B5B-42FA-ADAE-A6F8DB997D7C}" = Ad-Aware
"{9C18E568-8E10-491E-896E-EEFB3FF1A39A}" = TwixTel
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A2F991E7-DDCD-42B7-AFEC-47789A099FDC}" = Browser Configuration Utility
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}" = QuickTime
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BD3374D3-C2E6-42B7-A80B-E850B6886246}" = Adobe Flash CS4 STI-other
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}" = TuneUp Utilities 2013
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}" = System Requirements Lab for Intel
"{C938BE91-3BB5-4B84-9EF6-88F0505D0038}" = Adobe Premiere Pro CS4 Third Party Content
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF29A236-2802-415A-AF44-4383892BD804}" = HP Photosmart 6520 series Hilfe
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E7C97E98-4C2D-BEAF-5D2F-CC45A2F95D90}" = Acrobat.com
"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4811919-F252-4B25-9AB2-8859A85810B5}" = TuneUp Utilities Language Pack (de-DE)
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FB1AC1F1-8F47-4DCE-A1ED-0DFBA0F455B4}" = Driver Mender
"{FB2A5FCC-B81B-48C2-A009-7804694D83E9}" = Adobe Encore CS4 Codecs
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"9004-7442-8537-0667" = steuern.lu.2011 nP 7.0.1
"9333-3900-0456-3670" = steuern.lu.2012 nP 8.0.1
"adawaretb" = Ad-Aware Security Toolbar
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_b2d6abde968e6f277ddbfd501383e02" = Adobe Creative Suite 4 Master Collection
"Ashampoo MP3 AudioCenter" = Ashampoo MP3 AudioCenter
"com.adobe.amp.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DreamBoxEdit" = DreamBoxEdit -- The one and only settings editor for your Dreambox
"FileASSASSIN" = FileASSASSIN
"HP Photo Creations" = HP Photo Creations
"ifolor-Designer" = ifolor Designer
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}" = NEC Electronics USB 3.0 Host Controller Driver
"JAP" = JAP
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSC" = McAfee Total Protection
"Naviextras Toolbox" = Naviextras Toolbox
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"RealPlayer 15.0" = RealPlayer
"TuneUp Utilities 2013" = TuneUp Utilities 2013
"WinLiveSuite" = Windows Live Essentials
"Wuala CBFS" = Wuala CBFS
"Wuala OverlayIcons" = Wuala OverlayIcons
"XMedia Recode" = XMedia Recode 3.0.3.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3396227017-4180034831-218732410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"Wuala" = Wuala
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 17.07.2012 06:37:35 | Computer Name = HNPC1-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 17.07.2012 07:43:42 | Computer Name = HNPC1-PC | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest-
 oder Richtliniendatei "C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe"
 in Zeile 2.  Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
Error - 17.07.2012 07:45:08 | Computer Name = HNPC1-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
 Richtliniendatei "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
 AIR.dll" in Zeile 3.  Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
 des "version"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 17.07.2012 12:06:59 | Computer Name = HNPC1-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 17.07.2012 13:38:09 | Computer Name = HNPC1-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 17.07.2012 15:44:25 | Computer Name = HNPC1-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 18.07.2012 14:37:27 | Computer Name = HNPC1-PC | Source = Application Hang | ID = 1002
Description = Programm OUTLOOK.EXE, Version 14.0.6117.5001 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 11f8    Startzeit: 01cd65143026b84a    Endzeit: 0    Anwendungspfad: 
C:\Programme (neu)\MS Office 2010 Professional\Office14\OUTLOOK.EXE    Berichts-ID: 
9b7ec00e-d107-11e1-8e9d-1c6f6525cdea  
 
Error - 18.07.2012 15:03:13 | Computer Name = HNPC1-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 19.07.2012 14:11:28 | Computer Name = HNPC1-PC | Source = System Restore | ID = 8193
Description = 
 
Error - 20.07.2012 10:59:17 | Computer Name = HNPC1-PC | Source = System Restore | ID = 8193
Description = 
 
[ Media Center Events ]
Error - 04.11.2010 03:58:31 | Computer Name = HNPC1-PC | Source = MCUpdate | ID = 0
Description = 08:58:31 - Fehler beim Herstellen der Internetverbindung.  08:58:31 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 04.11.2010 03:58:38 | Computer Name = HNPC1-PC | Source = MCUpdate | ID = 0
Description = 08:58:36 - Fehler beim Herstellen der Internetverbindung.  08:58:36 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ System Events ]
Error - 05.05.2013 05:28:00 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk0\DR0 gefunden.
 
Error - 05.05.2013 05:28:03 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 05.05.2013 05:28:06 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk0\DR0 gefunden.
 
Error - 05.05.2013 05:28:09 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 05.05.2013 05:28:12 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk0\DR0 gefunden.
 
Error - 05.05.2013 05:28:15 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 05.05.2013 05:28:17 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk0\DR0 gefunden.
 
Error - 05.05.2013 05:28:20 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 05.05.2013 05:28:23 | Computer Name = HNPC1-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk0\DR0 gefunden.
 
Error - 05.05.2013 05:28:23 | Computer Name = HNPC1-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst McShield erreicht.
 
 
< End of report >

Aktualisiertes Java:

Code:

ATTFilter

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 20.0 ist aktuell

    Flash (11,7,700,169) ist aktuell.

    Java (1,7,0,21) ist aktuell.

    Adobe Reader 11,0,2,0 ist aktuell.



PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 20.0 ist aktuell

    Flash (11,7,700,169) ist aktuell.

    Java ist nicht Installiert oder nicht aktiviert.

    Adobe Reader 11,0,2,0 ist aktuell.

Gruss knax

t'john · 05.05.2013, 19:27

Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Uninstall.
Bestätige mit Ja.

Tool-Bereinigung
Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html

Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
http://www.trojaner-board.de/109844-...ren-seite.html
PC wird immer langsamer - was tun?

knax · 05.05.2013, 20:15

Hallo t'john

Herzlichen Dank für den sagenhaften und schnellen Support.
Ohne deine/(eure) Hilfe wäre für mich nur eine Neuintallation in Frage gekommen.

Rückblickend würde ich sagen, dass sich wohl über die Java Sicherheitslücke sich der Übeltäter ins System einschleusen konnte. Ich werde zukünftig darauf achten, was für Werbebanner ich ankliegen werden. Ich möchte mir nicht noch einmal so einen Halunken auf dem System einfangen!
Nochmals besten Dank und merci auch für die Lektüre..

Gruss knax

t'john · 05.05.2013, 20:20

Fuer den Uebeltaeter war nichtmal ein Klick noetig!

wuensche eine virenfreie Zeit

05.05.2013, 20:20	#10
t'john /// Helfer-Team	JS/Ransom-ABJ Trojaner Fuer den Uebeltaeter war nichtmal ein Klick noetig! wuensche eine virenfreie Zeit __________________ Mfg, t'john Das TB unterstützen

JS/Ransom-ABJ Trojaner

Plagegeister aller Art und deren Bekämpfung: JS/Ransom-ABJ Trojaner