Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Log-Analyse und Auswertung: Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 08.10.2013, 20:15   #1
tixi
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Hallo Leute,

ich habe ein Problem mit meinem Computer, ich werde bei der Googlesuche ständig auf andere Seiten weitergeleitet und komme beim klicken auf den Link nicht mehr auf die gewünsche Seite.
Im Browser wird die ihavenet Seite angezeigt.

Ich hoffe einer von euch kann mir helfen!?

Hier nun die geforderten Datein!!

defogger

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:35 on 08/10/2013 (Bea_PC)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
frst

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by schenke (ATTENTION: The logged in user is not administrator) on BEA-PC on 08-10-2013 20:45:32
Running from C:\Users\schenke\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(O&O Software GmbH) C:\WINDOWS\System32\oodtray.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(ACD Systems) C:\Program Files\Common Files\ACD Systems\DE\DevDetect.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\StCenter.exe
(Dropbox, Inc.) C:\Users\schenke\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\FwebProt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] - [x]
HKLM\...\Run: [WAWifiMessage] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [317128 2007-01-11] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe [1382568 2013-09-16] (Trend Micro Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OODefragTray] - C:\Windows\system32\oodtray.exe [2512392 2007-05-11] (O&O Software GmbH)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [49152 2006-09-29] ()
HKLM\...\Run: [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [472776 2007-03-01] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Conime] - C:\Windows\system32\conime.exe [69120 2009-04-11] (Microsoft Corporation)
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\wlangui.exe [1454080 2006-12-28] (AVM Berlin)
HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [132920 2013-08-29] (Trend Micro Inc.)
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44128 2006-11-08] (soft thinks)
HKLM\...\RunOnce: [DCERegBootClean] - C:\Windows\RegBootClean.exe [181808 2013-10-08] ()
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [484904 2007-04-19] (Hewlett-Packard Company)
HKCU\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [Device Detector] - DevDetect.exe -autorun
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_11_2_202_233_Plugin.exe -update plugin [353440 2012-04-18] (Adobe Systems Incorporated)
MountPoints2: {1f443d3c-8f2d-11dd-8b4f-001a73a7f47a} - G:\pushinst.exe
MountPoints2: {2d5bb31c-ae70-11dd-b61a-001a73a7f47a} - G:\LaunchU3.exe -a
MountPoints2: {528df0dc-5aa3-11e0-839f-001b24a08592} - F:\firefox////report.exe
MountPoints2: {c800dbad-72a3-11e0-823c-001a73a7f47a} - USBS\Open.exe
Startup: C:\Users\Bea_PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files\FRITZ!DSL\FwebProt.exe (AVM Berlin)
Startup: C:\Users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\schenke\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files\FRITZ!DSL\FwebProt.exe (AVM Berlin)
Startup: C:\Users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)
BootExecute: autocheck autochk * OODBS

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.t-online.de/cpm-redir/ie-9.html
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop
SearchScopes: HKLM - {4D8D54C6-8B48-4AA5-BF95-A180ECC71884} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
SearchScopes: HKCU - DefaultScope {30B74494-E60B-414C-8599-9ADFEB3DDEE2} URL = hxxp://suche.t-online.de/fast-cgi/tsc?mandant=toi&device=html&portallanguage=de&userlanguage=de&dia=suche&context=internet-tab&tpc=internet&ptl=std&classification=internet-tab_internet_std&q={searchTerms}&br=ie7-toi
SearchScopes: HKCU - {30B74494-E60B-414C-8599-9ADFEB3DDEE2} URL = hxxp://suche.t-online.de/fast-cgi/tsc?mandant=toi&device=html&portallanguage=de&userlanguage=de&dia=suche&context=internet-tab&tpc=internet&ptl=std&classification=internet-tab_internet_std&q={searchTerms}&br=ie7-toi
SearchScopes: HKCU - {4D8D54C6-8B48-4AA5-BF95-A180ECC71884} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
SearchScopes: HKCU - {5367D1D7-6793-4042-8996-AC9D2239B3BB} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag= interactivemesuche21&index=blended&linkCode=ur2&camp=1638&creative=6742
SearchScopes: HKCU - {8831D5E0-596A-4451-87C0-10504E93CAD0} URL = hxxp://suche.t-online.de/fastcgi/tsc?mandant=toi&device=html&portallanguage=de&userlanguage=de&d ia=suche&context=wiki-tab&tpc=internet&ptl=std&classification=wikitab_internet_std&q={searchTerms}&br=ie7-toi
SearchScopes: HKCU - {92CFE0EC-2ADA-4492-BD69-FBBD33AB2737} URL = hxxp://rover.ebay.com/rover/1/707-1403-276402/4?mpre=hxxp://search.ebay.de/search/search.dll?shortcut=4&query={sear chTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll (Trend Micro Inc.)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: amazon - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\PROGRA~1\PREISP~1\PREISP~1\IEBUTT~2.DLL ()
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} -  No File
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: No Name - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -  No File
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: Preispiraten 4 - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\PROGRA~1\PREISP~1\PREISP~1\IEBUTT~1.DLL ()
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
Winsock: Catalog5 07 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 01 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 02 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 03 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 14 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 83.169.186.33 83.169.186.97

FireFox:
========
FF ProfilePath: C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default
FF Homepage: https://eu.ixquick.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @TrendMicro.com/FFExtension - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll (Trend Micro Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @movenetworks.com/Quantum Media Player - C:\Users\schenke\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks)
FF SearchPlugin: C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\searchplugins\ixquick---deutsch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\SP_preispiraten_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\nostmp
FF Extension: Adobe DLM (powered by getPlus(R)) - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF Extension: No Name - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: Amazon-Startcenter - C:\Program Files\Mozilla Firefox\extensions\{144D1513-0819-4538-AD26-D515AF443AE7}
FF Extension: Google Kontextmen&#252; - C:\Program Files\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Preispiraten4 - C:\Program Files\Mozilla Firefox\extensions\{A86278FF-6B63-446C-B109-DD4E1BAAC868}
FF Extension: Preispiraten 4 Kontextmen&#252; - C:\Program Files\Mozilla Firefox\extensions\{D2A8BC29-8CA3-4C0A-A206-631C44E9620F}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF HKLM\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension
FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\

========================== Services (Whitelisted) =================

R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [356352 2006-12-28] (AVM Berlin)
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [62984 2007-03-14] (Hewlett-Packard)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [87344 2007-09-04] (AVM Berlin)
R2 iphlpsvc; C:\Windows\System32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 O&O Defrag; C:\Windows\system32\oodag.exe [1050120 2007-05-11] (O&O Software GmbH)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-08] ()
R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=nb -dt=60000 -ad [x]
S3 gusvc; "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" [x]
S3 stllssvr; "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe" [x]
S2 TuneUp.UtilitiesSvc; "C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2006-12-28] (AVM Berlin)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [160768 2007-04-12] (Conexant Systems Inc.)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [96736 2013-09-04] (Trend Micro Inc.)
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [263072 2013-09-04] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [38328 2012-08-24] (Trend Micro Inc.)
R2 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [83256 2012-12-07] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [76624 2013-09-04] (Trend Micro Inc.)
R2 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [171064 2012-07-06] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
U4 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 neokdss; system32\Drivers\neokdss.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U2 TMAgent; 
S3 TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-08 20:45 - 2013-10-08 20:45 - 01087213 _____ (Farbar) C:\Users\schenke\Desktop\FRST.exe
2013-10-08 20:45 - 2013-10-08 20:45 - 00000000 ____D C:\FRST
2013-10-08 20:38 - 2013-10-08 20:38 - 00003748 _____ C:\Windows\RegBootClean.CFG
2013-10-08 20:35 - 2013-10-08 20:36 - 00000474 _____ C:\Users\schenke\Desktop\defogger_disable.log
2013-10-08 20:35 - 2013-10-08 20:35 - 00000000 _____ C:\Users\Bea_PC\defogger_reenable
2013-10-08 20:30 - 2013-10-08 20:30 - 00377856 _____ C:\Users\schenke\Desktop\gmer_2.1.19163.exe
2013-10-08 20:27 - 2013-10-08 20:27 - 00050477 _____ C:\Users\schenke\Desktop\Defogger.exe
2013-10-08 14:36 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-08 14:36 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-08 14:36 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-08 14:36 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-08 14:36 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-08 14:36 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-08 14:36 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-08 14:36 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-08 14:36 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-08 14:36 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-08 14:36 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-08 14:36 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-08 14:36 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-08 14:36 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-08 14:36 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-08 14:35 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-21 21:09 - 2013-09-21 23:57 - 00000000 ____D C:\Users\schenke\Desktop\Auswahl
2013-09-21 20:54 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-21 20:54 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-09-10 13:10 - 2013-09-10 13:32 - 00000000 ____D C:\Program Files\Microsoft Office
2013-09-10 13:09 - 2013-09-10 13:09 - 00000000 __RHD C:\MSOCache
2013-09-09 17:32 - 2013-09-09 17:32 - 00001840 _____ C:\Users\schenke\Desktop\Skype.lnk
2013-09-09 16:40 - 2013-09-09 16:40 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-09-09 15:44 - 2013-09-09 15:44 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ghostscript
2013-09-09 15:35 - 2013-09-09 15:35 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\IObit

==================== One Month Modified Files and Folders =======

2013-10-08 20:45 - 2013-10-08 20:45 - 01087213 _____ (Farbar) C:\Users\schenke\Desktop\FRST.exe
2013-10-08 20:45 - 2013-10-08 20:45 - 00000000 ____D C:\FRST
2013-10-08 20:38 - 2013-10-08 20:38 - 00003748 _____ C:\Windows\RegBootClean.CFG
2013-10-08 20:38 - 2011-03-25 08:45 - 00181808 _____ C:\Windows\RegBootClean.exe
2013-10-08 20:36 - 2013-10-08 20:35 - 00000474 _____ C:\Users\schenke\Desktop\defogger_disable.log
2013-10-08 20:35 - 2013-10-08 20:35 - 00000000 _____ C:\Users\Bea_PC\defogger_reenable
2013-10-08 20:35 - 2008-09-30 20:22 - 00000000 ____D C:\Users\Bea_PC
2013-10-08 20:30 - 2013-10-08 20:30 - 00377856 _____ C:\Users\schenke\Desktop\gmer_2.1.19163.exe
2013-10-08 20:27 - 2013-10-08 20:27 - 00050477 _____ C:\Users\schenke\Desktop\Defogger.exe
2013-10-08 20:26 - 2008-10-01 00:21 - 00110256 _____ C:\Users\schenke\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-08 20:26 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-08 20:26 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-08 20:24 - 2012-04-18 22:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-08 20:23 - 2007-09-13 15:16 - 01950495 _____ C:\Windows\WindowsUpdate.log
2013-10-08 20:11 - 2010-05-27 16:38 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Dropbox
2013-10-08 20:09 - 2012-03-20 23:04 - 00000388 _____ C:\Windows\Tasks\Final Media Player Update Checker.job
2013-10-08 20:09 - 2011-12-09 13:10 - 00255073 _____ C:\ProgramData\nvModes.dat
2013-10-08 20:09 - 2011-12-09 13:10 - 00255073 _____ C:\ProgramData\nvModes.001
2013-10-08 20:03 - 2013-08-21 12:22 - 00000310 _____ C:\Windows\Tasks\Kedrmqmv.job
2013-10-08 20:03 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-08 20:02 - 2008-10-01 09:54 - 02648498 _____ C:\Windows\system32\oodbs.lor
2013-10-08 14:37 - 2006-11-02 15:01 - 00032582 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-08 14:34 - 2012-04-14 23:02 - 00000000 ____D C:\Users\schenke\AppData\Roaming\FRITZ!
2013-10-08 14:29 - 2006-11-02 14:47 - 00414640 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-07 21:15 - 2011-07-01 21:02 - 00000000 ____D C:\Users\schenke\AppData\Roaming\vlc
2013-10-07 20:32 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-09-21 23:57 - 2013-09-21 21:09 - 00000000 ____D C:\Users\schenke\Desktop\Auswahl
2013-09-21 21:56 - 2006-11-02 12:33 - 01573070 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-10 22:56 - 2008-10-02 15:36 - 00119296 _____ C:\Users\schenke\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-10 14:46 - 2011-01-11 10:43 - 00735458 _____ C:\Windows\PFRO.log
2013-09-10 13:37 - 2007-08-21 19:19 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-10 13:32 - 2013-09-10 13:10 - 00000000 ____D C:\Program Files\Microsoft Office
2013-09-10 13:32 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\ShellNew
2013-09-10 13:31 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\MSBuild
2013-09-10 13:31 - 2006-11-02 13:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-09-10 13:18 - 2007-08-21 19:17 - 00000000 ____D C:\Program Files\Microsoft Works
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-09-10 13:16 - 2008-10-01 14:10 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-09-10 13:10 - 2006-11-02 13:18 - 00000000 ____D C:\Program Files\Common Files\System
2013-09-10 13:10 - 2006-11-02 12:23 - 00000219 _____ C:\Windows\win.ini
2013-09-10 13:09 - 2013-09-10 13:09 - 00000000 __RHD C:\MSOCache
2013-09-10 12:36 - 2011-02-12 19:13 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Skype
2013-09-10 12:31 - 2011-07-22 13:16 - 00000000 ____D C:\Program Files\OpenOffice.org 3
2013-09-10 11:36 - 2007-08-21 19:44 - 00000000 ____D C:\Windows\SMINST
2013-09-10 11:34 - 2010-09-08 20:04 - 00000000 ____D C:\Windows\Minidump
2013-09-09 19:33 - 2013-09-01 02:05 - 00000000 ____D C:\Windows\Microsoft Antimalware
2013-09-09 19:18 - 2012-04-14 22:44 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\FRITZ!
2013-09-09 18:49 - 2008-10-01 00:21 - 00000000 ____D C:\Users\schenke
2013-09-09 18:44 - 2009-04-08 09:40 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Skype
2013-09-09 17:32 - 2013-09-09 17:32 - 00001840 _____ C:\Users\schenke\Desktop\Skype.lnk
2013-09-09 17:25 - 2008-10-01 23:59 - 00000000 ____D C:\Program Files\Winamp
2013-09-09 17:22 - 2008-10-01 09:36 - 00000000 ____D C:\ProgramData\Kodak
2013-09-09 17:21 - 2008-10-01 09:48 - 00002832 _____ C:\Windows\system32\InstallUtil.InstallLog
2013-09-09 17:20 - 2008-10-01 09:51 - 00000000 ____D C:\Windows\system32\kodak
2013-09-09 17:20 - 2007-08-21 18:38 - 00087914 _____ C:\Windows\DPINST.LOG
2013-09-09 17:20 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\twain_32
2013-09-09 17:19 - 2008-10-01 09:40 - 00000000 ____D C:\Program Files\Kodak
2013-09-09 17:19 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Help
2013-09-09 17:01 - 2008-10-01 20:02 - 00000000 ____D C:\Windows\pss
2013-09-09 16:40 - 2013-09-09 16:40 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-09-09 16:40 - 2009-04-08 09:40 - 00000000 ___RD C:\Program Files\Skype
2013-09-09 16:40 - 2009-04-08 09:40 - 00000000 ____D C:\ProgramData\Skype
2013-09-09 16:27 - 2012-04-22 18:16 - 00000000 ____D C:\Program Files\TuneUp Utilities 2012
2013-09-09 16:27 - 2012-03-04 11:07 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-09-09 15:44 - 2013-09-09 15:44 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ghostscript
2013-09-09 15:44 - 2008-09-30 22:35 - 00000000 ____D C:\Users\Bea_PC\AppData\Local\Google
2013-09-09 15:36 - 2008-10-01 08:20 - 00000000 ___RD C:\Users\Bea_PC\Desktop\Wartung&Sicherheit
2013-09-09 15:35 - 2013-09-09 15:35 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\IObit
2013-09-09 15:12 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\LogFiles

Files to move or delete:
====================
C:\Users\schenke\Firefox Setup 3.0.3.exe


Some content of TEMP:
====================
C:\Users\Bea_PC\AppData\Local\Temp\7.6.20.1-EasyShrx.Dll
C:\Users\Bea_PC\AppData\Local\Temp\ose00001.exe
C:\Users\Bea_PC\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Bea_PC\AppData\Local\Temp\TUUUninstallHelper.exe
C:\Users\schenke\AppData\Local\Temp\SkypeSetup.exe
C:\Users\schenke\AppData\Local\Temp\vlc-2.0.8-win32.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
addition

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by schenke at 2013-10-08 20:47:13
Running from C:\Users\schenke\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Trend Micro Titanium Maximum Security (Enabled - Up to date) {B7599298-8445-728A-A5C7-A26A082C8BDA}
AS: Trend Micro Titanium Maximum Security (Enabled - Up to date) {0C38737C-A27F-7D04-9F77-991873ABC167}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

ACDSee Pro 2.5 (Version: 2.5.333)
Adobe Flash Player 10 ActiveX (Version: 10.0.42.34)
Adobe Flash Player 11 Plugin (Version: 11.2.202.233)
Adobe Photoshop CS2 (Version: 9.0)
Adobe Reader 9.4.6 - Deutsch (Version: 9.4.6)
AusLogics Disk Defrag (Version: version 1.4)
AVM FRITZ!DSL (Version: 2.04.02)
AVM FRITZ!WLAN
Bing Bar (Version: 7.0.850.0)
Conexant HD Audio (Version: 4.36.7.61)
DivX-Setup (Version: 2.3.1.2)
Dropbox (HKCU Version: 1.6.16)
EasyFit (Version: 2.00.0000)
ESU for Microsoft Vista (Version: 2.0.5.1)
Final Media Player 2011
Foxit Reader (Version: 3.1.4.1125)
G*Power 3.1.2 (Version: 3.1.2)
HDAUDIO Soft Data Fax Modem with SmartCP
Hewlett-Packard Active Check (Version: 1.1.7.0)
Hewlett-Packard Asset Agent (Version: 2.0.58.0)
HP Active Support Library (Version: 2.0.9.1)
HP Active Support Library 32 bit components (Version: 1.0.9)
HP Customer Experience Enhancements (Version: 5.1.0.2278)
HP Doc Viewer (Version: 1.01.0005)
HP Easy Setup - Frontend (Version: 5.1.0.2279)
HP Help and Support (Version: 1.1.0)
HP Quick Launch Buttons (Version: 6.50.14.1)
HP Update (Version: 5.003.001.001)
HP User Guides 0057 (Version: 1.03.0000)
HP Wireless Assistant (Version: 3.00 F1)
Internet Explorer (Version: 9)
Java 7 Update 9 (Version: 7.0.90)
Java Auto Updater (Version: 2.1.9.0)
Java(TM) 6 Update 31 (Version: 6.0.310)
Junk Mail filter update (Version: 14.0.8117.416)
LightScribe  1.6.43.1 (Version: 1.6.43.1)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Enterprise 2007 (Version: 12.0.4518.1014)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.4518.1014)
Microsoft Silverlight (Version: 4.1.10329.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Works (Version: 08.05.0822)
Move Media Player
Mozilla Firefox 13.0.1 (x86 de) (Version: 13.0.1)
Mozilla Maintenance Service (Version: 13.0.1)
MSCU for Microsoft Vista (Version: 1.0.1.3)
MSVCRT (Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
NVIDIA Drivers (Version: 1.10)
O&O Defrag Professional Edition (Version: 10.0.1634)
Opera 11.62 (Version: 11.62.1347)
PowerDVD (Version: 7.0.2211.0)
Preispiraten (Version: 3)
PVSonyDll (Version: 1.00.0001)
QLBCASL (Version: 6.40.17.2)
QuickTime (Version: 7.1.3.100)
Rossmann Fotowelt Software 4.12.1 (Version: 4.12.1)
Roxio Activation Module (Version: 1.0)
Skype Click to Call (Version: 5.9.9216)
Skype™ 6.6 (Version: 6.6.106)
SmartAudio
Spelling Dictionaries Support For Adobe Reader 8 (Version: 8.0.0)
SPSS 11.5.1 für Windows
Trend Micro Titanium (Version: 6.00)
Trend Micro Titanium Maximum Security (Version: 6.0)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0)
VLC media player 2.0.6 (Version: 2.0.6)
Windows Live Anmelde-Assistent (Version: 5.000.818.5)
Windows Live Call (Version: 14.0.8117.0416)
Windows Live Communications Platform (Version: 14.0.8117.416)
Windows Live Essentials (Version: 14.0.8117.0416)
Windows Live Essentials (Version: 14.0.8117.416)
Windows Live Family Safety (Version: 14.0.8118.427)
Windows Live Fotogalerie (Version: 14.0.8117.416)
Windows Live Mail (Version: 14.0.8117.0416)
Windows Live Messenger (Version: 14.0.8117.0416)
Windows Live Movie Maker (Version: 14.0.8117.0416)
Windows Live Sync (Version: 14.0.8117.416)
Windows Live Writer (Version: 14.0.8117.0416)
Windows Live-Uploadtool (Version: 14.0.8014.1029)
Windows-Treiberpaket - Megawin USB  (04/15/2007 2.0.0.1) (Version: 04/15/2007 2.0.0.1)
WinRAR

==================== Restore Points  =========================

Could not list Restore Points.


==================== Hosts content: ==========================

2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\Final Media Player Update Checker.job => ?
Task: C:\Windows\Tasks\Kedrmqmv.job => ?

==================== Loaded Modules (whitelisted) =============

2008-10-01 22:30 - 2007-05-22 10:59 - 00128512 _____ () C:\Program Files\WinRAR\rarext.dll
2007-02-17 02:40 - 2007-02-17 02:40 - 01466368 _____ () C:\Program Files\Common Files\LightScribe\QtCore4.dll
2007-02-17 02:40 - 2007-02-17 02:40 - 05521408 _____ () C:\Program Files\Common Files\LightScribe\QtGui4.dll
2012-04-18 22:25 - 2012-06-24 08:50 - 02042848 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2012-04-18 22:02 - 2012-04-18 22:02 - 08797344 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll
2012-11-26 20:42 - 2012-05-02 21:26 - 00049152 _____ () C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_49.dll
2012-11-26 20:42 - 2012-05-02 21:24 - 00057344 _____ () C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_49.dll
2012-11-26 20:21 - 2012-07-25 17:53 - 00049152 _____ () C:\Program Files\Trend Micro\Titanium\UIFramework\boost_date_time-vc80-mt-1_49.dll
2012-11-26 20:21 - 2012-07-25 17:53 - 00057344 _____ () C:\Program Files\Trend Micro\Titanium\UIFramework\boost_thread-vc80-mt-1_49.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\Bea_PC\Personaldokumente:Roxio EMC Stream

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/21/2013 10:29:32 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung ACDSeePro25.exe, Version 2.5.333.0, Zeitstempel 0x48c83f53, fehlerhaftes Modul QuickTime.qts, Version 7.1.3.100, Zeitstempel 0x44f8bf2f, Ausnahmecode 0xc0000005, Fehleroffset 0x000cde10,
Prozess-ID 0x9e0, Anwendungsstartzeit ACDSeePro25.exe0.

Error: (09/21/2013 10:29:06 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung ACDSeePro25.exe, Version 2.5.333.0, Zeitstempel 0x48c83f53, fehlerhaftes Modul ID_Media.apl, Version 5.1.31.0, Zeitstempel 0x48b880fa, Ausnahmecode 0xc0000005, Fehleroffset 0x00018e59,
Prozess-ID 0x9e0, Anwendungsstartzeit ACDSeePro25.exe0.

Error: (09/10/2013 07:47:00 PM) (Source: Application Error) (User: )
Description: Fehlerhafte Anwendung DevDetect.exe, Version 5.0.48.0, Zeitstempel 0x48aca8e3, fehlerhaftes Modul kernel32.dll, Version 6.0.6002.18704, Zeitstempel 0x5065ccb6, Ausnahmecode 0xc000008c, Fehleroffset 0x0003fc16,
Prozess-ID 0x7c0, Anwendungsstartzeit DevDetect.exe0.

Error: (09/10/2013 01:35:54 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fca7d360-0242-42c8-b8d6-eabf1b6c0335}

Error: (09/10/2013 01:28:15 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fca7d360-0242-42c8-b8d6-eabf1b6c0335}

Error: (09/10/2013 01:08:58 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
   Generatordaten werden gesammelt

Kontext:
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {fca7d360-0242-42c8-b8d6-eabf1b6c0335}

Error: (09/10/2013 00:46:50 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CoCreateInstance(CLSID_VSSCoordinator)". hr = 0x800401f0.

Error: (09/10/2013 00:46:50 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "Coordinator" kann nicht gestartet werden. [0x800401f0]

Error: (09/10/2013 00:46:50 PM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "CoCreateInstance(CLSID_VSSCoordinator)". hr = 0x800401f0.

Error: (09/10/2013 00:46:50 PM) (Source: VSS) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "Coordinator" kann nicht gestartet werden. [0x800401f0]


System errors:
=============
Error: (10/08/2013 08:03:57 PM) (Source: Service Control Manager) (User: )
Description: TuneUp Utilities Service%%2

Error: (10/08/2013 08:03:57 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (10/08/2013 02:33:07 PM) (Source: Service Control Manager) (User: )
Description: HP Health Check Service%%1053

Error: (10/08/2013 02:33:07 PM) (Source: Service Control Manager) (User: )
Description: 30000HP Health Check Service

Error: (10/08/2013 02:30:17 PM) (Source: Service Control Manager) (User: )
Description: TuneUp Utilities Service%%2

Error: (10/08/2013 02:30:17 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (10/08/2013 02:30:02 PM) (Source: Dhcp) (User: )
Description: Die IP-Adresslease 192.168.1.201 für die Netzwerkkarte mit der Netzwerkadresse 001A73A7F47A wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat eine DHCPNACK-Meldung gesendet).

Error: (10/07/2013 09:18:43 PM) (Source: DCOM) (User: )
Description: {6295DF2D-35EE-11D1-8707-00C04FD93327}

Error: (10/07/2013 08:20:50 PM) (Source: Service Control Manager) (User: )
Description: HP Health Check Service%%1053

Error: (10/07/2013 08:20:50 PM) (Source: Service Control Manager) (User: )
Description: 30000HP Health Check Service


Microsoft Office Sessions:
=========================
Error: (06/11/2010 00:49:03 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 9842 seconds with 4080 seconds of active time.  This session ended with a crash.

Error: (06/08/2010 00:47:13 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7236 seconds with 2580 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2012-05-06 12:32:21.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 12:32:20.125
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 12:32:19.793
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 12:32:19.426
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 10:40:35.166
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 10:40:34.845
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 10:40:34.484
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 10:40:34.106
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tmevtmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-02-14 12:52:42.273
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-02-14 12:52:42.070
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\WINDOWS\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 58%
Total physical RAM: 2046.24 MB
Available physical RAM: 839.03 MB
Total Pagefile: 4334.88 MB
Available Pagefile: 3000.53 MB
Total Virtual: 2047.88 MB
Available Virtual: 1922.38 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:225.33 GB) (Free:86.96 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:7.55 GB) (Free:2.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

==================== End Of Log ============================

Mit GMER konnte ich leider keinen file erstellen, da das programm ein problem hatte, und die mittelung kam, das ich benachritigt werde wenn das progamm wieder läuft, keine ahnung wie das, aber naja.....

So ich hoffe ihr könnt mit der info was anfangen.
Bis hoffenlich ganz bald..tixi

Alt 08.10.2013, 20:49   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


hi,
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________

__________________
Alt 08.10.2013, 21:47   #3
tixi
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Hallo schrauber,

danke das du dich meines problems annimmst!!!

Ich habe comofix laufen lassen und hier nun das log

Code:
ATTFilter
Combofix Logfile:


	
Code: 

 
ATTFilter


  

	
ComboFix 13-10-08.01 - Bea_PC 08.10.2013  22:23:51.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.1129 [GMT 2:00]
ausgeführt von:: c:\users\schenke\Desktop\ComboFix.exe
AV: Trend Micro Titanium Maximum Security *Enabled/Updated* {B7599298-8445-728A-A5C7-A26A082C8BDA}
SP: Trend Micro Titanium Maximum Security *Enabled/Updated* {0C38737C-A27F-7D04-9F77-991873ABC167}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe
c:\windows\system32\service
c:\windows\system32\service\01062010_TIS17_SfFniAU.log
c:\windows\system32\service\01072010_TIS17_SfFniAU.log
c:\windows\system32\service\01112010_TIS17_SfFniAU.log
c:\windows\system32\service\01122010_TIS17_SfFniAU.log
c:\windows\system32\service\02012010_TIS17_SfFniAU.log
c:\windows\system32\service\02022010_TIS17_SfFniAU.log
c:\windows\system32\service\02062010_TIS17_SfFniAU.log
c:\windows\system32\service\02072010_TIS17_SfFniAU.log
c:\windows\system32\service\02092009_TIS17_SfFniAU.log
c:\windows\system32\service\02092010_TIS17_SfFniAU.log
c:\windows\system32\service\02112010_TIS17_SfFniAU.log
c:\windows\system32\service\02122010_TIS17_SfFniAU.log
c:\windows\system32\service\03042010_TIS17_SfFniAU.log
c:\windows\system32\service\03062010_TIS17_SfFniAU.log
c:\windows\system32\service\03072010_TIS17_SfFniAU.log
c:\windows\system32\service\03092010_TIS17_SfFniAU.log
c:\windows\system32\service\03112010_TIS17_SfFniAU.log
c:\windows\system32\service\04012011_TIS17_SfFniAU.log
c:\windows\system32\service\04022009_TIS17_SfFniAU.log
c:\windows\system32\service\04052010_TIS17_SfFniAU.log
c:\windows\system32\service\04112009_TIS17_SfFniAU.log
c:\windows\system32\service\04122010_TIS17_SfFniAU.log
c:\windows\system32\service\05022010_TIS17_SfFniAU.log
c:\windows\system32\service\05052010_TIS17_SfFniAU.log
c:\windows\system32\service\05072010_TIS17_SfFniAU.log
c:\windows\system32\service\05102010_TIS17_SfFniAU.log
c:\windows\system32\service\06052010_TIS17_SfFniAU.log
c:\windows\system32\service\06072010_TIS17_SfFniAU.log
c:\windows\system32\service\06092010_TIS17_SfFniAU.log
c:\windows\system32\service\06102009_TIS17_SfFniAU.log
c:\windows\system32\service\07022009_TIS17_SfFniAU.log
c:\windows\system32\service\08022010_TIS17_SfFniAU.log
c:\windows\system32\service\08042010_TIS17_SfFniAU.log
c:\windows\system32\service\08072010_TIS17_SfFniAU.log
c:\windows\system32\service\08102010_TIS17_SfFniAU.log
c:\windows\system32\service\08112009_TIS17_SfFniAU.log
c:\windows\system32\service\08112010_TIS17_SfFniAU.log
c:\windows\system32\service\08122009_TIS17_SfFniAU.log
c:\windows\system32\service\09012009_TIS17_SfFniAU.log
c:\windows\system32\service\09032009_TIS17_SfFniAU.log
c:\windows\system32\service\09092010_TIS17_SfFniAU.log
c:\windows\system32\service\09102010_TIS17_SfFniAU.log
c:\windows\system32\service\09122010_TIS17_SfFniAU.log
c:\windows\system32\service\10052010_TIS17_SfFniAU.log
c:\windows\system32\service\10062010_TIS17_SfFniAU.log
c:\windows\system32\service\10072010_TIS17_SfFniAU.log
c:\windows\system32\service\11022010_TIS17_SfFniAU.log
c:\windows\system32\service\11062010_TIS17_SfFniAU.log
c:\windows\system32\service\11072010_TIS17_SfFniAU.log
c:\windows\system32\service\11092009_TIS17_SfFniAU.log
c:\windows\system32\service\11092010_TIS17_SfFniAU.log
c:\windows\system32\service\11102010_TIS17_SfFniAU.log
c:\windows\system32\service\11122010_TIS17_SfFniAU.log
c:\windows\system32\service\12022010_TIS17_SfFniAU.log
c:\windows\system32\service\12042010_TIS17_SfFniAU.log
c:\windows\system32\service\12072010_TIS17_SfFniAU.log
c:\windows\system32\service\12102010_TIS17_SfFniAU.log
c:\windows\system32\service\12112010_TIS17_SfFniAU.log
c:\windows\system32\service\13012009_TIS17_SfFniAU.log
c:\windows\system32\service\13062009_TIS17_SfFniAU.log
c:\windows\system32\service\13062010_TIS17_SfFniAU.log
c:\windows\system32\service\13092010_TIS17_SfFniAU.log
c:\windows\system32\service\13112010_TIS17_SfFniAU.log
c:\windows\system32\service\14042010_TIS17_SfFniAU.log
c:\windows\system32\service\14062010_TIS17_SfFniAU.log
c:\windows\system32\service\14072010_TIS17_SfFniAU.log
c:\windows\system32\service\14092010_TIS17_SfFniAU.log
c:\windows\system32\service\14122009_TIS17_SfFniAU.log
c:\windows\system32\service\15012009_TIS17_SfFniAU.log
c:\windows\system32\service\15052010_TIS17_SfFniAU.log
c:\windows\system32\service\15062010_TIS17_SfFniAU.log
c:\windows\system32\service\15072010_TIS17_SfFniAU.log
c:\windows\system32\service\15102010_TIS17_SfFniAU.log
c:\windows\system32\service\15112010_TIS17_SfFniAU.log
c:\windows\system32\service\15122010_TIS17_SfFniAU.log
c:\windows\system32\service\16022010_TIS17_SfFniAU.log
c:\windows\system32\service\16062010_TIS17_SfFniAU.log
c:\windows\system32\service\16092009_TIS17_SfFniAU.log
c:\windows\system32\service\16092010_TIS17_SfFniAU.log
c:\windows\system32\service\16102010_TIS17_SfFniAU.log
c:\windows\system32\service\16112010_TIS17_SfFniAU.log
c:\windows\system32\service\17052010_TIS17_SfFniAU.log
c:\windows\system32\service\17062010_TIS17_SfFniAU.log
c:\windows\system32\service\17092010_TIS17_SfFniAU.log
c:\windows\system32\service\18052010_TIS17_SfFniAU.log
c:\windows\system32\service\18062010_TIS17_SfFniAU.log
c:\windows\system32\service\18072010_TIS17_SfFniAU.log
c:\windows\system32\service\18102010_TIS17_SfFniAU.log
c:\windows\system32\service\19042009_TIS17_SfFniAU.log
c:\windows\system32\service\19052010_TIS17_SfFniAU.log
c:\windows\system32\service\19102009_TIS17_SfFniAU.log
c:\windows\system32\service\19102010_TIS17_SfFniAU.log
c:\windows\system32\service\19112010_TIS17_SfFniAU.log
c:\windows\system32\service\19122010_TIS17_SfFniAU.log
c:\windows\system32\service\20052010_TIS17_SfFniAU.log
c:\windows\system32\service\20062010_TIS17_SfFniAU.log
c:\windows\system32\service\20112010_TIS17_SfFniAU.log
c:\windows\system32\service\21012009_TIS17_SfFniAU.log
c:\windows\system32\service\21052009_TIS17_SfFniAU.log
c:\windows\system32\service\21052010_TIS17_SfFniAU.log
c:\windows\system32\service\21062010_TIS17_SfFniAU.log
c:\windows\system32\service\21082009_TIS17_SfFniAU.log
c:\windows\system32\service\22012009_TIS17_SfFniAU.log
c:\windows\system32\service\22032010_TIS17_SfFniAU.log
c:\windows\system32\service\22072010_TIS17_SfFniAU.log
c:\windows\system32\service\23032010_TIS17_SfFniAU.log
c:\windows\system32\service\23042010_TIS17_SfFniAU.log
c:\windows\system32\service\23062010_TIS17_SfFniAU.log
c:\windows\system32\service\23082010_TIS17_SfFniAU.log
c:\windows\system32\service\23102009_TIS17_SfFniAU.log
c:\windows\system32\service\23112010_TIS17_SfFniAU.log
c:\windows\system32\service\24022010_TIS17_SfFniAU.log
c:\windows\system32\service\24062010_TIS17_SfFniAU.log
c:\windows\system32\service\24082010_TIS17_SfFniAU.log
c:\windows\system32\service\25022010_TIS17_SfFniAU.log
c:\windows\system32\service\25082010_TIS17_SfFniAU.log
c:\windows\system32\service\25102010_TIS17_SfFniAU.log
c:\windows\system32\service\25112010_TIS17_SfFniAU.log
c:\windows\system32\service\26012010_TIS17_SfFniAU.log
c:\windows\system32\service\26052010_TIS17_SfFniAU.log
c:\windows\system32\service\26082010_TIS17_SfFniAU.log
c:\windows\system32\service\26102010_TIS17_SfFniAU.log
c:\windows\system32\service\27102010_TIS17_SfFniAU.log
c:\windows\system32\service\27122010_TIS17_SfFniAU.log
c:\windows\system32\service\28012010_TIS17_SfFniAU.log
c:\windows\system32\service\28042010_TIS17_SfFniAU.log
c:\windows\system32\service\28052010_TIS17_SfFniAU.log
c:\windows\system32\service\28102010_TIS17_SfFniAU.log
c:\windows\system32\service\28112010_TIS17_SfFniAU.log
c:\windows\system32\service\29012010_TIS17_SfFniAU.log
c:\windows\system32\service\29042010_TIS17_SfFniAU.log
c:\windows\system32\service\29102010_TIS17_SfFniAU.log
c:\windows\system32\service\29112010_TIS17_SfFniAU.log
c:\windows\system32\service\29122010_TIS17_SfFniAU.log
c:\windows\system32\service\30032010_TIS17_SfFniAU.log
c:\windows\system32\service\30052010_TIS17_SfFniAU.log
c:\windows\system32\service\30062010_TIS17_SfFniAU.log
c:\windows\system32\service\30102010_TIS17_SfFniAU.log
c:\windows\system32\service\30122010_TIS17_SfFniAU.log
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-09-08 bis 2013-10-08  ))))))))))))))))))))))))))))))
.
.
2013-10-08 20:36 . 2013-10-08 20:36	--------	d-----w-	c:\users\schenke\AppData\Local\temp
2013-10-08 20:36 . 2013-10-08 20:36	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-10-08 20:36 . 2013-10-08 20:38	--------	d-----w-	c:\users\Bea_PC\AppData\Local\temp
2013-10-08 19:02 . 2013-10-08 19:02	103680	----a-w-	C:\ufddqpow.sys
2013-10-08 18:45 . 2013-10-08 18:45	--------	d-----w-	C:\FRST
2013-09-21 18:54 . 2013-07-16 04:35	615936	----a-w-	c:\windows\system32\themeui.dll
2013-09-21 18:54 . 2013-08-08 01:45	2049536	----a-w-	c:\windows\system32\win32k.sys
2013-09-10 11:09 . 2013-09-10 11:09	--------	d-----r-	C:\MSOCache
2013-09-09 17:22 . 2013-09-09 17:30	--------	d-----w-	C:\Desktop
2013-09-09 14:40 . 2013-09-09 14:40	--------	d-----w-	c:\program files\Common Files\Skype
2013-09-09 13:35 . 2013-09-09 13:35	--------	d-----w-	c:\users\Bea_PC\AppData\Roaming\IObit
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-08 18:38 . 2011-03-25 06:45	181808	----a-w-	c:\windows\RegBootClean.exe
2013-09-04 11:52 . 2013-08-31 14:43	263072	----a-w-	c:\windows\system32\drivers\tmcomm.sys
2013-09-04 11:52 . 2012-11-26 18:45	96736	----a-w-	c:\windows\system32\drivers\tmactmon.sys
2013-09-04 11:52 . 2012-11-26 18:45	76624	----a-w-	c:\windows\system32\drivers\tmevtmgr.sys
2013-08-02 04:09 . 2013-08-28 08:09	1548288	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-17 19:41 . 2013-08-15 08:36	2048	----a-w-	c:\windows\system32\tzres.dll
2012-06-24 06:50 . 2012-04-18 20:25	85472	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-21 19875432]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"Trend Micro Titanium"="c:\program files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" [2013-09-16 1382568]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-10-14 2299176]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2007-05-11 2512392]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-09-29 49152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"Conime"="c:\windows\system32\conime.exe" [2009-04-11 69120]
"AVMWlanClient"="c:\program files\avmwlanstick\wlangui.exe" [2006-12-27 1454080]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2013-08-29 132920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]
"DCERegBootClean"="c:\windows\RegBootClean.exe" [2013-10-08 181808]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-04-11 217088]
.
c:\users\Bea_PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Protect.lnk - c:\program files\FRITZ!DSL\FwebProt.exe [2007-9-7 1070384]
.
c:\users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\schenke\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-1-20 28539272]
FRITZ!DSL Protect.lnk - c:\program files\FRITZ!DSL\FwebProt.exe [2007-9-7 1070384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files\Hp\HP Software Update\HPWuSchd2.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe"
"EKIJ5000StatusMonitor"=c:\windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23	452136	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 20:02]
.
2013-10-08 c:\windows\Tasks\Final Media Player Update Checker.job
- c:\program files\FinalMediaPlayer\FMPCheckForUpdates.exe [2012-03-20 13:24]
.
2013-10-08 c:\windows\Tasks\Kedrmqmv.job
- c:\windows\system32\emdmgmt7.dll [2013-08-21 10:22]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
IE: 	
IE: &Preispiratensuche nach markiertem Text - c:\\Program Files\\Preispiraten\\Preispiraten4\\preispiraten.html
IE: amazon Suche - c:\program files\Preispiraten\Preispiraten4\Searchamazon.htm
IE: amazon Suche starten - c:\program files\Preispiraten\Preispiraten4\Searchamazon.htm
IE: eBay - Mein eBay - c:\program files\Preispiraten\Preispiraten4\SearchEbaymein.htm
IE: eBay - Powersuche - c:\program files\Preispiraten\Preispiraten4\SearchEbaypower.htm
IE: eBay - Startseite - c:\program files\Preispiraten\Preispiraten4\SearchEbay.htm
IE: eBay Suche starten - c:\program files\Preispiraten\Preispiraten4\SearchEbay.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: Google Suche - c:\program files\Preispiraten\Preispiraten4\SearchGoogle.htm
IE: Google Suche starten - c:\program files\Preispiraten\Preispiraten4\SearchGoogle.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\FRITZ!DSL\\sarah.dll
TCP: DhcpNameServer = 83.169.186.33 83.169.186.97
FF - ProfilePath - c:\users\Bea_PC\AppData\Roaming\Mozilla\Firefox\Profiles\yq5n2l4k.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.startfenster.com
FF - ExtSQL: 2013-09-02 11:12; tmbepff-7.5@trendmicro.com; c:\program files\Trend Micro\AMSP\Module\20002\7.5.1136\7.5.1136\firefoxextension
FF - ExtSQL: 2013-09-09 15:17; {22C7F6C6-8D67-4534-92B5-529A0EC09405}; c:\program files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
c:\users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-EKIJ5000StatusMonitor - c:\windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
MSConfigStartUp-WinampAgent - c:\program files\Winamp\winampa.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-10-08 22:38
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ani"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.arw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bay"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.bmp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cr2"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.crw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cs1"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cur"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dcr"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcx\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dcx"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dib"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djvu"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.dng"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.emf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eps\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.eps"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.erf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fff"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fpx"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.gif"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.hdr"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icl"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]
@Denied: (2) (LocalSystem)
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iff"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.j2k"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jfif"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jif"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jp2\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jp2"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpc"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpe"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpeg"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpg"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpx"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.lbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mef"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mos"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mrw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.nef"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.orf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pcd"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pct"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pcx"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pef"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pgm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pic"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pict"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.png"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ppm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.psd"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.psp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspimage"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.raf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ras"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.raw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgb"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rle"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sgi"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sr2"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.srf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.tga"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.thm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.tif"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.tiff"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ttc"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ttf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.wbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbmp\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.wbmp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.wmf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xif"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xmp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xpm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.032"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.abr"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ani\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ani"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.arw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.bay"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.bw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.cr2"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.crw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.cs1"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cur\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.cur"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dcr"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.djv"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djvu\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.djvu"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.dng"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.erf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.fff"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.fpx"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.hdr"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.icl"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.icn"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.iff"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ilbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.int"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.inta"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.iw4"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.j2c"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.j2k"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jbr"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpc"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpk"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.jpx"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.kdc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.kdc"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.lbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.mef"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.mos"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.mrw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.nef"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.orf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pbr"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pcd"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pct"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pef"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pgm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pgm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pict"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pix"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ppm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ppm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.psd"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.psp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pspbrush"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.pspimage"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.raf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ras\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ras"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.raw"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rgb"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rgba"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.rsb"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sgi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.sgi"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.sr2"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.srf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.thm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ttc"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.ttf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25po\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.v25po"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25pp\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.v25pp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v25ppf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.v25ppf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30po"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30pp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1001)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30ppf"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xbm"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2983697060-3170552294-346733467-1001)
"Progid"="ACDSee Pro 2.5.xmp"
.
[HKEY_USERS\S-1-5-21-2983697060-3170552294-346733467-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xpm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 2.5.xpm"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="A0DA7AA188B116B668550081B47E2940E2F5E2269008AA61FA5F97A107BF48134DB1E52B5B8E92ADA012D04A37C53BBB7D82A2CABDD65F98C400F60C3160DC6160FC65932E8D4537859FACF8FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E6675D575E7D6A3B9808A9C6AECB7A5D1407DAE35B9D08F1ADF9212D4D01C263A152D357BC64A7A4C0A6A9947BFE817CD2D7E314C8D50C693E730151B7F531EC3DA1044A31885D1AA15D4D7AF832D5799D7880A2484131C635F879E9FAB34BE822BE53494784DA4FE2FEFE468BC98E9342076A04A3A938ED025C3718D71991F789207EBED86A04C528462CD344318BC669A45F1EC26FA3F8F744E6EEB21A46728D10C50DE1E47AB1F445C46F59667242A2C520CC3686B835CEAA3DF7124070E0AF2CEA880531A777B4DDBDDBA5FA2BEBDF34F35F30748025235CEFAE23265C04D4E9B67A84A0B6B534488F502797645B778A249887564AFCF1FA3902B47E184CC58D7520CA98183A2411B7737EF30F5EA33AFCAFB85A28271FFD5856BB8BF6612D34F4AA651100891A18B5E6735F5FF4030AD04E60C3F041742D0F054F268F9D1DCA8B3E831967DA8F0F0FBB6D3CCF521810F615426A3D1C1B2725582BBABD0F88158EF4FAD088196280CC77FB011C6049BBC517C639EC3DA1DC649231C8A1794928D9DAC56EE5E353467A935036C6BB60CB9E59F6AFA0DFFD969CE462E69C529AF14E71003B42100890A9FEC17D94B48C55DF5981603F6F85EA9EF8683AD6441E2E4F2EE89226A30AE26D9BC7060ECF5F4171853B73720E75C943EB8F01BA2D57F0C37967675D5A4796603F031780C4514D3C3F99A4A912EB74E34B478B78212FA19730043FF72510551E34B28B7D02B988AC5FB7C11604EC80DE9CA1BC02E5717ABAA4EBB24B269AA0C7383FD05AA5D9593630D32EADA15F581858590F8FF6CE09A09AEEEFEDB47F4B02FD316AAF06D177CEF052E22A5C8E38F4E8C88C9C01DBB241CA8237BCDDBDFDF42A35ECDA2A2AF0EDD439690CDAAA33E0AF6FD6E66790AB97E2BF5DD8DF34B3CC572004FDD0CAA59382B4E2127546AECA7F7222F2C0C900A38463CCA42EAABB3C94E56D7CE7844940949180C53AD96524A2993686D7C78EE8C34E82C871C9BB75E2A07A7F958866781BC38A6FE9BFE3E3D250EFAD2BAF09EFAA051033849E2933390F93F5336DD84898E15B9CFA378B85C026BE376C08F74334321990F59950318012B110CA2C52BB8327E4A01765130810CF27B6033EB473D3A0D9D88B92D22F17AFE2C21F26D665C87327129ACE856C5AA4428289246E13ED411DC1B941A373CE924AC7231CBED945473BC918623D3A2AA13BB7CE6B28BAD92BC4C7AFC30946EE881E1B013537B2CC4C4C"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-10-08  22:42:18
ComboFix-quarantined-files.txt  2013-10-08 20:42
.
Vor Suchlauf: 12 Verzeichnis(se), 106.641.244.160 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 106.788.958.208 Bytes frei
.
- - End Of File - - 301BCE3E4A9D16B5493C6A70B01FEC0B
         
 
--- --- ---
1A1A06F62E891045814007163C1C76C3
Danke
__________________
Alt 09.10.2013, 08:42   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 10.10.2013, 21:09   #5
tixi
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


So hier nun die erste log datei:
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.10.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Bea_PC :: BEA-PC [Administrator]

Schutz: Aktiviert

10.10.2013 20:26:12
mbam-log-2013-10-10 (20-26-12).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 235574
Laufzeit: 24 Minute(n), 10 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
und es geht weiter adwcleaner log:

AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.007 - Bericht erstellt am 10/10/2013 um 20:54:37
# Updated 09/10/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Bea_PC - BEA-PC
# Gestartet von : C:\Users\schenke\Desktop\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Bea_PC\AppData\Roaming\Mozilla\Firefox\Profiles\yq5n2l4k.default\user.js
Ordner Gefunden C:\ProgramData\Ask
Ordner Gefunden C:\Users\schenke\AppData\LocalLow\boost_interprocess

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gefunden : HKLM\Software\Freeze.com
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\heoldelcflnigdllmlopiefhkkobendj
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16514


-\\ Mozilla Firefox v13.0.1 (de)

[ Datei : C:\Users\Bea_PC\AppData\Roaming\Mozilla\Firefox\Profiles\yq5n2l4k.default\prefs.js ]

Zeile gefunden : user_pref("browser.startup.homepage", "hxxp://www.startfenster.com");

[ Datei : C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2763 octets] - [10/10/2013 20:54:37]

########## EOF - \AdwCleaner\AdwCleaner[R0].txt - [2823 octets] ##########
--- --- ---

[/CODE]


AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.007 - Bericht erstellt am 10/10/2013 um 20:56:45
# Updated 09/10/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Bea_PC - BEA-PC
# Gestartet von : C:\Users\schenke\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Users\schenke\AppData\LocalLow\boost_interprocess
Datei Gelöscht : C:\Users\Bea_PC\AppData\Roaming\Mozilla\Firefox\Profiles\yq5n2l4k.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\heoldelcflnigdllmlopiefhkkobendj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Freeze.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16514


-\\ Mozilla Firefox v13.0.1 (de)

[ Datei : C:\Users\Bea_PC\AppData\Roaming\Mozilla\Firefox\Profiles\yq5n2l4k.default\prefs.js ]

Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://www.startfenster.com");

[ Datei : C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [2901 octets] - [10/10/2013 20:54:37]
AdwCleaner[S0].txt - [2828 octets] - [10/10/2013 20:56:45]

########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [2888 octets] ##########
--- --- ---

[/CODE]

der jrt log:

Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Bea_PC on 10.10.2013 at 21:42:49,16
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.10.2013 at 21:50:45,19
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
noch einer
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Bea_PC on 10.10.2013 at 21:41:14,13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{976B3218-6CAF-4B5C-BF1F-1EA0E045422F}



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.10.2013 at 21:49:30,61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und das frst:


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by schenke (ATTENTION: The logged in user is not administrator) on BEA-PC on 10-10-2013 21:59:53
Running from C:\Users\schenke\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(O&O Software GmbH) C:\WINDOWS\System32\oodtray.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(ACD Systems) C:\Program Files\Common Files\ACD Systems\DE\DevDetect.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Dropbox, Inc.) C:\Users\schenke\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\FwebProt.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [WAWifiMessage] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [317128 2007-01-11] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe [1382568 2013-09-16] (Trend Micro Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OODefragTray] - C:\Windows\system32\oodtray.exe [2512392 2007-05-11] (O&O Software GmbH)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [49152 2006-09-29] ()
HKLM\...\Run: [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [472776 2007-03-01] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Conime] - C:\Windows\system32\conime.exe [69120 2009-04-11] (Microsoft Corporation)
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\wlangui.exe [1454080 2006-12-28] (AVM Berlin)
HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [132920 2013-08-29] (Trend Micro Inc.)
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44128 2006-11-08] (soft thinks)
HKLM\...\RunOnce: [DCERegBootClean] - C:\Windows\RegBootClean.exe [181808 2013-10-08] ()
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [217088 2009-04-11] (Microsoft Corporation)
HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [484904 2007-04-19] (Hewlett-Packard Company)
HKCU\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [Device Detector] - DevDetect.exe -autorun
MountPoints2: {1f443d3c-8f2d-11dd-8b4f-001a73a7f47a} - G:\pushinst.exe
MountPoints2: {2d5bb31c-ae70-11dd-b61a-001a73a7f47a} - G:\LaunchU3.exe -a
MountPoints2: {528df0dc-5aa3-11e0-839f-001b24a08592} - F:\firefox////report.exe
MountPoints2: {c800dbad-72a3-11e0-823c-001a73a7f47a} - USBS\Open.exe
Startup: C:\Users\Bea_PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files\FRITZ!DSL\FwebProt.exe (AVM Berlin)
Startup: C:\Users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\schenke\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files\FRITZ!DSL\FwebProt.exe (AVM Berlin)
BootExecute: autocheck autochk * OODBS

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.t-online.de/cpm-redir/ie-9.html
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {4D8D54C6-8B48-4AA5-BF95-A180ECC71884} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
SearchScopes: HKCU - {30B74494-E60B-414C-8599-9ADFEB3DDEE2} URL = hxxp://suche.t-online.de/fast-cgi/tsc?mandant=toi&device=html&portallanguage=de&userlanguage=de&dia=suche&context=internet-tab&tpc=internet&ptl=std&classification=internet-tab_internet_std&q={searchTerms}&br=ie7-toi
SearchScopes: HKCU - {4D8D54C6-8B48-4AA5-BF95-A180ECC71884} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
SearchScopes: HKCU - {5367D1D7-6793-4042-8996-AC9D2239B3BB} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag= interactivemesuche21&index=blended&linkCode=ur2&camp=1638&creative=6742
SearchScopes: HKCU - {8831D5E0-596A-4451-87C0-10504E93CAD0} URL = hxxp://suche.t-online.de/fastcgi/tsc?mandant=toi&device=html&portallanguage=de&userlanguage=de&d ia=suche&context=wiki-tab&tpc=internet&ptl=std&classification=wikitab_internet_std&q={searchTerms}&br=ie7-toi
SearchScopes: HKCU - {92CFE0EC-2ADA-4492-BD69-FBBD33AB2737} URL = hxxp://rover.ebay.com/rover/1/707-1403-276402/4?mpre=hxxp://search.ebay.de/search/search.dll?shortcut=4&query={sear chTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll (Trend Micro Inc.)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: amazon - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\PROGRA~1\PREISP~1\PREISP~1\IEBUTT~2.DLL ()
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} -  No File
BHO: No Name - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -  No File
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: Preispiraten 4 - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\PROGRA~1\PREISP~1\PREISP~1\IEBUTT~1.DLL ()
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
Winsock: Catalog5 07 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 01 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 02 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 03 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 14 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 83.169.186.33 83.169.186.97

FireFox:
========
FF ProfilePath: C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default
FF Homepage: https://eu.ixquick.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @TrendMicro.com/FFExtension - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll (Trend Micro Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @movenetworks.com/Quantum Media Player - C:\Users\schenke\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks)
FF SearchPlugin: C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\searchplugins\ixquick---deutsch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\SP_preispiraten_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\nostmp
FF Extension: Adobe DLM (powered by getPlus(R)) - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF Extension: No Name - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: Amazon-Startcenter - C:\Program Files\Mozilla Firefox\extensions\{144D1513-0819-4538-AD26-D515AF443AE7}
FF Extension: Google Kontextmen&#252; - C:\Program Files\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Preispiraten4 - C:\Program Files\Mozilla Firefox\extensions\{A86278FF-6B63-446C-B109-DD4E1BAAC868}
FF Extension: Preispiraten 4 Kontextmen&#252; - C:\Program Files\Mozilla Firefox\extensions\{D2A8BC29-8CA3-4C0A-A206-631C44E9620F}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF HKLM\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension
FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\

========================== Services (Whitelisted) =================

R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [356352 2006-12-28] (AVM Berlin)
S2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [62984 2007-03-14] (Hewlett-Packard)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [87344 2007-09-04] (AVM Berlin)
R2 iphlpsvc; C:\Windows\System32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 O&O Defrag; C:\Windows\system32\oodag.exe [1050120 2007-05-11] (O&O Software GmbH)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-08] ()
R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=nb -dt=60000 -ad [x]
S3 gusvc; "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" [x]
S3 stllssvr; "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe" [x]
S2 TuneUp.UtilitiesSvc; "C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2006-12-28] (AVM Berlin)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [160768 2007-04-12] (Conexant Systems Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [96736 2013-09-04] (Trend Micro Inc.)
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [263072 2013-09-04] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [38328 2012-08-24] (Trend Micro Inc.)
R2 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [83256 2012-12-07] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [76624 2013-09-04] (Trend Micro Inc.)
R2 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [171064 2012-07-06] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Bea_PC\AppData\Local\Temp\catchme.sys [x]
U4 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 neokdss; system32\Drivers\neokdss.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U2 TMAgent; 
S3 TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-10 21:49 - 2013-10-10 21:50 - 00000658 _____ C:\Users\Bea_PC\Desktop\JRT.txt
2013-10-10 21:14 - 2013-10-10 21:14 - 00000000 ____D C:\Windows\ERUNT
2013-10-10 20:54 - 2013-10-10 20:56 - 00000000 ____D C:\AdwCleaner
2013-10-10 20:25 - 2013-10-10 20:25 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-10 20:23 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-10 20:21 - 2013-10-10 20:22 - 01032220 _____ (Thisisu) C:\Users\schenke\Desktop\JRT.exe
2013-10-10 20:21 - 2013-10-10 20:21 - 01048960 _____ C:\Users\schenke\Desktop\adwcleaner.exe
2013-10-10 20:20 - 2013-10-10 20:20 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\schenke\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-10 14:13 - 2013-09-22 12:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-10 14:13 - 2013-09-22 12:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 14:13 - 2013-09-22 12:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-10 14:12 - 2013-09-22 12:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 14:12 - 2013-09-22 12:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 14:12 - 2013-09-22 12:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 14:12 - 2013-09-22 12:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-10 14:12 - 2013-09-22 12:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 14:12 - 2013-09-22 12:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 14:12 - 2013-09-22 12:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-10 14:12 - 2013-09-22 12:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 14:12 - 2013-09-22 12:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-10 14:12 - 2013-09-22 12:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 14:12 - 2013-09-22 12:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 14:12 - 2013-09-22 12:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 14:12 - 2013-09-22 11:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 12:55 - 2013-08-29 09:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 12:55 - 2013-08-27 04:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-10 12:55 - 2013-08-27 04:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-10 12:55 - 2013-08-27 04:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-10 12:55 - 2013-08-27 04:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-10 12:55 - 2013-08-27 03:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-10 12:55 - 2013-08-27 03:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-10 12:55 - 2013-08-27 03:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-10 12:55 - 2013-08-27 03:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-10 12:55 - 2013-08-27 03:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-10 12:55 - 2013-08-01 05:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 12:55 - 2013-08-01 04:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-10 12:55 - 2013-07-20 12:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 12:51 - 2013-07-12 11:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-10 12:51 - 2013-06-29 04:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 12:51 - 2013-06-29 04:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 12:51 - 2013-06-29 04:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 12:51 - 2013-06-29 04:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 12:51 - 2011-05-05 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 12:51 - 2011-05-05 15:54 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 12:50 - 2013-06-27 01:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 12:49 - 2013-07-04 06:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 12:49 - 2013-07-03 04:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 12:49 - 2013-07-03 04:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 12:49 - 2013-06-04 06:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 12:49 - 2013-06-04 03:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-08 22:42 - 2013-10-08 22:42 - 00057637 _____ C:\ComboFix.txt
2013-10-08 22:18 - 2013-10-08 22:42 - 00000000 ____D C:\ComboFix
2013-10-08 22:18 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-08 22:18 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-08 22:18 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-08 21:54 - 2013-10-08 22:42 - 00000000 ____D C:\Qoobox
2013-10-08 21:53 - 2013-10-08 22:39 - 00000000 ____D C:\Windows\erdnt
2013-10-08 21:51 - 2013-10-08 21:52 - 05132072 ____R (Swearware) C:\Users\schenke\Desktop\ComboFix.exe
2013-10-08 21:02 - 2013-10-08 21:02 - 00103680 _____ (GMER) C:\ufddqpow.sys
2013-10-08 21:00 - 2013-10-08 21:00 - 219077120 _____ C:\Windows\MEMORY.DMP
2013-10-08 20:59 - 2013-10-08 20:59 - 00377856 _____ C:\Users\schenke\Desktop\gmer_2.1.19163.exe
2013-10-08 20:47 - 2013-10-08 20:47 - 00017948 _____ C:\Users\schenke\Desktop\Addition.txt
2013-10-08 20:45 - 2013-10-08 20:45 - 01087213 _____ (Farbar) C:\Users\schenke\Desktop\FRST.exe
2013-10-08 20:45 - 2013-10-08 20:45 - 00000000 ____D C:\FRST
2013-10-08 20:38 - 2013-10-08 20:38 - 00003748 _____ C:\Windows\RegBootClean.CFG
2013-10-08 20:35 - 2013-10-08 20:36 - 00000474 _____ C:\Users\schenke\Desktop\defogger_disable.log
2013-10-08 20:35 - 2013-10-08 20:35 - 00000000 _____ C:\Users\Bea_PC\defogger_reenable
2013-10-08 20:27 - 2013-10-08 20:27 - 00050477 _____ C:\Users\schenke\Desktop\Defogger.exe
2013-09-21 21:09 - 2013-09-21 23:57 - 00000000 ____D C:\Users\schenke\Desktop\Auswahl
2013-09-21 20:54 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-09-10 13:10 - 2013-09-10 13:32 - 00000000 ____D C:\Program Files\Microsoft Office
2013-09-10 13:09 - 2013-09-10 13:09 - 00000000 ___RD C:\MSOCache

==================== One Month Modified Files and Folders =======

2013-10-10 22:00 - 2010-05-27 16:38 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Dropbox
2013-10-10 21:58 - 2013-08-21 12:22 - 00000310 _____ C:\Windows\Tasks\Kedrmqmv.job
2013-10-10 21:58 - 2012-03-20 23:04 - 00000388 _____ C:\Windows\Tasks\Final Media Player Update Checker.job
2013-10-10 21:58 - 2011-12-09 13:10 - 00255073 _____ C:\ProgramData\nvModes.dat
2013-10-10 21:58 - 2011-12-09 13:10 - 00255073 _____ C:\ProgramData\nvModes.001
2013-10-10 21:58 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-10 21:58 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-10 21:57 - 2008-10-01 09:54 - 02665099 _____ C:\Windows\system32\oodbs.lor
2013-10-10 21:57 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-10 21:56 - 2012-04-14 23:02 - 00000000 ____D C:\Users\schenke\AppData\Roaming\FRITZ!
2013-10-10 21:56 - 2008-10-01 00:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-10 21:56 - 2007-09-13 15:16 - 01317730 _____ C:\Windows\WindowsUpdate.log
2013-10-10 21:56 - 2006-11-02 15:01 - 00032582 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-10 21:50 - 2013-10-10 21:49 - 00000658 _____ C:\Users\Bea_PC\Desktop\JRT.txt
2013-10-10 21:24 - 2012-04-18 22:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-10 21:14 - 2013-10-10 21:14 - 00000000 ____D C:\Windows\ERUNT
2013-10-10 20:56 - 2013-10-10 20:54 - 00000000 ____D C:\AdwCleaner
2013-10-10 20:39 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 20:25 - 2013-10-10 20:25 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-10 20:22 - 2013-10-10 20:21 - 01032220 _____ (Thisisu) C:\Users\schenke\Desktop\JRT.exe
2013-10-10 20:21 - 2013-10-10 20:21 - 01048960 _____ C:\Users\schenke\Desktop\adwcleaner.exe
2013-10-10 20:20 - 2013-10-10 20:20 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\schenke\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-10 20:09 - 2006-11-02 12:33 - 01573070 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-10 20:02 - 2006-11-02 14:47 - 00414640 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 14:15 - 2006-11-02 12:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-09 10:10 - 2011-01-11 10:43 - 00736010 _____ C:\Windows\PFRO.log
2013-10-08 22:42 - 2013-10-08 22:42 - 00057637 _____ C:\ComboFix.txt
2013-10-08 22:42 - 2013-10-08 22:18 - 00000000 ____D C:\ComboFix
2013-10-08 22:42 - 2013-10-08 21:54 - 00000000 ____D C:\Qoobox
2013-10-08 22:42 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-10-08 22:39 - 2013-10-08 21:53 - 00000000 ____D C:\Windows\erdnt
2013-10-08 22:38 - 2006-11-02 12:23 - 00000248 _____ C:\Windows\system.ini
2013-10-08 21:52 - 2013-10-08 21:51 - 05132072 ____R (Swearware) C:\Users\schenke\Desktop\ComboFix.exe
2013-10-08 21:02 - 2013-10-08 21:02 - 00103680 _____ (GMER) C:\ufddqpow.sys
2013-10-08 21:01 - 2010-09-08 20:04 - 00000000 ____D C:\Windows\Minidump
2013-10-08 21:00 - 2013-10-08 21:00 - 219077120 _____ C:\Windows\MEMORY.DMP
2013-10-08 20:59 - 2013-10-08 20:59 - 00377856 _____ C:\Users\schenke\Desktop\gmer_2.1.19163.exe
2013-10-08 20:47 - 2013-10-08 20:47 - 00017948 _____ C:\Users\schenke\Desktop\Addition.txt
2013-10-08 20:45 - 2013-10-08 20:45 - 01087213 _____ (Farbar) C:\Users\schenke\Desktop\FRST.exe
2013-10-08 20:45 - 2013-10-08 20:45 - 00000000 ____D C:\FRST
2013-10-08 20:38 - 2013-10-08 20:38 - 00003748 _____ C:\Windows\RegBootClean.CFG
2013-10-08 20:38 - 2011-03-25 08:45 - 00181808 _____ C:\Windows\RegBootClean.exe
2013-10-08 20:36 - 2013-10-08 20:35 - 00000474 _____ C:\Users\schenke\Desktop\defogger_disable.log
2013-10-08 20:35 - 2013-10-08 20:35 - 00000000 _____ C:\Users\Bea_PC\defogger_reenable
2013-10-08 20:35 - 2008-09-30 20:22 - 00000000 ____D C:\Users\Bea_PC
2013-10-08 20:27 - 2013-10-08 20:27 - 00050477 _____ C:\Users\schenke\Desktop\Defogger.exe
2013-10-08 20:26 - 2008-10-01 00:21 - 00110256 _____ C:\Users\schenke\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-07 21:15 - 2011-07-01 21:02 - 00000000 ____D C:\Users\schenke\AppData\Roaming\vlc
2013-09-22 12:29 - 2013-10-10 14:12 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-22 12:22 - 2013-10-10 14:12 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-22 12:22 - 2013-10-10 14:12 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-22 12:14 - 2013-10-10 14:12 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-22 12:13 - 2013-10-10 14:12 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-22 12:13 - 2013-10-10 14:12 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-22 12:12 - 2013-10-10 14:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-22 12:09 - 2013-10-10 14:12 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-22 12:08 - 2013-10-10 14:12 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-22 12:07 - 2013-10-10 14:12 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-22 12:06 - 2013-10-10 14:13 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-22 12:05 - 2013-10-10 14:12 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-22 12:03 - 2013-10-10 14:13 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-22 12:03 - 2013-10-10 14:13 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-22 12:03 - 2013-10-10 14:12 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-22 11:59 - 2013-10-10 14:12 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-21 23:57 - 2013-09-21 21:09 - 00000000 ____D C:\Users\schenke\Desktop\Auswahl
2013-09-10 22:56 - 2008-10-02 15:36 - 00119296 _____ C:\Users\schenke\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-10 13:37 - 2007-08-21 19:19 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-10 13:32 - 2013-09-10 13:10 - 00000000 ____D C:\Program Files\Microsoft Office
2013-09-10 13:32 - 2006-11-02 14:37 - 00000000 ____D C:\Windows\ShellNew
2013-09-10 13:31 - 2006-11-02 14:37 - 00000000 ____D C:\Program Files\MSBuild
2013-09-10 13:31 - 2006-11-02 13:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-09-10 13:18 - 2007-08-21 19:17 - 00000000 ____D C:\Program Files\Microsoft Works
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Microsoft Visual Studio
2013-09-10 13:17 - 2013-09-10 13:17 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-09-10 13:16 - 2008-10-01 14:10 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-09-10 13:10 - 2006-11-02 13:18 - 00000000 ____D C:\Program Files\Common Files\System
2013-09-10 13:10 - 2006-11-02 12:23 - 00000219 _____ C:\Windows\win.ini
2013-09-10 13:09 - 2013-09-10 13:09 - 00000000 ___RD C:\MSOCache
2013-09-10 12:36 - 2011-02-12 19:13 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Skype
2013-09-10 12:31 - 2011-07-22 13:16 - 00000000 ____D C:\Program Files\OpenOffice.org 3
2013-09-10 11:36 - 2007-08-21 19:44 - 00000000 ____D C:\Windows\SMINST

Files to move or delete:
====================
C:\Users\schenke\Firefox Setup 3.0.3.exe


Some content of TEMP:
====================
C:\Users\Bea_PC\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
--- --- ---

--- --- ---


Alt 11.10.2013, 08:41   #6
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?

Alt 14.10.2013, 12:55   #7
tixi
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Hallo Schrauber,
so hier nun die log's:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2dbb3d012bad2e4f8fa6664eb19a6877
# engine=15452
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-12 01:58:44
# local_time=2013-10-12 03:58:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 27591885 219075852 0 0
# scanned=206682
# found=4
# cleaned=0
# scan_time=18791
sh=6F787399ED31128D9EEB0478718F18324498BE77 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.PEJ trojan" ac=I fn="C:\Users\schenke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11\37ada38b-699cd770"
sh=A421E71A6BD46AB870E275694598F3D9F6093F7E ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.PEJ trojan" ac=I fn="C:\Users\schenke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33\680aa9a1-5a33d051"
sh=990CB2B686547886F9E7A8FF8079A335B87F908C ft=0 fh=0000000000000000 vn="Java/Agent.CR trojan" ac=I fn="C:\Users\schenke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\dfb3ce8-2e88d5fd"
sh=8A84355FDB33B94E1957EC44F2BC98A807E9A5D4 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.PGU trojan" ac=I fn="C:\Users\schenke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\76cd7848-2a204903"
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.74  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
Trend Micro Titanium Maximum Security   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java(TM) 6 Update 31  
 Java 7 Update 9  
 Java version out of Date! 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Flash Player 	11.2.202.233  
 Adobe Reader 8 Adobe Reader out of Date! 
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox 13.0.1 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 Trend Micro AMSP coreServiceShell.exe  
 Trend Micro UniClient UiFrmWrk uiWatchDog.exe 
 Trend Micro AMSP coreFrameworkHost.exe  
 Trend Micro AMSP AMSP_LogServer.exe  
 Trend Micro UniClient UiFrmWrk uiSeAgnt.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by schenke (ATTENTION: The logged in user is not administrator) on BEA-PC on 14-10-2013 13:27:27
Running from C:\Users\schenke\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(O&O Software GmbH) C:\WINDOWS\System32\oodtray.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\WINDOWS\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(ACD Systems) C:\Program Files\Common Files\ACD Systems\DE\DevDetect.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Dropbox, Inc.) C:\Users\schenke\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\FwebProt.exe
(AVM Berlin) C:\Program Files\FRITZ!DSL\StCenter.EXE
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [WAWifiMessage] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe [317128 2007-01-11] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe [1382568 2013-09-16] (Trend Micro Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [OODefragTray] - C:\Windows\system32\oodtray.exe [2512392 2007-05-11] (O&O Software GmbH)
HKLM\...\Run: [LanguageShortcut] - C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [49152 2006-09-29] ()
HKLM\...\Run: [hpWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [472776 2007-03-01] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [Conime] - C:\Windows\system32\conime.exe [69120 2009-04-11] (Microsoft Corporation)
HKLM\...\Run: [AVMWlanClient] - C:\Program Files\avmwlanstick\wlangui.exe [1454080 2006-12-28] (AVM Berlin)
HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [132920 2013-08-29] (Trend Micro Inc.)
HKLM\...\RunOnce: [Launcher] - %WINDIR%\SMINST\launcher.exe [44128 2006-11-08] (soft thinks)
HKLM\...\RunOnce: [DCERegBootClean] - C:\Windows\RegBootClean.exe [181808 2013-10-14] ()
HKLM\...\RunOnce: [*WerKernelReporting] - %SYSTEMROOT%\SYSTEM32\WerFault.exe -k -rq [217088 2009-04-11] (Microsoft Corporation)
HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [484904 2007-04-19] (Hewlett-Packard Company)
HKCU\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [Device Detector] - DevDetect.exe -autorun
MountPoints2: {1f443d3c-8f2d-11dd-8b4f-001a73a7f47a} - G:\pushinst.exe
MountPoints2: {2d5bb31c-ae70-11dd-b61a-001a73a7f47a} - G:\LaunchU3.exe -a
MountPoints2: {528df0dc-5aa3-11e0-839f-001b24a08592} - F:\firefox////report.exe
MountPoints2: {c800dbad-72a3-11e0-823c-001a73a7f47a} - USBS\Open.exe
Startup: C:\Users\Bea_PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files\FRITZ!DSL\FwebProt.exe (AVM Berlin)
Startup: C:\Users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\schenke\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\schenke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Protect.lnk
ShortcutTarget: FRITZ!DSL Protect.lnk -> C:\Program Files\FRITZ!DSL\FwebProt.exe (AVM Berlin)
BootExecute: autocheck autochk * OODBS

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.t-online.de/cpm-redir/ie-9.html
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {4D8D54C6-8B48-4AA5-BF95-A180ECC71884} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
SearchScopes: HKCU - {30B74494-E60B-414C-8599-9ADFEB3DDEE2} URL = hxxp://suche.t-online.de/fast-cgi/tsc?mandant=toi&device=html&portallanguage=de&userlanguage=de&dia=suche&context=internet-tab&tpc=internet&ptl=std&classification=internet-tab_internet_std&q={searchTerms}&br=ie7-toi
SearchScopes: HKCU - {4D8D54C6-8B48-4AA5-BF95-A180ECC71884} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06
SearchScopes: HKCU - {5367D1D7-6793-4042-8996-AC9D2239B3BB} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag= interactivemesuche21&index=blended&linkCode=ur2&camp=1638&creative=6742
SearchScopes: HKCU - {8831D5E0-596A-4451-87C0-10504E93CAD0} URL = hxxp://suche.t-online.de/fastcgi/tsc?mandant=toi&device=html&portallanguage=de&userlanguage=de&d ia=suche&context=wiki-tab&tpc=internet&ptl=std&classification=wikitab_internet_std&q={searchTerms}&br=ie7-toi
SearchScopes: HKCU - {92CFE0EC-2ADA-4492-BD69-FBBD33AB2737} URL = hxxp://rover.ebay.com/rover/1/707-1403-276402/4?mpre=hxxp://search.ebay.de/search/search.dll?shortcut=4&query={sear chTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll (Trend Micro Inc.)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: amazon - {84B94901-3645-4D80-A6B7-4D0050B19455} - C:\PROGRA~1\PREISP~1\PREISP~1\IEBUTT~2.DLL ()
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: No Name - {AA58ED58-01DD-4d91-8333-CF10577473F7} -  No File
BHO: No Name - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -  No File
BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: Preispiraten 4 - {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} - C:\PROGRA~1\PREISP~1\PREISP~1\IEBUTT~1.DLL ()
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
Winsock: Catalog5 07 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 01 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 02 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 03 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Winsock: Catalog9 14 C:\Program Files\FRITZ!DSL\\sarah.dll [24880] (AVM Berlin)
Tcpip\Parameters: [DhcpNameServer] 83.169.186.33 83.169.186.97

FireFox:
========
FF ProfilePath: C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default
FF Homepage: https://eu.ixquick.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @TrendMicro.com/FFExtension - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll (Trend Micro Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @movenetworks.com/Quantum Media Player - C:\Users\schenke\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks)
FF SearchPlugin: C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\searchplugins\ixquick---deutsch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\SP_preispiraten_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\nostmp
FF Extension: Adobe DLM (powered by getPlus(R)) - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF Extension: No Name - C:\Users\schenke\AppData\Roaming\Mozilla\Firefox\Profiles\cr706vm4.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
FF Extension: Amazon-Startcenter - C:\Program Files\Mozilla Firefox\extensions\{144D1513-0819-4538-AD26-D515AF443AE7}
FF Extension: Google Kontextmenü - C:\Program Files\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Preispiraten4 - C:\Program Files\Mozilla Firefox\extensions\{A86278FF-6B63-446C-B109-DD4E1BAAC868}
FF Extension: Preispiraten 4 Kontextmenü - C:\Program Files\Mozilla Firefox\extensions\{D2A8BC29-8CA3-4C0A-A206-631C44E9620F}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF HKLM\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension
FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension\

========================== Services (Whitelisted) =================

R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [356352 2006-12-28] (AVM Berlin)
S2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [62984 2007-03-14] (Hewlett-Packard)
R2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [87344 2007-09-04] (AVM Berlin)
R2 iphlpsvc; C:\Windows\System32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
R2 O&O Defrag; C:\Windows\system32\oodag.exe [1050120 2007-05-11] (O&O Software GmbH)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [167936 2005-08-08] ()
R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=nb -dt=60000 -ad [x]
S3 gusvc; "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" [x]
S3 stllssvr; "C:\Program Files\Common Files\SureThing Shared\stllssvr.exe" [x]
S2 TuneUp.UtilitiesSvc; "C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe" [x]

==================== Drivers (Whitelisted) ====================

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2006-12-28] (AVM Berlin)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-01-26] (AVM GmbH)
S3 HdAudAddService; C:\Windows\System32\drivers\CHDART.sys [160768 2007-04-12] (Conexant Systems Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [96736 2013-09-04] (Trend Micro Inc.)
R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [263072 2013-09-04] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [38328 2012-08-24] (Trend Micro Inc.)
R2 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [83256 2012-12-07] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [76624 2013-09-04] (Trend Micro Inc.)
R2 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [171064 2012-07-06] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Bea_PC\AppData\Local\Temp\catchme.sys [x]
U4 eabfiltr; 
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 neokdss; system32\Drivers\neokdss.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U2 TMAgent; 
S3 TuneUpUtilitiesDrv; \??\C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-14 13:27 - 2013-10-14 13:27 - 01087213 _____ (Farbar) C:\Users\schenke\Desktop\FRST.exe
2013-10-12 20:13 - 2013-10-12 20:14 - 06951048 _____ (Microsoft Corporation) C:\Users\schenke\Desktop\Silverlight.exe
2013-10-11 22:41 - 2013-10-11 22:41 - 00000000 ____D C:\Program Files\ESET
2013-10-11 22:40 - 2013-10-11 22:40 - 00891167 _____ C:\Users\schenke\Desktop\SecurityCheck.exe
2013-10-11 22:39 - 2013-10-11 22:39 - 02347384 _____ (ESET) C:\Users\schenke\Desktop\esetsmartinstaller_enu.exe
2013-10-10 21:49 - 2013-10-10 21:50 - 00000658 _____ C:\Users\Bea_PC\Desktop\JRT.txt
2013-10-10 21:14 - 2013-10-10 21:14 - 00000000 ____D C:\Windows\ERUNT
2013-10-10 20:54 - 2013-10-10 20:56 - 00000000 ____D C:\AdwCleaner
2013-10-10 20:25 - 2013-10-10 20:25 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-10 20:23 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-10 20:21 - 2013-10-10 20:22 - 01032220 _____ (Thisisu) C:\Users\schenke\Desktop\JRT.exe
2013-10-10 20:21 - 2013-10-10 20:21 - 01048960 _____ C:\Users\schenke\Desktop\adwcleaner.exe
2013-10-10 20:20 - 2013-10-10 20:20 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\schenke\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-10 14:13 - 2013-09-22 12:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-10 14:13 - 2013-09-22 12:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 14:13 - 2013-09-22 12:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-10 14:12 - 2013-09-22 12:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 14:12 - 2013-09-22 12:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 14:12 - 2013-09-22 12:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 14:12 - 2013-09-22 12:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-10 14:12 - 2013-09-22 12:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 14:12 - 2013-09-22 12:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 14:12 - 2013-09-22 12:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-10 14:12 - 2013-09-22 12:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 14:12 - 2013-09-22 12:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-10 14:12 - 2013-09-22 12:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 14:12 - 2013-09-22 12:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 14:12 - 2013-09-22 12:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 14:12 - 2013-09-22 11:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 12:55 - 2013-08-29 09:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 12:55 - 2013-08-27 04:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-10-10 12:55 - 2013-08-27 04:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-10-10 12:55 - 2013-08-27 04:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-10-10 12:55 - 2013-08-27 04:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-10-10 12:55 - 2013-08-27 03:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-10-10 12:55 - 2013-08-27 03:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-10-10 12:55 - 2013-08-27 03:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-10-10 12:55 - 2013-08-27 03:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-10-10 12:55 - 2013-08-27 03:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-10-10 12:55 - 2013-08-01 05:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 12:55 - 2013-08-01 04:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-10-10 12:55 - 2013-07-20 12:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 12:51 - 2013-07-12 11:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-10 12:51 - 2013-06-29 04:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 12:51 - 2013-06-29 04:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 12:51 - 2013-06-29 04:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 12:51 - 2013-06-29 04:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 12:51 - 2011-05-05 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 12:51 - 2011-05-05 15:54 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 12:50 - 2013-06-27 01:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-10 12:49 - 2013-07-04 06:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 12:49 - 2013-07-03 04:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 12:49 - 2013-07-03 04:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 12:49 - 2013-06-04 06:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 12:49 - 2013-06-04 03:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-08 22:42 - 2013-10-08 22:42 - 00057637 _____ C:\ComboFix.txt
2013-10-08 22:18 - 2013-10-08 22:42 - 00000000 ____D C:\ComboFix
2013-10-08 22:18 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-08 22:18 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-08 22:18 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-08 22:18 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-08 21:54 - 2013-10-08 22:42 - 00000000 ____D C:\Qoobox
2013-10-08 21:53 - 2013-10-08 22:39 - 00000000 ____D C:\Windows\erdnt
2013-10-08 21:51 - 2013-10-08 21:52 - 05132072 ____R (Swearware) C:\Users\schenke\Desktop\ComboFix.exe
2013-10-08 21:02 - 2013-10-08 21:02 - 00103680 _____ (GMER) C:\ufddqpow.sys
2013-10-08 21:00 - 2013-10-08 21:00 - 219077120 _____ C:\Windows\MEMORY.DMP
2013-10-08 20:59 - 2013-10-08 20:59 - 00377856 _____ C:\Users\schenke\Desktop\gmer_2.1.19163.exe
2013-10-08 20:47 - 2013-10-08 20:47 - 00017948 _____ C:\Users\schenke\Desktop\Addition.txt
2013-10-08 20:45 - 2013-10-08 20:45 - 00000000 ____D C:\FRST
2013-10-08 20:38 - 2013-10-14 13:20 - 00004546 _____ C:\Windows\RegBootClean.CFG
2013-10-08 20:35 - 2013-10-08 20:36 - 00000474 _____ C:\Users\schenke\Desktop\defogger_disable.log
2013-10-08 20:35 - 2013-10-08 20:35 - 00000000 _____ C:\Users\Bea_PC\defogger_reenable
2013-10-08 20:27 - 2013-10-08 20:27 - 00050477 _____ C:\Users\schenke\Desktop\Defogger.exe
2013-09-21 21:09 - 2013-09-21 23:57 - 00000000 ____D C:\Users\schenke\Desktop\Auswahl
2013-09-21 20:54 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll

==================== One Month Modified Files and Folders =======

2013-10-14 13:27 - 2013-10-14 13:27 - 01087213 _____ (Farbar) C:\Users\schenke\Desktop\FRST.exe
2013-10-14 13:24 - 2012-04-18 22:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-14 13:23 - 2007-09-13 15:16 - 01586735 _____ C:\Windows\WindowsUpdate.log
2013-10-14 13:20 - 2013-10-08 20:38 - 00004546 _____ C:\Windows\RegBootClean.CFG
2013-10-14 13:20 - 2011-03-25 08:45 - 00181808 _____ C:\Windows\RegBootClean.exe
2013-10-14 11:48 - 2010-05-27 16:38 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Dropbox
2013-10-14 11:45 - 2013-08-21 12:22 - 00000310 _____ C:\Windows\Tasks\Kedrmqmv.job
2013-10-14 11:45 - 2012-03-20 23:04 - 00000388 _____ C:\Windows\Tasks\Final Media Player Update Checker.job
2013-10-14 11:45 - 2011-12-09 13:10 - 00255073 _____ C:\ProgramData\nvModes.dat
2013-10-14 11:45 - 2011-12-09 13:10 - 00255073 _____ C:\ProgramData\nvModes.001
2013-10-14 11:45 - 2008-10-01 09:54 - 02677869 _____ C:\Windows\system32\oodbs.lor
2013-10-14 11:45 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-14 11:45 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-14 11:45 - 2006-11-02 14:47 - 00003168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-14 11:44 - 2006-11-02 15:01 - 00032582 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-13 20:26 - 2012-04-14 23:02 - 00000000 ____D C:\Users\schenke\AppData\Roaming\FRITZ!
2013-10-13 12:58 - 2012-01-22 17:08 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-12 20:14 - 2013-10-12 20:13 - 06951048 _____ (Microsoft Corporation) C:\Users\schenke\Desktop\Silverlight.exe
2013-10-11 22:41 - 2013-10-11 22:41 - 00000000 ____D C:\Program Files\ESET
2013-10-11 22:40 - 2013-10-11 22:40 - 00891167 _____ C:\Users\schenke\Desktop\SecurityCheck.exe
2013-10-11 22:39 - 2013-10-11 22:39 - 02347384 _____ (ESET) C:\Users\schenke\Desktop\esetsmartinstaller_enu.exe
2013-10-10 21:56 - 2008-10-01 00:44 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-10 21:50 - 2013-10-10 21:49 - 00000658 _____ C:\Users\Bea_PC\Desktop\JRT.txt
2013-10-10 21:14 - 2013-10-10 21:14 - 00000000 ____D C:\Windows\ERUNT
2013-10-10 20:56 - 2013-10-10 20:54 - 00000000 ____D C:\AdwCleaner
2013-10-10 20:39 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 20:25 - 2013-10-10 20:25 - 00000000 ____D C:\Users\schenke\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000912 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Users\Bea_PC\AppData\Roaming\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-10 20:23 - 2013-10-10 20:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-10 20:22 - 2013-10-10 20:21 - 01032220 _____ (Thisisu) C:\Users\schenke\Desktop\JRT.exe
2013-10-10 20:21 - 2013-10-10 20:21 - 01048960 _____ C:\Users\schenke\Desktop\adwcleaner.exe
2013-10-10 20:20 - 2013-10-10 20:20 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\schenke\Desktop\mbam-setup-1.75.0.1300.exe
2013-10-10 20:09 - 2006-11-02 12:33 - 01573070 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-10 20:02 - 2006-11-02 14:47 - 00414640 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 14:15 - 2006-11-02 12:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-10-09 10:10 - 2011-01-11 10:43 - 00736010 _____ C:\Windows\PFRO.log
2013-10-08 22:42 - 2013-10-08 22:42 - 00057637 _____ C:\ComboFix.txt
2013-10-08 22:42 - 2013-10-08 22:18 - 00000000 ____D C:\ComboFix
2013-10-08 22:42 - 2013-10-08 21:54 - 00000000 ____D C:\Qoobox
2013-10-08 22:42 - 2006-11-02 13:18 - 00000000 ___RD C:\Users\Public
2013-10-08 22:39 - 2013-10-08 21:53 - 00000000 ____D C:\Windows\erdnt
2013-10-08 22:38 - 2006-11-02 12:23 - 00000248 _____ C:\Windows\system.ini
2013-10-08 21:52 - 2013-10-08 21:51 - 05132072 ____R (Swearware) C:\Users\schenke\Desktop\ComboFix.exe
2013-10-08 21:02 - 2013-10-08 21:02 - 00103680 _____ (GMER) C:\ufddqpow.sys
2013-10-08 21:01 - 2010-09-08 20:04 - 00000000 ____D C:\Windows\Minidump
2013-10-08 21:00 - 2013-10-08 21:00 - 219077120 _____ C:\Windows\MEMORY.DMP
2013-10-08 20:59 - 2013-10-08 20:59 - 00377856 _____ C:\Users\schenke\Desktop\gmer_2.1.19163.exe
2013-10-08 20:47 - 2013-10-08 20:47 - 00017948 _____ C:\Users\schenke\Desktop\Addition.txt
2013-10-08 20:45 - 2013-10-08 20:45 - 00000000 ____D C:\FRST
2013-10-08 20:36 - 2013-10-08 20:35 - 00000474 _____ C:\Users\schenke\Desktop\defogger_disable.log
2013-10-08 20:35 - 2013-10-08 20:35 - 00000000 _____ C:\Users\Bea_PC\defogger_reenable
2013-10-08 20:35 - 2008-09-30 20:22 - 00000000 ____D C:\Users\Bea_PC
2013-10-08 20:27 - 2013-10-08 20:27 - 00050477 _____ C:\Users\schenke\Desktop\Defogger.exe
2013-10-08 20:26 - 2008-10-01 00:21 - 00110256 _____ C:\Users\schenke\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-07 21:15 - 2011-07-01 21:02 - 00000000 ____D C:\Users\schenke\AppData\Roaming\vlc
2013-09-22 12:29 - 2013-10-10 14:12 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-22 12:22 - 2013-10-10 14:12 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-22 12:22 - 2013-10-10 14:12 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-22 12:14 - 2013-10-10 14:12 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-22 12:13 - 2013-10-10 14:12 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-22 12:13 - 2013-10-10 14:12 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-22 12:12 - 2013-10-10 14:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-22 12:09 - 2013-10-10 14:12 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-22 12:08 - 2013-10-10 14:12 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-22 12:07 - 2013-10-10 14:12 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-22 12:06 - 2013-10-10 14:13 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-22 12:05 - 2013-10-10 14:12 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-22 12:03 - 2013-10-10 14:13 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-22 12:03 - 2013-10-10 14:13 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-22 12:03 - 2013-10-10 14:12 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-22 11:59 - 2013-10-10 14:12 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-21 23:57 - 2013-09-21 21:09 - 00000000 ____D C:\Users\schenke\Desktop\Auswahl

Files to move or delete:
====================
C:\Users\schenke\Firefox Setup 3.0.3.exe


Some content of TEMP:
====================
C:\Users\Bea_PC\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Ich habe nochmals die google suche versucht und auf einen Link geklickt, aber leider werde ich immer noch weitergeleitet.

LG tixi

Alt 14.10.2013, 19:52   #8
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Java, Flash, Adobe und Firefox updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.


In welchem Browser?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 15.10.2013, 18:57   #9
tixi
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Hallo Schrauber,

also ich hab jetzt alles gemacht, aber leider ist der Virus immer noch da.
Ich benutze den Mozialla Firofox Browser!

LG
tixi

Alt 16.10.2013, 09:52   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Standard

Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Immer noch?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?
32 bit, auf werbung umgeleitet, bingbar, browser, computer, dsl, error, farbar, farbar recovery scan tool, firefox, flash player, home, homepage, java/agent.cr, java/exploit.agent.pej, java/exploit.agent.pgu, launch, plug-in, problem, registry, services.exe, software, svchost.exe, system, vista, werbung, windows


« Windows7, Spybot findet multiple Malware | Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben »


Ähnliche Themen: Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?


  1. Windows Vista Home Premium Service Pack 2 Win32/Bundled.Toolbar.Google.D und Variante von Win32/OpenCandy.C mit eset online scanner gefunden
    Log-Analyse und Auswertung - 16.10.2015 (9)
  2. Windows 7 Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 07.09.2015 (10)
  3. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 30.07.2015 (8)
  4. Windows 7: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 15.07.2015 (19)
  5. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 10.01.2015 (10)
  6. Windows 7: Webseiten werden auf Werbung umgeleitet.
    Plagegeister aller Art und deren Bekämpfung - 25.11.2014 (9)
  7. Windows 7: WEBSEITEN werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 03.10.2014 (5)
  8. Windows 8: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 01.08.2014 (5)
  9. Windows 7: Internet Explorer startet automatisch Werbung/ Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 27.07.2014 (7)
  10. Windows Vista: Webseiten werden auf Werbung umgeleitet.
    Log-Analyse und Auswertung - 11.04.2014 (34)
  11. Windows 7: Webseiten werden auf Werbung umgeleitet, veralteter Browser erkannt obwohl aktuell wie auch flashplayer, spybot search mit Virus
    Log-Analyse und Auswertung - 11.12.2013 (16)
  12. Windows 7 Home Premium 64-Bit : Verdacht auf Virus >Ihavenet<
    Log-Analyse und Auswertung - 02.11.2013 (6)
  13. Windows 7: Webseiten werden auf werbung umgeleitet
    Log-Analyse und Auswertung - 27.10.2013 (9)
  14. TR/Agent.131072.V - Fund von Antivir \Windows Vista Home Basic Service Pack 2
    Log-Analyse und Auswertung - 13.10.2013 (15)
  15. Win Vista: Webseiten (auch Besucher) werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 23.09.2013 (9)
  16. Windows 7: Webseiten (Google) werden auf Werbung umgeleitet (ihavenet)
    Log-Analyse und Auswertung - 15.09.2013 (13)
  17. Windows 8: Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 24.08.2013 (5)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? - Hallo Leute, ich habe ein Problem mit meinem Computer, ich werde bei der Googlesuche ständig auf andere Seiten weitergeleitet und komme beim klicken auf den Link nicht mehr auf die - Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus?...
Archiv
Du betrachtest: Windows Vista Home Premium Service Pack 2 2007: Webseiten werden auf Werbung umgeleitet! Besonders bei Googlesuche! ihavenet Virus? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129