System-Wiederherstellung nicht mehr möglich, programm browserprotect bit 89 neu und lässt sich nicht entfernen

Andy.pol · 24.05.2013, 20:33

Hallo zusammen,

ich wollte mir heute eine Software zum bpm-Zählen herunterladen.
Statt des gewünschten Programms wurde zahlreiche Ad-ins mit installiert (ZIP OpenerSetup.exe). Diese lassen sich (browserprotect bit 89) nicht mehr komplett entfernen.
Browserprotect bit 89 scheint lt. Google-Suche durchaus kritisch zu sein...
Eine Systemwiederherstellung ist nicht möglich, da diese deaktiviert ist ?!?
Beim Versuch Eure Anweisungen bzgl des Leitfadens scheitere ich bereits am Download des defoggers, es wird eine 7ZipSetup.exe heruntergeladen.

Kann ich jetzt überhaupt schon OTL herunterladen?
HILFE!

Sorry, aber ich bin völlig ahnungs- und ratlos und kenne mich noch dazu mit Computern kaum aus....

Danke bereits im Vorraus
Andy.pol

cosinus · 24.05.2013, 20:34

Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die jemals fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Andy.pol · 24.05.2013, 20:41

Hallo,

das ging ja schnell! Super!

Ja, mein AVG Virenscanner hat bereits beim Download gemeckert, und hat empfohlen eine Software zu entfernen. Das hab ich auch sofort gemacht.
Wie kann ich denn letzten Log aufrufen?

Wenn ich meinen AVG öffne, dann bietet er nur an "Jetzt scannen" und den Hinweis "Letzter Scan: nie gescannt" ?!?

Sorry, aber das versteh ich jetzt echt nicht, hab die Installation eigentlich schon länger.

Danke und Grüße
Andy.pol

cosinus · 24.05.2013, 21:18

Zitat:

Ja, mein AVG Virenscanner hat bereits beim Download gemeckert, und hat empfohlen eine Software zu entfernen. Das hab ich auch sofort gemacht.
Wie kann ich denn letzten Log aufrufen?

Was bitte wurde gefunden? Ist das Log nicht über das Hauptmenü vom Scanner zu sehen?

Andy.pol · 24.05.2013, 21:31

Hallo cosinus,

äh, das PRoblem sitz sicherlich mal wieder mehr vor dem Rechner...
Es wurde eine Anwendung gemeldet (sorry, aber weiß den Namen nicht mehr), die als bedenklich eingestuft wird. Das bereinigen wurde empfohlen.
Das hab ich auch gemacht.

Wenn ich AVG jetzt allerdings öffne, dann kann ich keinen Bericht o.ä. finden, nur einen Hinweis, dass das System noch nie gescannt wurde.

Gibt es evtl. noch einen anderen Weg das Log wieder zu finden?

Übrigens: ich bin durchaus nicht abgeneigt den Rechner einfach platt zu machen und neu aufzusetzen (geht vielleicht schneller/sicherer?).
Könnte man dafür vorher die Daten (Word/Excel/Pdf/mp3) gefahrlos auf einem anderen Datenträger sichern?

Vielen Dank und viele Grüße
Andy.pol

cosinus · 24.05.2013, 21:44

Hättest du mal AVG-Version und dein Betriebssystem genannt, wär es schon mal einfacher

Andy.pol · 24.05.2013, 21:47

Na klar:

AVG Version 2013.0.3343
Betriebssystem: Microsoft Windows Vista Home Basic Edition (32-bit) Service Pack 2

Hilft das schon?

cosinus · 24.05.2013, 22:25

Ja das ist gut. Schau ob du hier die Logs findest:

Code:

ATTFilter

C:\Users\<dein Benutzername>\AppData\Local\Avg2013\

Andy.pol · 25.05.2013, 05:34

Super! Ja, so find ich's:
Für gestern Abend direkt nach dem fehlerhaften Download hab ich eine Textdatei gefunden (avgidpagentmonitor.log), dazu der Code anbei. Es gibt noch zahlreiche andere Dateien mit Soeicherdatum von gestern Abend. Die lassen sich aber nicht öffnen (1-Datei, 2-Datei).

Code:

ATTFilter

[AVG.LOG.SM] ALL 2013-03-11 19:46:22,830 KUNDEN-NB PID:3640 THID:3644 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002007585504bAGZxqVM8FMHKgrRs0ZLHd0PuaR14G0NXo44pO38y/Gn1c9Qn5hIwmIP6/KdHk2UXV/Dc+UvVIo/kQDeezYAEjTWwray1PzOEWGu7339wi71D5uPfn91nhY6ioBsUYMd1jfFu6lHz2tcagJqCsba+F7ik7R+1eOTxEXBTwPOkM19Jg2QNgYDBFizw62Z8wxGkKYDY8ifzSzxtRXbn1iBYPIsyH0MRKg/WZVI1uvBhSceu9vq4y45NRucswqoQ1/rQ0aSeB53kGzHawXJ5SWG1O8QJeAl/8I1dp8/uJxjKeSnu2ZdCfblbfQ9Nzic1tzD4jH9QPN+f6re9k0tCVXvsCLI=
[AVG.IDP.MONITOR] ERROR 2013-03-11 20:03:19,687 KUNDEN-NB PID:3640 THID:1292 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 20:08:53,104 KUNDEN-NB PID:3640 THID:1292 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 20:11:13,884 KUNDEN-NB PID:3640 THID:1292 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 20:21:29,469 KUNDEN-NB PID:3640 THID:1292 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.LOG.SM] ALL 2013-03-11 20:25:19,039 KUNDEN-NB PID:3376 THID:3380 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002001162976bAFz9Vg6Xv+J8v5uoeaZ3BfQ4+K955SzTAEADZD7tT4PLgvTYr/1F/uyZ0Akl9+rUay9/Z8Ju4JzDs5gJPOymFpKJxr0hpUlN3RqnhzVv8211eGlf4wUOTl5j2LzliOHJyBLhQJczHRMQ8MjnS45NY3Mf7agkJhf2KgBs7rs3K0vPNF9B313mtzgKW3RGfoUL8wUbYeRUvhRGrcDs0/RNxCYLEp4QBhop121GZmA3ylYDJwFOz5HPMM0gTvf+XgbLGmAUZEfB50PoByp3gziqw1If6+YVK589CjgTx4w/HHyV33gpJ/iHO8RvI30fizNTpT/AovJoYknrpj4EELSPGZU=
[AVG.IDP.MONITOR] ERROR 2013-03-11 20:25:55,044 KUNDEN-NB PID:3376 THID:1124 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 20:26:05,059 KUNDEN-NB PID:3376 THID:1124 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 21:23:03,564 KUNDEN-NB PID:3376 THID:1124 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 21:24:23,686 KUNDEN-NB PID:3376 THID:1124 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 21:25:23,777 KUNDEN-NB PID:3376 THID:1124 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-11 21:29:34,323 KUNDEN-NB PID:3376 THID:1124 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.LOG.SM] ALL 2013-03-14 18:33:18,646 KUNDEN-NB PID:3184 THID:3188 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002011255520bAFcVdL2LdR/Ptk5e4epCmBWG2JIWaQngD9a8Zbg4kxkeTPoABVeo+XGOq2N5kNkjA53kLu1xlGBGOIlOVZgXMU4YeJgS+aTazVQpzJySJ2jla7U1MyML/ZE584J0228f7HNj3bY3g5s9TY5VP+PTfyfxfvVJ5pvEM3gfSUDEw9SIqezANLyov5WjCzeuGaoXFTJgZJ0mGcIRT/fPtWxxoAVTs61mMW3OvVjeo+PKj6t+4525cYnZB7g9A/Bxb/VF8ir4OjB6U+aIUgF9PmvITLXHqLs9B8oFesVglE0yWPOgN+ILrG9wAzLZ9/96HLBjJ1ZMBFuqa529xCw5WPInnHk=
[AVG.IDP.MONITOR] ERROR 2013-03-14 18:46:10,776 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 19:47:54,083 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 19:48:14,088 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 19:50:54,296 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 19:57:35,657 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 20:19:16,162 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 20:29:46,315 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 20:32:36,382 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-14 20:39:56,863 KUNDEN-NB PID:3184 THID:3772 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.LOG.SM] ALL 2013-03-17 18:29:27,738 KUNDEN-NB PID:3552 THID:3576 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002006602464bAGIHh+JQqss8zftlRdbBvVtHyJlwiaV9lj/Pm1LQNLGtrIG70ZdoTKvhmlK2hm4DK96CTvw0w5CbrWSP+LGd+yub1lCXBvom4y7PqoWgV8yLydEJ2IxCdUsg7cwTTx4gsL2m7EpefLKKrwA/NNRGUZju3snOYnvMdkZe9CLtFFjVmdeiZMhJgCbGVmX8J549Smh/2Iu8aqIcljVerjfvYpFlTnkz5DgxTH0YzO0y8zyU27YM4ENIvjgXysfL78JR1xYmdJbb+AfIqJtNi1K5X/JpnUdrWzqTV7BP/OBeLIVxhzGp516rcBrbdw9TOi0h57yWE/4MPX7esJdskZVsVeQ=
[AVG.IDP.MONITOR] ERROR 2013-03-17 18:29:34,899 KUNDEN-NB PID:3552 THID:4224 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-17 20:21:13,945 KUNDEN-NB PID:3552 THID:4224 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-17 20:45:14,209 KUNDEN-NB PID:3552 THID:4224 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-17 20:47:04,209 KUNDEN-NB PID:3552 THID:4224 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.LOG.SM] ALL 2013-03-18 20:22:53,832 KUNDEN-NB PID:2588 THID:2592 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000001997624032bAHATmb56lf4rLnshMwULDp5jN1/paMsiepJjs6Hrzswn4taDy2zz3neKKTJbzsOf2ay6vGmcRbIJSxrerE21Jysbw2TSLWZ5muPga5jGPQlYdYIG9YlEDpPKL+THXO7ty5qH4P4KZZawiAjducjQCcGmglDF7CKl9ebyAVgjeRTxxHonI6M1pFxcjsCvl14BdDeDdxqM4zF9zDyybRjEC/4ikcUR+e4q15Qd+MP/+ve4IzghrEs1O1b2RKVOwLf/IcGI/uucOAZ/KTJQg/G1G3FXBn5WXj1ONifWTiCcd9SoQ66VcCEBXVMNDeRpoIjozKOCPAEXwOGdo3A7b9ybiLc=
[AVG.IDP.MONITOR] ERROR 2013-03-18 21:03:45,621 KUNDEN-NB PID:2588 THID:2932 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-18 21:24:17,554 KUNDEN-NB PID:2588 THID:2932 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-18 21:33:48,420 KUNDEN-NB PID:2588 THID:2932 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-18 21:47:19,652 KUNDEN-NB PID:2588 THID:2932 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-18 21:57:51,046 KUNDEN-NB PID:2588 THID:2932 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.LOG.SM] ALL 2013-03-27 07:12:15,399 KUNDEN-NB PID:1316 THID:1232 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000001996247776bAKfecH3NUZmqx0G6vaaGhKr8PK+UOlcCB9N0Dtr9a4nJuGi9wVrJ0XBm61nMtTMww+4ZVkNxGtLkg/W6KcITD1FZvbnM3OymmJPXPSTboz0cI692KKiPix/BlO90dV7wAB/GxnkvAU3iJ5TgFrvOLLMVxNpUDmTTc41n3UFwhNWd2vMM+wUDa2Gbt+8xLkU7zyZbRVMdqOg83bQKtnpWeIBTpHkPLKUQGH8hnVpixklL5gaQzDbRPMFLOASwumcM8otg+rkCwajLg1giQoYuM2juW1k+b+vklCGe1TgJu6HOBRe3QiF8i38/Y4YBNPBOV4kuQ1F1fQOlirkoAK9HPwg=
[AVG.IDP.MONITOR] ERROR 2013-03-27 07:35:48,019 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 08:28:43,511 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 08:31:03,724 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 08:32:03,815 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 08:32:13,830 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 08:39:44,514 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 11:56:02,639 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 12:18:24,676 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 12:18:44,706 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 12:24:15,208 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 12:26:05,375 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 12:40:36,698 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 12:44:47,171 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 12:50:27,688 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:04:38,980 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:07:09,208 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:10:09,482 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:22:41,090 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:29:41,728 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:46:03,218 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:47:03,309 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:48:13,415 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:52:43,826 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:53:23,886 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:55:54,114 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 13:58:04,312 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 14:04:34,905 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 14:07:15,148 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 14:09:15,330 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 14:27:06,879 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 14:42:47,235 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 14:45:27,274 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 14:54:07,445 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:01:57,600 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:20:58,165 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:25:38,243 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:29:18,363 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:30:08,375 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:30:28,384 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:31:08,395 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:49:28,809 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:52:38,881 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 15:55:38,957 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:04:09,133 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:13:49,595 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:15:09,618 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:18:09,679 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:34:30,211 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:36:50,338 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:40:20,649 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:46:30,771 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:56:51,238 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:57:01,239 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:58:11,260 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:59:21,287 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 16:59:41,289 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:05:31,408 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:10:01,496 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:13:31,566 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:13:51,575 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:17:01,636 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:22:11,745 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:28:41,868 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:32:41,947 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:33:01,956 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-03-27 17:34:01,976 KUNDEN-NB PID:1316 THID:3812 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-02 18:28:42,582 KUNDEN-NB PID:3216 THID:3220 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002004112096bAHhZFf5c5hqtgG0kPKR4z8x1UXVxVxU4LhdF0uK+vsKFViM55qZsq96GUO7us1ktDVpWyEBVEaWhJYUtuzAN238LBUpuZ1cjqdMlKdvp+ZI6RMhkxoel9QgsZf0bA0XCNy7IBEUuGOSTgXJGZOHI+OL6PWwAZw0qxIk1RHDrIzEtZj4n8RYHx40jIjjG6unyqkueA6/EbcmmvKnb/F/VYhR2SzNLdov09ObYgFWLik9tu0YVeUnyx1Y6Mrb8eFkQVysH+tTxtmF+lqjq9EYYQyH9Qa422trYITwn6MZ3aH4RSVOnVCVcJT9DPn67ed/X3ac7n2j50BtAWgOF1518R0o=
[AVG.IDP.MONITOR] ERROR 2013-04-02 18:53:05,163 KUNDEN-NB PID:3216 THID:2808 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-04-02 18:56:25,238 KUNDEN-NB PID:3216 THID:2808 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-04-02 19:07:36,077 KUNDEN-NB PID:3216 THID:2808 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.IDP.MONITOR] ERROR 2013-04-02 19:13:36,305 KUNDEN-NB PID:3216 THID:2808 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.2780.fc8a432.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-02 19:29:59,341 KUNDEN-NB PID:3516 THID:3520 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002009092816bADcy2Idj0PF+JaWI6PT7zVBFfkGR3sn3KKfUAsU/h2jqBF0e+27CgEXpNYcZItfIWHc2YtRNn40fJS17f2w5xZOG6y2tqm/VObs0GZhkgPb2OWnlaE/1jKgi+Ip148gdW5fmLCZGCEvqFvbV2E7MyuBnUUDQr/n6yiTUvpgE5WURrjdDwl33mqonoCGWFc/LKNb4xmNIRnyIghYHBpJIwMw3akR0fgRn11nqfZ2bUGNbfEocKpO1/vl7ua0f10ZBFuryHI3SXHFF/mYiZN4VYgfwIKucfXLVxzadth0XGNbzoPvWPuIaycGHy9zv3afgdEs1nQkcH6jmfl+OlFGucBU=
[AVG.IDP.MONITOR] ERROR 2013-04-02 19:30:34,160 KUNDEN-NB PID:3516 THID:4068 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-04 18:54:43,180 KUNDEN-NB PID:3484 THID:3488 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002005226192bAB9rzHBen18I/KYHfrb1xq5osJ6julkBxNOPCIg/DKw9dVtaeO3V6zGkaizN0fVQvfOwI51+4ECQsrYPEwYJnHYficd5ARwSLCLiQ5PYcGy9hwjCxVhd4yWLApzQuDHhMMuV9HugRJIGUgoB1mcI52wHqDndnJu1X65rlQwKNYd+ohEL0tOKvy+8WrZ2f+Bit2PAD+zjh1t7amQod9oO4bPmJrfm0PWE4g9kQasErCEH5WD7v44QOrRleY0gmroYT/C9vXDPqPEb2NJD8t7SrYIEAiDZOb4y58yFCXyOMOOODnuqUWwfZNJugrh7FOe2DtaVhdhhAWC0ylrrV5U1dO0=
[AVG.IDP.MONITOR] ERROR 2013-04-04 18:55:18,810 KUNDEN-NB PID:3484 THID:3436 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-04 19:05:51,268 KUNDEN-NB PID:5436 THID:5440 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002005226192bAF3a4tXKOX7zR2ExU9RTn3cj2FHQcC9OJiTqNPmeMsjIF7OEtZjjWdiUzdKlFgwaXNVLAL9MhpS9Fc+UAt3jEnMT+UnE9xguJZYWAxlPxRphU/gkKN2nHM48DD2awVlRrpIWMoN/8kowTGqEpe0PIJAkvufbwVlOspOKrPzMsKQwxA6S4XG90qcftS2OOG+z9KDI++nHKgPPv18IA6ptT+kbbLFQEUVhzKkSCH/WOMqDvn33GlQERpswYnDjBGeqyiaq5lssTHPFm8Wgsuo2J2QhJNeJYIxng0c4n0K3vPzGAPfFxiEhXDzPvgsSp2Rb/KDjfMyhGPmuPwJmryo8rsM=
[AVG.IDP.MONITOR] ERROR 2013-04-04 19:06:00,800 KUNDEN-NB PID:5436 THID:5464 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-06 07:50:03,317 KUNDEN-NB PID:3308 THID:3312 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002002342608bAK4T1X8v9iS585fKtsO/ZhNuQ8d1Cvm0SNYfMW2hZNpWltYQ4BDh8Dap7SDJXtiseD/e0qEuRhUJOKAOx3vvSGZWtW62WW9GHQvA0xL7Fh6kHRBg8NXmtXQtYYix594oog0OsEnyitxak8Rcd0lkx0naNGu4LZaz96SbuoOqwlG2NiEMNNrEysE1vaBT6FKZ0XeN67/KdoupcoDIyFAaw8zHiIJo0YL/PGkNlC1pW+hklwpYg3uV/PuUpj9clHJzBX2xwuiw7vk247tQypHTO89zFxidVjgd4Jq34VulpGvF9xncAs6vZGb0giBEYzB33X+fqGNSWH6QTWZzKN21eVA=
[AVG.IDP.MONITOR] ERROR 2013-04-06 07:50:17,576 KUNDEN-NB PID:3308 THID:1560 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-11 17:49:01,926 KUNDEN-NB PID:2144 THID:2140 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002011124432bAMf4shPwT0XJASwfvNgGUN7NKFobXeatclHfTtWzTrb7F4FCrl9bPtZfseu7Br+luJKFmnYXKpSTIqc1PArHkLb9dIP79X9Vq+7xDCIr/ZPw5ZXr5tQDdseqisg0ka0rVOKVfifoVRkpcsn4e/XWpZj8WJLJdpES4Mngk5RYF32ftewDkZQE7odQ+d7jO68nZEQ3Wfsv4pnw6gC41VFaft78a2q26+jGPoxscA4f+ISQtXOGDVTBHZV40jATLNSk6BDPGYm84cuQ/k0tI0rumBSOR2TQEN317WQgl7vbozqK+BbZXlfnWZk1/pDZTk3WQHITKZI+yiTmthmcuf1LhdE=
[AVG.IDP.MONITOR] ERROR 2013-04-11 17:49:30,708 KUNDEN-NB PID:2144 THID:3612 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-14 14:12:47,050 KUNDEN-NB PID:3316 THID:3900 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000001999524560bAGRDIhqP8wJKIyOdcWrPaDbv6+G1XaxTJ0d9DOZuXNtu1xPSJBZL1pgIfxvCim5oI2sc3utw4Bp5G47kmCK2rQkAf86KsmD7hYsODDDcBBIlVgKrDMZcbDrTfEnGsVLI43dWNFERl8F/9pg9p+CcimOM4O0g7JCFBPbuc2Mp0gW77sOVQHDqYja5h+bOIUsonyG41QI1NipUz9vkfsVZUCxbc8xl3c0aqoRTj3nYL4cQs2xHCAQL4sQBcI8oduAa4RL6D2ZtPboBQ28uo5eXPHuTuGiDzzyagMlelGXR2tQrDCLDIu+Yulcrjcf6k4l0kXEbc/VxylKAIKCuH7YkCn0=
[AVG.IDP.MONITOR] ERROR 2013-04-14 14:13:02,556 KUNDEN-NB PID:3316 THID:5164 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-23 19:07:26,802 KUNDEN-NB PID:3264 THID:3268 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002000442064bAD9ZD7Q7KX96jH2fLBgTYdic8J4JxmVGxv3Hq1jRBp1f9XkbiN1SxuFkSfiqvzKEejQVpFIDKs/7lvlJhzYlUb6yYC9wCE5C12olHFOPzv4Fn0vk5ArG9eFU5i43Yedto3vlGWjpicWDVW/3vF9VSZOkRXITupQndU3SbgomGRm667LRneJ77WS7NILcSGh/tPB1i8WHN9e+AmqiHGVSlJMZrnr6rk8S3qtwpnIlG8XuI0GP72J+chfJpHIAqN5qK9snbmHrOr5zelGMBRv5AhoZrHb/2Z2K1cz4Q/Ysya/NoB3aBu++5pI6vh/r4UZhmhjfpZi+nK7hrTW2DTlZNlw=
[AVG.IDP.MONITOR] ERROR 2013-04-23 19:08:27,638 KUNDEN-NB PID:3264 THID:4488 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-04-25 20:14:21,704 KUNDEN-NB PID:2876 THID:2856 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002007061200bALv2FxDjo3lruT0XBjNg8XEPcF34qM9NpgWh+VWHjYxukh4B1sBfyq0DgLVEZf53Yzu/dpodzyow885SSzNo7DxaF8EJdSw1sJkhLr3HE6fDB3skcplsGJz8qPuF8Sq2J9sQtusXJK6Gj876QXEjBzL/d9HB90WPsbGiTR/V8z+nVQUWRsn0vEzAC732kI3TYpJAwoZhN9CxiHOJH4IbTS0sK7CrsytsHsQKQ4+ynVvr1V3Xx6D9wSfOakosKZnoMGpiPwUQOw7gpxJYaQri4BS1PX/hUdPgtefynnamm9fq0NEkQjIP8PNdPqDnjqT3DVFhK56thaUZusnfdapXr2c=
[AVG.IDP.MONITOR] ERROR 2013-04-25 20:14:26,821 KUNDEN-NB PID:2876 THID:4328 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-01 18:42:27,046 KUNDEN-NB PID:2940 THID:2948 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000001996903120bAHqXl/uBSpRcp5iP4jnjm7jxvDbc6otE1CldJHZ87RM1IQUVdweGOT4TY19MIZ7kU2ndynzrIUKJv5Lu9TpTswkmvaMHUbUC8EHXHfhi7NyqFGAO6GHsgL7lCJ6PXmQJLMLYZryupCWNVe+Z6SnACYQf/rztHoU3oviYbPc80YUIoG4uDAAzO1thR4/zEH2PGk1bEWHaAH5yBC8XXuTh4NhDd9Weh39HBTuJiz9XRJLyklFxzw23NEaGlUsrPENJj9yWo902/10L1EFy9gsSAYTyKjECNxqEkSfDz+qUTo16MNt/gieNKJtXysZpSw9wkVTqRi5I3HjGIg2dBINjTUM=
[AVG.IDP.MONITOR] ERROR 2013-05-01 18:42:43,894 KUNDEN-NB PID:2940 THID:3968 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-01 19:00:43,789 KUNDEN-NB PID:3624 THID:3628 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000001998148304bAKVdU+Vo1OqqsDsU1R5sgcBM/z8dbiyDl4v7IVYPQS0KcpekeEvlghHLS9nGp1/aFMMsxHNoG3YDph0z+vlFqznlTOniomhZGLjd5H1Iy88DCnh/iqs1ssSC4hpNmPaBaPiUbaQHeQBWvM48HJEGuocz1kCqL2+fFN9ezbk6DjwDEEr5leqI8gcvttZAh+PHfw0BXvOBsjFG2Z15Z1MWmh2v0aKK52cD/Y5o3o8UcGpxbzdZi5k4JfBMTb7WPXHeFSqAbRybpGg4GtF+4Kze6bPYqewcFdL3YN5KzAlXMjvHSuN4uIGa5TVtovcFFlVxtMQwN7NKqSpvw62DCiesCLo=
[AVG.IDP.MONITOR] ERROR 2013-05-01 19:01:34,020 KUNDEN-NB PID:3624 THID:4244 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-01 19:34:09,795 KUNDEN-NB PID:3456 THID:3460 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002011517648bAGrK8ozVWdkJmO8q0Lu2VbAjXr4bUWicZQSeoUlj95oA4W6BXG/KCA0kyc1IZ6KQLBVEPlWJMMMDpyUvgvS2rucbWdwLnGM7DzLrZgABjpajQQ5G2PZsNfmHdSg0xjvRGFGQMPum9YKTeLPxdixttMJXvXHTSUaKAtn6d4bgR62TU74bI0ltS29C1P3E+Tqhb8V5+0E5lQ/c7NFEPexqOqspCfyKMPypJXYVGF2pMpY+1WIgh2ZNyqQx+CiPQu7FLOP5PZXlUErZYH8eFOk/lZoRKoTORKe0a2JX+UImYJtYRUg0grNzBtuWlLK5jwdXpR76N2hOoDbe+bbs4M0GOFM=
[AVG.IDP.MONITOR] ERROR 2013-05-01 19:34:58,033 KUNDEN-NB PID:3456 THID:3728 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-05 04:40:20,265 KUNDEN-NB PID:3476 THID:3480 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002000048848bAGZVSsYJcyok34McAxonRD7+zlFQGGyIx1Wv3ZcwqFOppcyqm5LryEwM4zw9IjCNoxX1WiLX48tkqRz2o4utesJPdErG4VW3xEBBR2r1M5gaqhCH9SSctD/c6XtmCYOBKkSBhE/+bckxoDkKVqf7koJOoDezdo2rP4tzJjEa3KmPYxug6jzStMqDG9sG047k9ugyEDPJxYEZkGT6uU6+cL/W0RMMAUEKivxMDhcA4Jrk/eOf3Xb0e7Fq5gW9q5Lw50/ThWEEaGx0xp7YRqr5hAAzXYH9JkVkK7Tb6HSj+1OO2gWCRONIYqe+D5GKLJyvtGJO7SSPrdTrEimPnju85Dw=
[AVG.IDP.MONITOR] ERROR 2013-05-05 04:40:28,705 KUNDEN-NB PID:3476 THID:1536 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-05 14:29:16,915 KUNDEN-NB PID:3616 THID:3620 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002001883856bAEqrypbIVuXVxyq96+TANgztWePyuTlb5aFZisvnulEKRDRPwMZ7ls95RNQXVRzNsTVnJbO8IMqpofYE6T8pZTOt51jw5AIHweKV3k32WoqKQUTNKZKUcTpD9hgoJsC7skyD2imGfTwQwdSti89MMECBRNYpMHXR0r/2V6kR72KSSBksekXQNyHS/Ymnb2eviHcMatNML3+tfxtpIecg9K3mENYdFNn+3/Ui+S2vntnLf4FCoquz49OreNVxkhk4xTmad+Q2G0xLGrfMc53QFdw81LE6CSwCvuVklgHerqMi+6VmpTdtZhopka8rspxFKvQ12yr/3PADCDSWENb2PBs=
[AVG.IDP.MONITOR] ERROR 2013-05-05 14:29:26,945 KUNDEN-NB PID:3616 THID:4148 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-07 18:33:52,335 KUNDEN-NB PID:2732 THID:2736 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002011976400bAHse7q4m5lmT9XYeh3bngX7vLSV3FDAdwqaE+9rmirbYqfdKH+/AzmkqBg/WnLlor8MIzcoVgaz1EKkXRCd9O9A2cDhU6NNfrqqQoRJ8+8bPBhcniDwROtmpDmwr6iiiMBEfTFPRJPVQ9C9C1tKAfI8t6DeJYa6NJeBtFt6hN8m/W4+sgd5t8aCY4caz671emy2IYSInvwisAPonZr+jtTfIDHorh36M9v7F5bP3AbDF86IPO3j6fSMBjzPRpd553Ah2/idAcURrlCkT+ta1wNcDvWv/v33Bhz6wsFGBmPBONdYp9QFImjL3aA2+2hbIv5sJTNoZZSjDWAweOpOZPGs=
[AVG.IDP.MONITOR] ERROR 2013-05-07 18:34:01,399 KUNDEN-NB PID:2732 THID:2024 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-11 11:35:08,726 KUNDEN-NB PID:3116 THID:3120 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000001996706512bAJiAAPDq/+wyk0nJGEgw6IzH/CPaveg3Lhrawbq5N+cwv6uhuUAFJwv1nawt0BwlGcR9YELz9s6Ev4L7vByaqgHfcsPvcBeBcXRojxBa1ArY81Xp15w/XXRAXvWT/yB0CDjO2aCKPdRu5OGB8N6GWvqaG/ol4tBchAgY2qIwHtKH8nNF+oTj29+Ny8BzWTVlJdon9fUz+gig3xXt/YOAwNuA0Lk/pZs8eb+Jkk4XSxNeTHJXuYLEBUSOVPpGI3SsfAKo8eBQ146uBT9n+dFr3vZzpA6zSJSfBDtr9UFKPNEEKRhiElzSHbBAIUd75RVESzrXh5rQubU9ZvIecLFtDN0=
[AVG.IDP.MONITOR] ERROR 2013-05-11 11:35:39,583 KUNDEN-NB PID:3116 THID:4560 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-12 13:47:38,960 KUNDEN-NB PID:3488 THID:3492 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002006864592bAKsYMm4VpaZrbrNLbFo9hHxBDJ9X0M3rVm0iiCdXTARp+X+AQuT5+Q7v8vaMY6MgETiaSc0WxuOpZ1s0jLJ+HiQ0P3AmsJK6xX/cf6Y9gHddMmueyB1eI5Sgt/05oK2qftL9jzM/HXUn6LNJqHtAFDZcWvj8R97U7wKFFPO4cwRnJU3zF9FjFogT68Qt+5uetk7ZTkHTzc44bb48Vp+WkMTRZ4T1xqiZtPLe6/cnGnxBeFMUoutRO3rtauSJjba8DzSyNwhKQjC1rVxhsnSqdQK+hjJJ84fgR8tipGYELWTwvD4UKSn+1UqLfTBK/DfEreSFgJ25m7KT+qo0Z86soNY=
[AVG.IDP.MONITOR] ERROR 2013-05-12 13:47:55,371 KUNDEN-NB PID:3488 THID:3536 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-14 19:24:47,256 KUNDEN-NB PID:3336 THID:3340 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002000442064bAHgnCwC+BMj/+H/woA5wu88KFzEt/8as4+aVwpDQv96jtE6tmjGclbZKY0VIgKE61Rs96jQLDg7P0IeBYsTU2Nv+3eFjcIbljvA2hcqeyW7Pyei/cHRiRWshPqxYAPCBCvgaYNJ9gpz8qVjbipPnSVaNJ28kdscO5DpDBtgPTq0swMewfGbXKrMUqqFMMnyEl0XAxAAgndDGLWLyqkpbgyHG4C97umWVTVg4dLVmKWcyRbLmDQIIrpMBFskcvrgOG4LW07b8yDqUpqxnognnMkG8SZpsvYywrcxU6VTdaiITq0IxgzGqP6EajFmMFetQ9HSpqCoVz3a5rbxiOJAmvgA=
[AVG.IDP.MONITOR] ERROR 2013-05-14 19:25:07,209 KUNDEN-NB PID:3336 THID:3928 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-16 19:06:54,128 KUNDEN-NB PID:2344 THID:2576 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002010993360bABEGjXPvLNAGnDJ/HwCg+SZ+j+WJ8k9bRi9cnmx/06GVOttahxn6lxfsaPO3+U2PwtirYzJBIxEFxtChO7ElzMJnrlDay6hyc9ZXL0EPmOs0z/KvE4K2G6nkxjwx5rz/CEWKXDyP89yBDIDiRgvq7ivX230aHPoXXupsFE19Y9O8CxgWK9kQjaTPULKFCxBWTur9dD1F/F7UZtHnYtrAtX1Z5XBsa+YsT7v1PV2Z6n0g6IwGNy9Tges0/ifBem0H5GMvLV4CB8NVJdSEU6XhXscWELl+bo+rbpp7GgqZ7WBdZkoKqP/38u9A0kY2HbLb8DDmQdjN+kwKfBEV1XQ4AaQ=
[AVG.IDP.MONITOR] ERROR 2013-05-16 19:07:15,001 KUNDEN-NB PID:2344 THID:4700 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-20 06:33:23,734 KUNDEN-NB PID:3880 THID:3884 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002005160656bAMzUQvZ+eRyGL715b32z0JkyNR5F4BpBwzGoUa4ap0FgXwCj1Nr8J9DjjY086Nhff4cHex5okGq/U/h4E76T7tCYqj8oQ6p5yEhKyjDuQSBV4tZHdE0DJzFChlkl0Q6LkMp0qfMYMQlmUFeKbxauo+u9/HDjaH1dXHQ99AmR0whGeoPDQ6SHmYq8pt/tdZrl8n5I4BfNlDFVJlMYOa6rdE4ziD7uh4Op8FFK5e7CgVIY01zkkzT005mXOWPMBjo/bU2/qFO4oXYyQqpNIRW2yMzBOtFzBjnTjJcVqYzNAxGp6ceaOBTYEeKfRliBSH6TFt5HRSZWtMxnfSffVNQ9158=
[AVG.IDP.MONITOR] ERROR 2013-05-20 06:33:31,659 KUNDEN-NB PID:3880 THID:4160 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-21 20:41:31,997 KUNDEN-NB PID:3360 THID:3364 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002011058896bAJuaXNh6YZYadm+6EFb9BJmmmeLrI/Cs24Hat64wiUXcFRsmC/IZVoa0asLQJgNOa3jdo8LAXkI6gbRCt6BNWho3zdy9xG/DFTAQh+NLnT0PsZbqLD5BgAs4tKOaj3rEm3qPVR1UTLisnpGO1af6WLgzWaUAoFbMJ4d+Q4M5K1y6OoZD/lD4TM6tE42wh7EEfIgF90MiniSzlZvbRF9h+6VFMgz2qwaJh2y79g7xv1be+IwHT7E5pZ6EGRQqNNdAJSufhrHhj4tu8L/0C2XwvsuvssqJV5GphbSQSDbAnOLqfJzm2O2UJ/Cvagaw+MdMHkxzMvPIXBAE8ZPZ9fNfhzI=
[AVG.IDP.MONITOR] ERROR 2013-05-21 20:41:32,902 KUNDEN-NB PID:3360 THID:3460 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-21 20:52:02,768 KUNDEN-NB PID:4740 THID:6100 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002011058896bAKj8V1TfrcYvjjjtrksQbB+2LsfJGrTQpW4ipGbYsgQ3DQzLTq8PN77yGnM4KEczRbgOlDp3gIHG+6le5w8xcQggA73TECEwv1NM1fa/Q7sW7U3C10b7IC92YYyp/gr80WZJssZyhDlTb3QBH4Xy/bOuGAsTVVjymyLJdYNELvS3vK9jPco9xmgz5gUxltFoNIC+k1ZqGQ1OsRoKXIiSFl8N4CxCM4aS5LWyTPXcfywlFOfFUoyhgnTeYlsBAJSgrFpA/c0tsd5e8j7j+6uJP090gChJoWJ4hm0vtvyR21zfQvg1wmZhDoBK3aYm19NRlFB4oYWXebRHcc7Vh2IqYDs=
[AVG.IDP.MONITOR] ERROR 2013-05-21 20:52:07,714 KUNDEN-NB PID:4740 THID:3620 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-24 18:23:09,096 KUNDEN-NB PID:3640 THID:3644 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002006995664bACXhtUT11rFXBjER6AjD2tm0aZYlnjInVehuY6LCpkRkm4eYUFB7Bn4WQe4hid6M/8+5ywJPFGh3zYAY7hCBTKDxmmX2XeQNsYTLr8BQeYwynZlWTwQE0hnuXc5go/G6J8vVrps2TmTJ+2GRmh5kpgqrfoo9XacAQloxB1O/7ueg8sKD6tnDd5qfo+d/YvzQmra5FYaeER13EnyaL/tkpWwewj2h2auKbHlQfKExT4rAyclQTCaVBr/ZO/+HN/Rw9wFq/QrNaK9zDxwio1qzyf6sO8IKdxCGEmESgJ9XSFokmozYFd2bH6etG05ldvBFwkmOeiqPO79PcD1lWVqboxA=
[AVG.IDP.MONITOR] ERROR 2013-05-24 18:23:17,333 KUNDEN-NB PID:3640 THID:2160 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*
[AVG.LOG.SM] ALL 2013-05-24 20:21:47,679 KUNDEN-NB PID:3452 THID:3620 ID:AVG.LOG.SM:0.0.0.0 MSG:c00000000002012631760bAIHUJXSTdxX8FQsRMIWBVRpjwAPh/xCxcpOOG1eOGG4M1+eJu1GIsfqX+c0SKMYy+wIfrqi5phqz4XqEIyrJ6tJloeXttZojNHPVvjS9xm7Mf1WO5sEGANmONI6R8LDQV3darIrL0Yh3mlExGA4B1uh/SbLBvtmiltzEeeSPRSO8S7tAHx4SRaGEJEk3lZw1YnlvQOE0Yara2PAP62iWMtTsp3J6vyYH0En19Our8adGRzz5/KM1iDnP4QUAKXsMjnkgYkrlqfawiGyF6LXQn1256L6nG/KFM57jMQQXZJuRy2sQL6cW9Hh4CH5KTWZv1duIx33Rnyi5yEGN9Y1HdLM=
[AVG.IDP.MONITOR] ERROR 2013-05-24 20:21:56,743 KUNDEN-NB PID:3452 THID:2052 ID:{C98F6E41-290D-48ec-87CA-2AF8A86A920B}:63.3211.72e7281.0 MSG:*

Weiterhin gibt's von gestern Abend bzw heute morgen noch zahlreiche weitere Logs.
Ist sehr umfangreich, soll ich die alle posten? Helfen die?
Hier einfach mal die Aufstellung der Logs:
krnlapi.log
avgcfg.log
avgcore.log
avgdecider.log
avgmsgdisp.log
lng.log
avgual.log
avgui.log

cosinus · 25.05.2013, 19:11

Pack mal bitte alle Logs zusammen in eine ZIP-Datei und poste diese hier

Andy.pol · 26.05.2013, 07:16

Hallo,

anbei die Zip-Datei.
Einige Log-files liessen sich nicht direkt zippen, sondern mussten erst zwischengespeichert werden (Hinweis: die Datei wird gerade verwendet.).
Gehen dabei für Dich wichtige Infos verloren?
Der Änderungsdatumstempel wurde dabei aber anscheinaén nicht verändert...

Viele Grüße
Andy.pol

cosinus · 26.05.2013, 18:11

Hilft nicht so wirklich weiter...

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.
Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.
Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!
Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!
Die Logs der aufgegebenen Tools wie zB Malwarebytes sind immer zu posten - egal ob ein Fund dabei war oder nicht!
Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.

Erstmal eine Kontrolle mit OTL bitte:

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Setze oben mittig den Haken bei Scanne alle Benutzer
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in CODE-Tags in den Thread.

Andy.pol · 26.05.2013, 19:18

Hallo cosinus,

hier die beiden Codes:

1. Extras.txt:
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 26.05.2013 19:56:23 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kunde\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,73 Gb Available Physical Memory | 57,81% Memory free
6,18 Gb Paging File | 4,91 Gb Available in Paging File | 79,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 110,46 Gb Total Space | 18,43 Gb Free Space | 16,68% Space Free | Partition Type: NTFS
Drive D: | 58,95 Gb Total Space | 56,95 Gb Free Space | 96,61% Space Free | Partition Type: NTFS
Drive F: | 53,71 Gb Total Space | 48,89 Gb Free Space | 91,03% Space Free | Partition Type: NTFS
Drive H: | 9,76 Gb Total Space | 5,18 Gb Free Space | 53,04% Space Free | Partition Type: FAT32
 
Computer Name: KUNDEN-NB | User Name: Kunde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3796133184-2747058595-3010327798-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Fotoschau] -- "C:\Program Files\Pixum\Pixum Fotobuch\Fotoschau.exe" -d "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [Pixum Fotobuch] -- "C:\Program Files\Pixum\Pixum Fotobuch\Pixum Fotobuch.exe" "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2100927C-AA69-40C3-8DA8-B479A735921F}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2306831E-255A-47C5-A812-B95C2CFEE616}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{2A419F32-7016-4090-9E5A-86EBBA5B7972}" = rport=445 | protocol=6 | dir=out | app=system | 
"{2C60DFE5-D5CC-4AAA-A330-74D7CB181231}" = lport=138 | protocol=17 | dir=in | app=system | 
"{4E040D2C-9799-4045-A8EE-4EDC4B5EBCC5}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{4E4951D3-7738-4993-BC88-F68081F10895}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{50AE9CAE-6605-453E-96C7-EF303B5F8B51}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{9AA4A9E5-5484-4A1B-A026-74649CA5BB08}" = lport=137 | protocol=17 | dir=in | app=system | 
"{A732B9E9-77ED-4DB5-B169-CCF01F685E6F}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{A76BD92C-D189-496A-BD1C-D33C35BF8A81}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{AAD6A4E3-A726-4873-96C3-8F2DAA8D29A6}" = rport=138 | protocol=17 | dir=out | app=system | 
"{CA1462C1-8CF6-4054-B81F-A183042C1B62}" = rport=137 | protocol=17 | dir=out | app=system | 
"{CA92FC4B-0852-497D-89F0-8236210DE156}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{D4164324-852C-4D4A-8E60-381F36B6C53B}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E63DDA9E-031B-4D7C-B87D-B910C4A7BA16}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{FAB3B3CC-3B15-4F79-8B46-071FCEB5C50A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FCD288C0-EE17-4833-8322-AD7C54373708}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FFCB2962-FD28-4C91-971D-9051B72B23FB}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00C99E77-959D-4797-9717-724F5AFB746C}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{02FBA099-4233-4F47-ADED-7116C3527109}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{031E4CE3-1DA5-4E4C-A74B-74BD3A801C0B}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{0428CE89-1890-4A28-BDCB-BAA405FB809D}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{0AFF8459-A8D6-4EF2-A626-FEC774618D54}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{0D43363D-92ED-445F-B8FD-8C300D6B2F05}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | 
"{129C66F3-9367-4F38-9C2B-463D0149488B}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{15B57D51-1A2B-4099-9A26-1EB05AA2B0EF}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{16C325B6-C746-4FAC-8E3C-71F522C85DE7}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{179CFAC8-86A6-407B-B61F-1116F2A21084}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe | 
"{34309FE9-F7FF-4181-9898-3BFCF5CACC7C}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{3C40E26A-81BA-42C9-BB8D-83576CF3B42A}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{4824F4D2-A191-497B-B3B7-1915285EB535}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{4BA7A064-4A85-48D5-BE5E-748A3D3ECAF3}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe | 
"{5A1861B5-2931-47F8-94FF-83ABBA044A6F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{5B8F169E-9FEC-4B7C-B82A-C346EBF70A58}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5BFE093C-85A1-4687-BC50-0F00A845E45B}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{5D8C4685-E8BE-43CA-ABA0-40C5E19BC881}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{6A3DD61B-0381-4BC6-8118-E26D0029E130}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{715B9EFC-7781-42B7-A78B-AE6377DD6826}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{76F504B7-74F2-4953-B054-02F7A672AD64}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{7748DFD2-BD1C-4315-AF16-36F9139AE3AA}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{7CDCBAB2-8D30-4E2B-8C5E-AB2FE44057B4}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{7EC47210-66D9-4DFF-9816-6C6B733EFCE1}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe | 
"{8EFAC1FA-AB50-4581-8696-785BFB26405E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{94E3A127-AA67-4730-A329-814C2879B6D3}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe | 
"{9605CD4F-5AA7-4514-AD37-ED4391BDA7C0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{BC951AA7-3A52-4D29-B00F-D8938F69B4BB}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{C0A5BFF6-9DAF-4441-AD3F-3E75D091613D}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe | 
"{C0C42204-5890-49B8-A36A-669037E25138}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe | 
"{C882259A-5AD8-4183-B516-132E55B816CC}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{CA2D3F9D-BA19-4631-9DB0-FD9343969CF3}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{DB763D00-4627-456C-907C-70F7D62EB182}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F595A28A-7C67-4FC9-A5BE-AAAAB82AD426}" = dir=in | app=c:\program files\asustek\asusdvd\powerdvd.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID-Anmelde-Assistent
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserProtect
"{1C8521E5-5A7B-4A4E-A9CD-AD53116EAEE0}" = ASUS Data Security Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EF8BE6A-899C-4196-94E7-297C5F7A203E}" = pdfforge Toolbar v1.1.1
"{554A4E80-0002-2006-0407-11FF59A27A18}" = 3D-Garten 8.0
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.55.03
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{62CF8923-31DC-4285-A23C-17CE5AA6A679}" = Express Gate
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = ASUSDVD
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus
"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{959282E3-55A9-49D8-B885-D27CF8A2FD82}" = PHOTOfunSTUDIO 5.0
"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}" = Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
"{B3A1BF34-A336-450D-BC3E-3A854AD270A0}" = AVG 2013
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{DC905847-D537-427F-BF91-47CC7ACCDE58}" = ASUS FancyStart
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{DEE76D44-8D7C-4A32-8FAE-A813817631FC}" = AVG 2013
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"AVG" = AVG 2013
"ElsterFormular für Privatanwender 12.2.1.6570p" = ElsterFormular für Privatanwender
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.2.430
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"Kobo" = Kobo
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Pixum Fotobuch" = Pixum Fotobuch
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"ScreenshotCaptor_is1" = Screenshot Captor 2.72.01
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TagScanner_is1" = TagScanner 5.1.635
"TVWiz" = Intel(R) TV Wizard
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"VLC media player" = VideoLAN VLC media player 0.8.6a
"WinRAR archiver" = WinRAR Archivierer
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 04.05.2013 10:14:59 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 05.05.2013 00:40:58 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 05.05.2013 10:30:14 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 07.05.2013 14:34:16 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 08.05.2013 14:42:25 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.05.2013 02:20:59 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.05.2013 02:55:00 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.05.2013 13:01:01 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 11.05.2013 07:35:27 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 11.05.2013 14:45:17 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.05.2013 02:36:20 | Computer Name = Kunden-NB | Source = WinMgmt | ID = 10
Description = 
 
[ OSession Events ]
Error - 01.12.2010 21:28:28 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 01.12.2010 21:34:30 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 01.12.2010 21:34:32 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 01.12.2010 21:57:17 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 01.12.2010 22:03:56 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 01.12.2010 22:04:11 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 07.12.2010 17:57:17 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 07.12.2010 17:57:21 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 19.12.2010 02:06:26 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 10.03.2012 11:57:25 | Computer Name = Kunden-NB | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 760
 seconds with 360 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 25.05.2013 00:20:00 | Computer Name = Kunden-NB | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
 werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner 
Fehler ist im Speicher-Manager aufgetreten.
 
Error - 25.05.2013 00:20:41 | Computer Name = Kunden-NB | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 25.05.2013 00:35:19 | Computer Name = Kunden-NB | Source = Service Control Manager | ID = 7006
Description = 
 
Error - 26.05.2013 01:47:01 | Computer Name = Kunden-NB | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 26.05.2013 01:47:46 | Computer Name = Kunden-NB | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
Error - 26.05.2013 01:49:41 | Computer Name = Kunden-NB | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
 werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner 
Fehler ist im Speicher-Manager aufgetreten.
 
Error - 26.05.2013 01:49:44 | Computer Name = Kunden-NB | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
 werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner 
Fehler ist im Speicher-Manager aufgetreten.
 
Error - 26.05.2013 02:18:37 | Computer Name = Kunden-NB | Source = Service Control Manager | ID = 7006
Description = 
 
Error - 26.05.2013 13:51:10 | Computer Name = Kunden-NB | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 26.05.2013 13:52:12 | Computer Name = Kunden-NB | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description = 
 
 
< End of report >

--- --- ---

[/CODE]

2. OTL.txt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 26.05.2013 19:56:23 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kunde\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 1,73 Gb Available Physical Memory | 57,81% Memory free
6,18 Gb Paging File | 4,91 Gb Available in Paging File | 79,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 110,46 Gb Total Space | 18,43 Gb Free Space | 16,68% Space Free | Partition Type: NTFS
Drive D: | 58,95 Gb Total Space | 56,95 Gb Free Space | 96,61% Space Free | Partition Type: NTFS
Drive F: | 53,71 Gb Total Space | 48,89 Gb Free Space | 91,03% Space Free | Partition Type: NTFS
Drive H: | 9,76 Gb Total Space | 5,18 Gb Free Space | 53,04% Space Free | Partition Type: FAT32
 
Computer Name: KUNDEN-NB | User Name: Kunde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Kunde\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe (AVG Secure Search)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\PROGRA~1\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\System32\FsUsbExService.Exe (Teruten)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\ASScrPro.exe ()
PRC - C:\Program files\P4G\BatteryLife.exe (ATK)
PRC - C:\Program Files\ASUS\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files\ASUS\SmartLogon\sensorsrv.exe (ASUS)
PRC - C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)
PRC - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
PRC - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)
PRC - C:\Program Files\ASUS\ATK Hotkey\WDC.exe ()
PRC - C:\Program Files\ASUS\ASUS Live Update\ALU.exe ()
PRC - C:\Program Files\ASUS\ATK Hotkey\MsgTranAgt.exe ()
PRC - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe ()
PRC - C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exe ()
PRC - C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
PRC - C:\Program Files\Wireless Console 2\wcourier.exe ()
PRC - C:\Windows\System32\ACEngSvr.exe (ASUSTeK)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\SiteSafety.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\Windows\ASScrPro.exe ()
MOD - C:\Program files\P4G\OvrClk.dll ()
MOD - C:\Program files\P4G\DevMng.dll ()
MOD - C:\Program Files\ASUS\ASUS Live Update\ALU.exe ()
MOD - C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll ()
MOD - C:\Program Files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll ()
MOD - C:\Program Files\ATKGFNEX\AGFNEX.dll ()
MOD - C:\Program Files\WinRAR\rarext.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (BrowserProtect) -- BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe File not found
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (vToolbarUpdater15.2.0) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe (AVG Secure Search)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVGIDSAgent) -- C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) -- C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (Symantec Core LC) -- C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe ()
SRV - (ADSMService) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe ()
SRV - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (cpuz132) -- C:\Users\Kunde\AppData\Local\Temp\cpuz132\cpuz132_x32.sys File not found
DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (AVGIDSDriver) -- C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) -- C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) -- C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) -- C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) -- C:\Windows\System32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSHX) -- C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) -- C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) -- C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (AsDsm) -- C:\Windows\System32\drivers\AsDsm.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (ASMMAP) -- C:\Program Files\ATKGFNEX\ASMMAP.sys ()
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (w800bus) -- C:\Windows\System32\drivers\w800bus.sys (MCCI)
DRV - (w800obex) -- C:\Windows\System32\drivers\w800obex.sys (MCCI)
DRV - (w800mgmt) -- C:\Windows\System32\drivers\w800mgmt.sys (MCCI)
DRV - (w800mdm) -- C:\Windows\System32\drivers\w800mdm.sys (MCCI)
DRV - (w800mdfl) -- C:\Windows\System32\drivers\w800mdfl.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=ACF600224383E24B
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-search.com/?affID=119357&tt=gc_&babsrc=HP_ss&mntrId=ACF600224383E24B
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - SOFTWARE\Classes\CLSID\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}\InprocServer32 File not found
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.delta-search.com/?q={searchTerms}&affID=119357&tt=gc_&babsrc=SP_ss&mntrId=ACF600224383E24B
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\SearchScopes\{7D4539A9-D7B3-4C67-ADD7-A5BAFC5DAE18}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=971163&p={searchTerms}
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={781D00EA-C90D-4D1B-8CEE-BA25AD70A5FE}&mid=eed53fe6d2c647d1866cd16dca271746-a85c00a43e7d751f46570975110c117d80ce1390&lang=de&ds=AVG&pr=fr&d=2012-10-18 20:24:17&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: avg%40toolbar:15.2.0.5
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\15.2.0.5 [2013.05.21 22:41:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.24 20:56:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.05.24 20:56:00 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.24 20:56:12 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.05.24 20:56:00 | 000,000,000 | ---D | M]
 
[2012.02.01 21:27:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kunde\AppData\Roaming\mozilla\Extensions
[2009.09.26 13:01:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kunde\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2013.05.24 20:52:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kunde\AppData\Roaming\mozilla\Firefox\Profiles\caserjqh.default\extensions
[2013.05.24 20:39:30 | 000,006,503 | ---- | M] () -- C:\Users\Kunde\AppData\Roaming\mozilla\firefox\profiles\caserjqh.default\searchplugins\babylon.xml
[2013.05.24 20:39:45 | 000,001,294 | ---- | M] () -- C:\Users\Kunde\AppData\Roaming\mozilla\firefox\profiles\caserjqh.default\searchplugins\delta.xml
[2013.05.24 20:56:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2013.05.24 20:55:58 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Program Files\mozilla firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2013.05.24 20:55:57 | 000,000,000 | ---D | M] (Search Settings Plugin) -- C:\Program Files\mozilla firefox\extensions\search@searchsettings.com
[2013.05.24 20:56:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions
[2013.05.24 20:56:12 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.05.21 22:41:53 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\PROGRAMDATA\AVG SECURE SEARCH\FIREFOXEXT\15.2.0.5
[2011.03.06 09:31:47 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2013.05.21 22:41:58 | 000,003,714 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll File not found
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll File not found
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Reg Error: Value error.) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\pdfforge Toolbar\SearchSettings.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll File not found
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3796133184-2747058595-3010327798-1000..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe File not found
O4 - Startup: C:\Users\Kunde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Inhaltsverzeichnis.onetoc2 ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Kunde\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{240CE465-C3AF-4234-A791-2C2008F083F1}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll (AVG Secure Search)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (browse~1\261249~1.132\{c16c1~1\browse~1.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{6648191f-e2ca-11df-8a0e-00248cc3feb5}\Shell\AutoRun\command - "" = G:\installer.exe
O33 - MountPoints2\{6648191f-e2ca-11df-8a0e-00248cc3feb5}\Shell\verb\command - "" = G:\installer.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.26 19:55:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Kunde\Desktop\OTL.exe
[2013.05.24 21:20:23 | 000,000,000 | ---D | C] -- C:\Users\Kunde\Local Settings
[2013.05.24 20:55:56 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.05.24 20:40:15 | 000,000,000 | ---D | C] -- C:\Users\Kunde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
[2013.05.24 20:39:16 | 000,000,000 | ---D | C] -- C:\Users\Kunde\AppData\Roaming\DSite
[2013.05.24 20:39:13 | 000,000,000 | ---D | C] -- C:\Users\Kunde\AppData\Roaming\Babylon
[2013.05.24 20:39:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013.05.22 22:24:04 | 000,000,000 | ---D | C] -- C:\Users\Kunde\AppData\Roaming\TagScanner
[2013.05.22 22:24:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TagScanner
[2013.05.22 22:23:59 | 000,000,000 | ---D | C] -- C:\Program Files\TagScanner
[2013.05.21 22:50:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2013.05.14 22:37:39 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.05.14 22:33:44 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.05.14 22:33:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.05.14 22:33:44 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.05.14 22:33:44 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.05.14 22:33:43 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.05.14 22:33:43 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.05.14 22:33:42 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.05.14 21:37:48 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2013.05.14 21:37:44 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013.05.12 16:05:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\3D-Garten 8.0
[2013.05.12 15:57:22 | 000,000,000 | ---D | C] -- C:\Users\Kunde\Documents\3D-Garten 8.0 Beispiele
[2013.05.12 15:54:07 | 000,000,000 | ---D | C] -- C:\ProgramData\GARTEN8C
[2013.05.12 15:54:07 | 000,000,000 | ---D | C] -- C:\Program Files\3D-Garten 8.0
[2013.05.08 23:37:28 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2013.05.08 23:00:50 | 000,000,000 | ---D | C] -- C:\Users\Kunde\AppData\Roaming\OpenCandy
[2013.05.08 23:00:50 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.26 19:57:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.26 19:55:04 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kunde\Desktop\OTL.exe
[2013.05.26 19:50:15 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2013.05.26 19:50:10 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.26 19:50:07 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.26 19:49:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.26 19:49:46 | 3212,042,240 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.26 08:18:39 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.05.26 07:53:47 | 000,002,631 | ---- | M] () -- C:\Users\Kunde\Desktop\Microsoft Office Word 2007.lnk
[2013.05.24 22:20:53 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2013.05.24 20:39:16 | 000,000,286 | ---- | M] () -- C:\Windows\tasks\DSite.job
[2013.05.22 22:24:00 | 000,000,817 | ---- | M] () -- C:\Users\Kunde\Desktop\TagScanner.lnk
[2013.05.21 22:50:19 | 000,000,864 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013.05.21 22:41:02 | 000,037,664 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2013.05.20 13:07:23 | 000,682,590 | ---- | M] () -- C:\Users\Kunde\Desktop\23442_xxx_Aupl_HSB_PDF.pdf
[2013.05.20 11:43:58 | 000,765,985 | ---- | M] () -- C:\Users\Kunde\Desktop\Bild 3 001.jpg
[2013.05.20 11:42:38 | 000,794,069 | ---- | M] () -- C:\Users\Kunde\Desktop\Bild 2 001.jpg
[2013.05.20 11:40:32 | 001,055,633 | ---- | M] () -- C:\Users\Kunde\Desktop\Bild 1 001.jpg
[2013.05.20 08:58:10 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.05.20 08:58:10 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.05.16 21:12:18 | 000,623,280 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.16 21:12:18 | 000,591,320 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.16 21:12:18 | 000,125,378 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.16 21:12:18 | 000,103,194 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.16 21:05:33 | 000,270,792 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.05.12 16:05:04 | 000,001,695 | ---- | M] () -- C:\Users\Public\Desktop\3D-Garten 8.0.lnk
[2013.05.12 11:04:49 | 000,120,666 | ---- | M] () -- C:\Users\Kunde\Desktop\Grundriss_Carport_und_Garage.pdf
[2013.05.12 11:03:57 | 003,729,960 | R--- | M] () -- C:\Users\Kunde\Desktop\%0d%0a Garage_und_Carport_in_grautönen.jpg
[2013.05.10 19:09:24 | 000,002,633 | ---- | M] () -- C:\Users\Kunde\Desktop\Microsoft Office Excel 2007.lnk
[2013.05.08 23:01:08 | 000,001,197 | ---- | M] () -- C:\Users\Kunde\Desktop\Free YouTube to MP3 Converter.lnk
[2013.05.05 21:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.04.28 19:40:29 | 000,000,806 | ---- | M] () -- C:\Users\Public\Desktop\Kobo.lnk
 
========== Files Created - No Company Name ==========
 
[2013.05.24 20:39:16 | 000,000,286 | ---- | C] () -- C:\Windows\tasks\DSite.job
[2013.05.22 22:24:00 | 000,000,817 | ---- | C] () -- C:\Users\Kunde\Desktop\TagScanner.lnk
[2013.05.20 13:07:18 | 000,682,590 | ---- | C] () -- C:\Users\Kunde\Desktop\23442_xxx_Aupl_HSB_PDF.pdf
[2013.05.20 11:43:58 | 000,765,985 | ---- | C] () -- C:\Users\Kunde\Desktop\Bild 3 001.jpg
[2013.05.20 11:42:38 | 000,794,069 | ---- | C] () -- C:\Users\Kunde\Desktop\Bild 2 001.jpg
[2013.05.20 11:40:32 | 001,055,633 | ---- | C] () -- C:\Users\Kunde\Desktop\Bild 1 001.jpg
[2013.05.12 16:05:04 | 000,001,695 | ---- | C] () -- C:\Users\Public\Desktop\3D-Garten 8.0.lnk
[2013.05.12 11:04:48 | 000,120,666 | ---- | C] () -- C:\Users\Kunde\Desktop\Grundriss_Carport_und_Garage.pdf
[2013.05.12 11:03:48 | 003,729,960 | R--- | C] () -- C:\Users\Kunde\Desktop\%0d%0a Garage_und_Carport_in_grautönen.jpg
[2013.05.08 23:01:08 | 000,001,197 | ---- | C] () -- C:\Users\Kunde\Desktop\Free YouTube to MP3 Converter.lnk
[2013.03.11 21:05:05 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2013.03.11 21:05:05 | 000,037,344 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2012.05.24 01:49:44 | 000,142,111 | ---- | C] () -- C:\Users\Kunde\ESt2011_xxx.elfo
[2011.05.23 22:42:23 | 000,146,064 | ---- | C] () -- C:\Users\Kunde\ESt2010_xxx.elfo
[2010.07.06 21:26:44 | 000,178,322 | ---- | C] () -- C:\Users\Kunde\xxx 2009.elfo
[2010.06.28 00:24:17 | 000,000,211 | -HS- | C] () -- \boot.ini
[2010.06.27 22:52:12 | 000,000,000 | RHS- | C] () -- \MSDOS.SYS
[2010.06.27 22:52:12 | 000,000,000 | RHS- | C] () -- \IO.SYS
[2009.10.05 15:07:56 | 000,000,058 | ---- | C] () -- C:\Users\Kunde\AppData\Local\DonationCoder_ScreenshotCaptor_InstallInfo.dat
[2009.07.04 14:58:51 | 000,025,600 | ---- | C] () -- C:\Users\Kunde\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.07.03 02:48:14 | 3212,042,240 | -HS- | C] () -- \hiberfil.sys
[2009.01.14 04:23:17 | 000,000,027 | ---- | C] () -- \Driver.20
[2008.12.09 08:37:37 | 001,048,576 | RH-- | C] () -- \X58LE.BIN
[2008.11.06 05:14:01 | 000,000,022 | ---- | C] () -- \RECOVERY.DAT
[2008.04.16 11:45:26 | 000,008,192 | R-S- | C] () -- \BOOTSECT.BAK
[2008.04.16 11:45:24 | 000,333,257 | RHS- | C] () -- \bootmgr
[2008.04.14 14:00:00 | 000,251,712 | RHS- | C] () -- \ntldr
[2008.04.14 14:00:00 | 000,047,564 | RHS- | C] () -- \NTDETECT.COM
[2008.04.14 14:00:00 | 000,004,952 | RHS- | C] () -- \bootfont.bin
[2006.11.02 12:23:09 | 000,000,024 | ---- | C] () -- \autoexec.bat
[2006.11.02 08:25:08 | 000,000,010 | ---- | C] () -- \config.sys
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.11.01 21:26:43 | 000,000,000 | ---D | M] -- C:\Users\Default\AppData\Roaming\TuneUp Software
[2012.11.01 21:26:43 | 000,000,000 | ---D | M] -- C:\Users\Default User\AppData\Roaming\TuneUp Software
[2012.10.18 20:27:45 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\AVG2013
[2013.05.24 20:39:13 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\Babylon
[2009.10.05 15:07:56 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\DonationCoder
[2013.05.24 20:39:16 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\DSite
[2013.05.08 23:01:04 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\DVDVideoSoft
[2011.12.25 23:08:43 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.05.24 00:05:03 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\elsterformular
[2011.03.10 00:40:42 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\FMA
[2011.03.10 01:28:01 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\MyPhoneExplorer
[2013.05.08 23:00:50 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\OpenCandy
[2013.05.14 22:25:00 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\Samsung
[2013.05.22 22:24:04 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\TagScanner
[2012.05.09 21:25:18 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\Temp
[2009.09.26 13:01:41 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\TomTom
[2012.10.18 20:24:33 | 000,000,000 | ---D | M] -- C:\Users\Kunde\AppData\Roaming\TuneUp Software
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

[/CODE]

Viele Grüße

Andy.pol

cosinus · 26.05.2013, 19:19

Rootkitscan mit GMER

Bitte lade dir

GMER herunter: (Dateiname zufällig)

Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?

Unbedingt auf "No" klicken.
Entferne rechts den Haken bei: IAT/EAT und Show All
Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
Starte den Scan mit "Scan".
Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Tauchen Probleme auf?

Probiere alternativ den abgesicherten Modus.
Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.

Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Andy.pol · 26.05.2013, 19:37

Hallo,
habe GMER nach deiner Anweisung gestartet.
Jetzt kommt die Fehlermeldung 'gmer-2.1.19163.exe funktioniert nicht mehr.'
Und die Frage, ob ich das Programm schließen will. Die Sanduhr läuft. Ich habe das Programm jetzt noch nicht geschlossen.
Was soll ich machen?

Keine Sorge, bin mit dem Handy hier im Netz. ..

Andy.pol

24.05.2013, 21:44	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	System-Wiederherstellung nicht mehr möglich, programm browserprotect bit 89 neu und lässt sich nicht entfernen Hättest du mal AVG-Version und dein Betriebssystem genannt, wär es schon mal einfacher __________________ --> System-Wiederherstellung nicht mehr möglich, programm browserprotect bit 89 neu und lässt sich nicht entfernen

24.05.2013, 22:25	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	System-Wiederherstellung nicht mehr möglich, programm browserprotect bit 89 neu und lässt sich nicht entfernen Ja das ist gut. Schau ob du hier die Logs findest: Code: ATTFilter C:\Users\<dein Benutzername>\AppData\Local\Avg2013\ __________________ Logfiles bitte immer in CODE-Tags posten

25.05.2013, 19:11	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	System-Wiederherstellung nicht mehr möglich, programm browserprotect bit 89 neu und lässt sich nicht entfernen Pack mal bitte alle Logs zusammen in eine ZIP-Datei und poste diese hier __________________ Logfiles bitte immer in CODE-Tags posten

System-Wiederherstellung nicht mehr möglich, programm browserprotect bit 89 neu und lässt sich nicht entfernen

Plagegeister aller Art und deren Bekämpfung: System-Wiederherstellung nicht mehr möglich, programm browserprotect bit 89 neu und lässt sich nicht entfernen