Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Google Such Link leitet auf eine andere Seite um

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 27.12.2011, 23:01   #1
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Hallo und Bitte um Hilfe,

ich habe die Suchfunktion benutzt, aber noch keinen hilfreichen Beitrag zu meinem speziellen Thema gefunden.

Eine Google Suche wird immer auf einen Präfix seite (hxxp://95p.com/...) umgeleitet.

Malewarebyte und SpyBootSD habe ich durchlauffen lassen auch den cccleaner aber das Problem besteht immer noch.

Hijackthis ergibt folgenden Log
Zitat:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 22:51:26, on 27.12.2011
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16912)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Vtune\TBPANEL.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\xampp\xampp-control.exe
C:\xampp\apache\bin\httpd.exe
C:\xampp\apache\bin\httpd.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
C:\Users\Christian\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hiergehtslos.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Windows Live ID Sign-in Helper - {11020C8B-5174-407D-41C2-4F712CA13A3E} - C:\Windows\SysWOW64\eaappprxy.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {613B0591-718A-1647-6B04-1B5D08AB694C} - C:\Windows\SysWOW64\iaasnap.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~2\FlashFXP\IEFlash.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\RunOnce: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [TBPanel] C:\Program Files (x86)\Vtune\TBPanel.exe /A
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3986920089-1276453631-457452291-1010\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'UpdatusUser')
O4 - HKUS\S-1-5-21-3986920089-1276453631-457452291-1010\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'UpdatusUser')
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: AAV UpdateService - Unknown owner - C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira Echtzeit Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: DES2 Service for Energy Saving. (DES2 Service) - Unknown owner - C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMSAccess - Unknown owner - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Smart TimeLock Service (Smart TimeLock) - Gigabyte Technology CO., LTD. - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 15215 bytes
Desweiteren arbeite ich gerade offline an einer Webseite und diese wird im localhost auch nicht mehr angezeigt, ständig sucht er pausenlos.

als Browser benutze ich nur Firefox.

Wenn jemand helfen kann bin ich für jeden Lösungsvorschlag zu haben.

LG Christian

Alt 28.12.2011, 00:06   #2
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Hier noch der fehlende OTL Log:

OTL Logfile:
OTL EXTRAS Logfile:
Code:
ATTFilter
OTL logfile created on: 27.12.2011 23:59:38 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Christian\Downloads
64bit- Enterprise Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 5,83 Gb Available Physical Memory | 73,06% Memory free
15,97 Gb Paging File | 13,39 Gb Available in Paging File | 83,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297,99 Gb Total Space | 70,21 Gb Free Space | 23,56% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 13,37 Gb Free Space | 2,87% Space Free | Partition Type: NTFS
Drive I: | 298,08 Gb Total Space | 60,94 Gb Free Space | 20,45% Space Free | Partition Type: NTFS
Drive T: | 931,51 Gb Total Space | 246,06 Gb Free Space | 26,41% Space Free | Partition Type: NTFS
Drive Z: | 931,51 Gb Total Space | 57,51 Gb Free Space | 6,17% Space Free | Partition Type: NTFS
 
Computer Name: CHRISTIAN-PC | User Name: Christian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Christian\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
PRC - C:\Program Files (x86)\Vtune\TBPANEL.exe (Gainward Co.)
PRC - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ()
PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
PRC - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\AlarmClock.exe (Gigabyte Technology CO., LTD.)
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
PRC - C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe (Gigabyte Technology CO., LTD.)
PRC - C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe ()
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe ()
PRC - C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\plugins\iCalendarPlugin.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTMUI.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTHAL.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTCore.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTUI.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTFC.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\wxmsw28u_xrc_vc_rny.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\wxbase28u_xml_vc_rny.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\wxmsw28u_html_vc_rny.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\wxmsw28u_adv_vc_rny.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\wxmsw28u_core_vc_rny.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\wxbase28u_vc_rny.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\Normal.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\work.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\MFCCPU.DLL ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\GVTunner.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\OCK.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\GPTT.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\StabilityLib.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files (x86)\MSI Afterburner\RTTSH.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\IccLibDll.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\AMD8.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\lfs.dll ()
MOD - C:\Program Files (x86)\Rainlendar2\lua51.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\Platform.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\Device.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\SF.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\ycc.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\HM.dll ()
MOD - \\?\globalroot\systemroot\syswow64\mswsock.DLL ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\CIAMIB.dll ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe ()
MOD - C:\Program Files (x86)\GIGABYTE\ET6\Sound.dll ()
MOD - C:\Program Files (x86)\Vtune\TBManage.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)
SRV:64bit: - (AppleChargerSrv) -- C:\Windows\SysNative\AppleChargerSrv.exe ()
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (KMService) -- C:\Windows\SysWOW64\srvany.exe ()
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (NMSAccess) -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe ()
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (Smart TimeLock) -- C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe (Gigabyte Technology CO., LTD.)
SRV - (DES2 Service) -- C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe ()
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (AAV UpdateService) -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe ()
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (MEMSWEEP2) -- C:\Windows\SysNative\6C36.tmp (Sophos Plc)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (cpuz135) -- C:\Windows\SysNative\drivers\cpuz135_x64.sys (CPUID)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (AppleCharger) -- C:\Windows\SysNative\drivers\AppleCharger.sys ()
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (StarOpen) -- C:\Windows\SysNative\drivers\StarOpen.sys ()
DRV:64bit: - (P17) -- C:\Windows\SysNative\drivers\P17.sys (Creative Technology Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (USBPNPA) -- C:\Windows\SysNative\drivers\CM10864.sys (C-Media Electronics Inc)
DRV:64bit: - (WDC_SAM) -- C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
DRV - (GVTDrv64) -- C:\Windows\GVTDrv64.sys ()
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (RTCore64) -- C:\Program Files (x86)\MSI Afterburner\RTCore64.sys ()
DRV - (StarOpen) -- C:\Windows\SysWow64\drivers\StarOpen.sys ()
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (Cardex) -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys (Windows (R) Server 2003 DDK provider)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hiergehtslos.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 83 7D EB DB D9 D9 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: quickstores@quickstores.de:1.2.0
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: web2pdfextension@web2pdf.adobedotcom:1.0
FF - prefs.js..keyword.URL: "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q="
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Users\Christian\AppData\Roaming\ProtectDisc\License Helper v2\NPPDLicenseHelper.dll ( )
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2011.05.25 22:01:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.02 12:30:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.18 14:26:06 | 000,000,000 | ---D | M]
 
[2010.07.20 06:32:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christian\AppData\Roaming\mozilla\Extensions
[2011.12.27 21:25:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christian\AppData\Roaming\mozilla\Firefox\Profiles\j53f1ibk.default\extensions
[2011.01.09 11:38:44 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Christian\AppData\Roaming\mozilla\Firefox\Profiles\j53f1ibk.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2011.02.12 14:13:15 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Christian\AppData\Roaming\mozilla\Firefox\Profiles\j53f1ibk.default\extensions\firefox@tvunetworks.com
[2010.10.26 21:05:38 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Users\Christian\AppData\Roaming\mozilla\Firefox\Profiles\j53f1ibk.default\extensions\vshare@toolbar
[2010.10.26 21:05:47 | 000,001,583 | ---- | M] () -- C:\Users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\j53f1ibk.default\searchplugins\web-search.xml
[2011.12.02 12:30:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.11.30 08:21:09 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.11.18 23:29:41 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Program Files (x86)\mozilla firefox\extensions\quickstores@quickstores.de
[2011.11.21 05:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.03.03 20:46:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.27 14:45:50 | 000,083,456 | ---- | M] (LiveVDO ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2011.11.21 02:17:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.21 02:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.11.21 02:17:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.21 02:17:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.21 02:17:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.21 02:17:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.05.25 21:57:03 | 000,001,835 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {11020C8B-5174-407D-41C2-4F712CA13A3E} - C:\Windows\SysWOW64\eaappprxy.dll ()
O2 - BHO: (Windows Live ID Sign-in Helper) - {613B0591-718A-1647-6B04-1B5D08AB694C} - C:\Windows\SysWOW64\iaasnap.dll ()
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (FlashFXP Helper for Internet Explorer) - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~2\FlashFXP\IEFlash.dll (IniCom Networks, Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Cm108Sound] C:\Windows\Syswow64\cm108.dll (C-Media Corporation)
O4:64bit: - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [Launch LgDeviceAgent] C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup File not found
O4 - HKCU..\Run: [Rainlendar2] C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe ()
O4 - HKCU..\Run: [TBPanel] C:\Program Files (x86)\Vtune\TBPanel.exe (Gainward Co.)
O4:64bit: - HKLM..\RunOnce: [RPMKickstart] C:\Program Files\GIGABYTE\SMART6\Recovery\RPMKickstart.exe (Gigabyte Technology CO., LTD.)
O4 - HKLM..\RunOnce: [EasyTuneVI] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 [2010.09.03 21:22:15 | 000,000,000 | ---D | M]
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15112/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{53B069EA-C7E6-41FE-B9F4-E402696E5555}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EAFA3E7E-CF0F-4B6D-8F8D-05CFC2EF9089}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (C:\Users\Christian\AppData\Local\4f0a8a5c\X) -C:\Users\Christian\AppData\Local\4f0a8a5c\X ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.07.18 13:32:31 | 000,000,000 | ---D | M] - I:\AUTODESK.MAYA.UNLIMITED.V2009-ISO -- [ NTFS ]
O32 - AutoRun File - [2010.07.18 13:40:08 | 000,000,000 | ---D | M] - I:\Autodesk_AutoCAD_v2009_GERMAN-CYGiSO -- [ NTFS ]
O33 - MountPoints2\{5eaaa68a-1cf8-11e0-8825-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5eaaa68a-1cf8-11e0-8825-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Nvsetup.exe
O33 - MountPoints2\{8ca51313-93bc-11df-b635-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8ca51313-93bc-11df-b635-806e6f6e6963}\Shell\AutoRun\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{8ca51314-93bc-11df-b635-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8ca51314-93bc-11df-b635-806e6f6e6963}\Shell\AutoRun\command - "" = E:\SETUP.EXE
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.27 22:30:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011.12.27 22:30:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.12.27 22:30:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011.12.27 21:46:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\1012
[2011.12.27 21:46:07 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\1052
[2011.12.27 21:16:35 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Malwarebytes
[2011.12.27 21:16:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.12.27 21:16:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.12.27 21:16:27 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.12.27 21:16:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.12.27 20:05:07 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.12.27 19:55:41 | 000,000,000 | ---D | C] -- C:\avrescue
[2011.12.27 19:53:49 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Avira
[2011.12.27 19:50:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.12.27 19:49:32 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.12.27 19:49:32 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.12.27 19:49:32 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.12.27 19:49:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.12.27 19:49:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2011.12.27 18:55:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sophos
[2011.12.27 18:38:10 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.22 11:59:59 | 000,000,000 | ---D | C] -- C:\ProgramData\RELOADED
[2011.12.21 23:09:42 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\SysWow64\dhRichClient3.dll
[2011.12.21 23:09:35 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\DesktopIconForAmazon
[2011.12.21 22:52:02 | 000,414,368 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.12.21 22:51:47 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2011.12.21 22:47:45 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2011.12.21 22:43:19 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\PanoramaStudio2
[2011.12.21 22:43:15 | 000,000,000 | ---D | C] -- C:\Program Files\PanoramaStudio2
[2011.12.21 22:43:11 | 000,000,000 | -HSD | C] -- C:\Users\Christian\AppData\Local\4f0a8a5c
[2011.12.21 16:15:17 | 000,000,000 | ---D | C] -- C:\Users\Christian\.rainlendar2
[2011.12.21 16:15:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rainlendar2
[2011.12.21 16:15:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rainlendar2
[2011.12.20 22:06:45 | 000,000,000 | ---D | C] -- C:\Users\Christian\Documents\Maurice Klettergerüst
[2011.12.20 12:44:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Canon
[2011.12.20 12:24:36 | 000,000,000 | ---D | C] -- C:\Users\Christian\Desktop\FeWo
[2011.12.18 14:26:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StartSearch plugin
[2011.12.16 20:31:19 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\ElevatedDiagnostics
[2011.12.15 13:29:27 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2011.12.15 13:29:27 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.12.15 13:29:27 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.12.15 13:29:26 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2011.12.15 13:29:26 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2011.12.15 13:29:26 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2011.12.15 13:29:26 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2011.12.15 13:29:26 | 000,134,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.12.15 13:29:26 | 000,132,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.12.15 13:29:26 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.12.15 13:29:26 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.12.15 13:29:26 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2011.12.15 13:29:26 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2011.12.15 13:29:26 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2011.12.15 13:29:26 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2011.12.15 13:05:29 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.15 12:48:34 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.15 12:48:34 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.15 12:25:37 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\torrent-search
[2011.12.13 15:07:08 | 000,000,000 | ---D | C] -- C:\Users\Christian\Documents\Ferienwohnung
[2011.12.11 12:44:25 | 000,000,000 | ---D | C] -- C:\Users\Christian\Documents\Nitro Games
[2011.12.11 11:18:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paradox Interactive
[2011.12.09 13:41:32 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Trine2
[2011.12.09 09:27:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Frozenbyte
[2011.12.06 23:00:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Astroart5 Demo
[2011.12.06 23:00:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astroart 5.0 demo
[2011.12.05 11:36:42 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Local\Canon Easy-PhotoPrint EX
[2011.12.05 11:36:36 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEPPEX
[2011.12.05 11:36:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEPPEX2
[2011.12.05 11:36:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonEPP
[2011.11.30 08:20:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.11.29 23:39:29 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEGV
[2011.11.29 23:38:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG6100 series Manual
[2011.11.29 17:40:53 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJ
[2011.11.29 17:28:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJScan
[2011.11.29 17:27:48 | 000,000,000 | ---D | C] -- C:\Users\Christian\AppData\Roaming\Canon
[2011.11.29 17:21:18 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJPLM
[2011.11.29 17:08:48 | 000,361,472 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNMXLMAG.DLL
[2011.11.29 17:08:28 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJMSetup
[2011.11.29 17:08:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG6100 series Benutzerregistrierung
[2011.11.29 17:08:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\CANON
[2011.11.29 17:08:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
[2011.11.29 17:07:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG6100 series
[2011.11.29 17:07:08 | 000,000,000 | -H-D | C] -- C:\Program Files\CanonBJ
[2011.11.29 17:06:53 | 000,327,680 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNMN6PPM.DLL
[2011.11.29 17:06:53 | 000,037,376 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNMN6UI.DLL
[2011.11.29 17:06:53 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\STRING
[2011.11.29 17:02:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Canon
[2011.11.29 16:57:13 | 000,000,000 | -H-D | C] -- C:\Windows\SysNative\CanonIJ Uninstaller Information
[2011.11.29 16:56:59 | 000,361,472 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNMLMAG.DLL
[2011.11.29 16:56:37 | 001,354,240 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNC6100C.dll
[2011.11.29 16:56:37 | 000,348,672 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNC6100L.dll
[2011.11.29 16:56:37 | 000,307,200 | ---- | C] (CANON INC.) -- C:\Windows\SysWow64\CNC6100L.dll
[2011.11.29 16:56:37 | 000,112,128 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNC6100I.dll
[2011.11.29 16:56:37 | 000,106,496 | ---- | C] (CANON INC.) -- C:\Windows\SysWow64\CNC6100U.dll
[2011.11.29 16:56:37 | 000,017,920 | ---- | C] (CANON INC.) -- C:\Windows\SysNative\CNHMCA6.dll
[2011.11.29 16:56:37 | 000,015,872 | ---- | C] (CANON INC.) -- C:\Windows\SysWow64\CNHMCA.dll
[2011.03.28 06:24:21 | 000,082,816 | ---- | C] (VSO Software) -- C:\Users\Christian\AppData\Roaming\pcouffin.sys
[2010.08.16 06:01:30 | 000,040,445 | ---- | C] (Beepa Pty Ltd) -- C:\Program Files (x86)\uninstall.exe
[2010.06.15 02:54:36 | 000,153,008 | ---- | C] (Beepa P/L) -- C:\Program Files (x86)\fraps64.dll
[2010.06.15 02:54:34 | 000,206,768 | ---- | C] (Beepa P/L) -- C:\Program Files (x86)\fraps32.dll
[2010.06.15 02:54:32 | 000,074,672 | ---- | C] (Beepa P/L) -- C:\Program Files (x86)\fraps64.dat
[2010.06.15 02:54:22 | 002,320,304 | ---- | C] (Beepa P/L) -- C:\Program Files (x86)\fraps.exe
[2010.06.15 02:46:32 | 000,163,840 | ---- | C] (Beepa P/L) -- C:\Program Files (x86)\frapslcd.dll
[5 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.28 00:01:02 | 000,012,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.28 00:01:02 | 000,012,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.27 23:54:29 | 000,030,528 | ---- | M] () -- C:\Windows\GVTDrv64.sys
[2011.12.27 23:54:29 | 000,000,004 | ---- | M] () -- C:\Windows\SysWow64\GVTunner.ref
[2011.12.27 23:54:22 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\Windows\gdrv.sys
[2011.12.27 23:53:54 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.27 23:52:55 | 000,000,324 | -HS- | M] () -- C:\Windows\tasks\dmsv.job
[2011.12.27 23:52:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.27 23:52:27 | 2134,450,175 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.27 23:50:51 | 000,000,188 | ---- | M] () -- C:\Users\Christian\defogger_reenable
[2011.12.27 23:09:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.27 22:30:54 | 000,001,258 | ---- | M] () -- C:\Users\Christian\Desktop\Spybot - Search & Destroy.lnk
[2011.12.27 22:13:57 | 001,806,310 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.27 22:13:57 | 000,763,764 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.27 22:13:57 | 000,720,636 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.27 22:13:57 | 000,173,478 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.27 22:13:57 | 000,146,598 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.27 21:47:00 | 000,000,504 | ---- | M] () -- C:\Windows\tasks\At1.job
[2011.12.27 21:47:00 | 000,000,500 | ---- | M] () -- C:\Windows\tasks\At2.job
[2011.12.27 21:16:30 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.27 19:50:11 | 000,002,066 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.12.27 18:41:19 | 000,026,932 | ---- | M] () -- C:\Users\Christian\Documents\cc_20111227_184106_Sicherung 2.reg
[2011.12.27 18:40:52 | 000,286,194 | ---- | M] () -- C:\Users\Christian\Documents\cc_20111227_184018_Sicherung REG 27122011.reg
[2011.12.27 18:38:11 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.21 23:09:35 | 000,001,498 | ---- | M] () -- C:\Users\Christian\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.lnk
[2011.12.21 22:52:02 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.12.21 22:47:08 | 000,000,218 | ---- | M] () -- C:\Users\Christian\.recently-used.xbel
[2011.12.21 16:15:14 | 000,001,933 | ---- | M] () -- C:\Users\Public\Desktop\Rainlendar2.lnk
[2011.12.19 20:28:43 | 000,001,456 | ---- | M] () -- C:\Users\Christian\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2011.12.16 15:10:47 | 005,386,784 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2011.12.15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2011.12.15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2011.12.11 11:18:24 | 000,001,956 | ---- | M] () -- C:\Users\Christian\Desktop\Play Pirates of Black Cove.lnk
[2011.12.09 09:27:25 | 000,001,602 | ---- | M] () -- C:\Users\Public\Desktop\Trine 2.lnk
[2011.12.07 22:38:53 | 000,062,225 | ---- | M] () -- C:\Users\Christian\Documents\Personalfragebogen (2).rtf
[2011.12.07 08:53:25 | 000,000,034 | ---- | M] () -- C:\Windows\cdplayer.ini
[2011.12.06 23:00:11 | 000,000,973 | ---- | M] () -- C:\Users\Christian\Desktop\Astroart 5.0 demo.lnk
[2011.12.02 12:30:34 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.11.29 23:39:12 | 000,002,356 | ---- | M] () -- C:\Users\Public\Desktop\Canon MG6100 series Online-Handbuch.lnk
[5 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.27 23:50:51 | 000,000,188 | ---- | C] () -- C:\Users\Christian\defogger_reenable
[2011.12.27 22:30:54 | 000,001,258 | ---- | C] () -- C:\Users\Christian\Desktop\Spybot - Search & Destroy.lnk
[2011.12.27 21:46:21 | 000,000,500 | ---- | C] () -- C:\Windows\tasks\At2.job
[2011.12.27 21:46:07 | 000,000,504 | ---- | C] () -- C:\Windows\tasks\At1.job
[2011.12.27 21:16:30 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.27 19:50:11 | 000,002,066 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2011.12.27 18:41:17 | 000,026,932 | ---- | C] () -- C:\Users\Christian\Documents\cc_20111227_184106_Sicherung 2.reg
[2011.12.27 18:40:39 | 000,286,194 | ---- | C] () -- C:\Users\Christian\Documents\cc_20111227_184018_Sicherung REG 27122011.reg
[2011.12.27 18:38:11 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.21 23:09:42 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2011.12.21 23:09:35 | 000,001,498 | ---- | C] () -- C:\Users\Christian\Application Data\Microsoft\Internet Explorer\Quick Launch\Amazon.lnk
[2011.12.21 22:47:08 | 000,000,218 | ---- | C] () -- C:\Users\Christian\.recently-used.xbel
[2011.12.21 16:15:14 | 000,001,933 | ---- | C] () -- C:\Users\Public\Desktop\Rainlendar2.lnk
[2011.12.11 11:18:24 | 000,001,956 | ---- | C] () -- C:\Users\Christian\Desktop\Play Pirates of Black Cove.lnk
[2011.12.09 09:27:25 | 000,001,602 | ---- | C] () -- C:\Users\Public\Desktop\Trine 2.lnk
[2011.12.07 22:38:53 | 000,062,225 | ---- | C] () -- C:\Users\Christian\Documents\Personalfragebogen (2).rtf
[2011.12.06 23:00:11 | 000,000,973 | ---- | C] () -- C:\Users\Christian\Desktop\Astroart 5.0 demo.lnk
[2011.12.06 22:54:35 | 032,178,240 | ---- | C] () -- C:\Users\Christian\Desktop\M33-002L.fit
[2011.12.02 12:30:34 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.12.02 12:30:34 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.11.29 23:39:12 | 000,002,356 | ---- | C] () -- C:\Users\Public\Desktop\Canon MG6100 series Online-Handbuch.lnk
[2011.11.29 16:56:37 | 000,013,056 | ---- | C] () -- C:\Windows\SysWow64\CNC174AD.TBL
[2011.11.29 16:56:37 | 000,013,056 | ---- | C] () -- C:\Windows\SysNative\CNC174AD.TBL
[2011.11.23 22:03:47 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\uuddc32.dll
[2011.11.16 00:06:22 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2011.11.13 16:29:04 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2011.11.07 13:03:17 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll
[2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.04.19 09:46:42 | 000,007,764 | ---- | C] () -- C:\Windows\cadx2.ini
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.28 06:24:21 | 000,099,384 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\inst.exe
[2011.03.28 06:24:21 | 000,007,859 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\pcouffin.cat
[2011.03.28 06:24:21 | 000,001,167 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\pcouffin.inf
[2011.03.27 22:17:47 | 000,001,057 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\vso_ts_preview.xml
[2011.01.10 22:03:03 | 000,030,528 | ---- | C] () -- C:\Windows\GVTDrv64.sys
[2011.01.10 21:37:42 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2011.01.10 21:32:02 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini
[2010.12.30 13:44:44 | 000,035,900 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2010.11.19 21:08:43 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\D3DDCompiler_39.dll
[2010.11.19 21:08:39 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\D3DCompiiler_38.dll
[2010.11.03 00:28:42 | 000,000,268 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.11.03 00:28:41 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.11.01 21:50:24 | 001,073,152 | ---- | C] () -- C:\Windows\SysWow64\libmysql_c.dll
[2010.11.01 21:49:39 | 001,772,016 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.08.17 19:19:13 | 000,007,168 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2010.08.15 22:57:49 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe
[2010.08.15 20:37:13 | 000,260,074 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\mdbu.bin
[2010.08.09 08:37:30 | 000,000,132 | ---- | C] () -- C:\Users\Christian\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2010.07.24 13:19:02 | 000,001,456 | ---- | C] () -- C:\Users\Christian\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2010.07.23 20:21:42 | 000,000,128 | ---- | C] () -- C:\Windows\Cm108.ini.cfl
[2010.07.23 20:21:12 | 000,001,096 | R--- | C] () -- C:\Windows\cm108.ini
[2010.07.23 20:20:55 | 000,000,939 | R--- | C] () -- C:\Windows\Cm108.ini.cfg
[2010.07.21 22:33:52 | 000,000,431 | ---- | C] () -- C:\Windows\WISO.INI
[2010.07.20 22:51:04 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.07.20 06:43:56 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2010.07.20 06:43:56 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2010.06.15 00:20:08 | 000,001,872 | ---- | C] () -- C:\Program Files (x86)\README.HTM
[2009.08.27 08:04:14 | 000,207,400 | R--- | C] () -- C:\Windows\GSetup.exe
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:11:56 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\odbcad332.exe
[2009.07.14 01:10:36 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\phhotowiz.dll
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:56:32 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\eaappprxy.dll
[2009.07.14 00:53:28 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\iaasnap.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.14 00:25:06 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\kbdllk41a.dll
[2009.07.14 00:19:58 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\rellog.exe
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2008.11.13 05:07:24 | 000,002,177 | ---- | C] () -- C:\Windows\P17EP.ini
[2008.10.27 22:44:12 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll
[2007.04.27 10:43:58 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[1997.11.17 16:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll
 
========== LOP Check ==========
 
[2011.09.16 12:39:34 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\.minecraft
[2011.06.21 22:52:10 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Autodesk
[2011.12.27 18:39:50 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Azureus
[2011.11.15 14:41:06 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\BOM
[2011.11.10 15:14:26 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\BoulderDashXL
[2010.07.21 22:34:07 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Buhl Data Service
[2010.07.21 22:35:00 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Buhl Data Service GmbH
[2010.08.17 19:19:28 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Canneverbe Limited
[2011.12.05 11:52:59 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Canon
[2011.07.30 22:01:45 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.07.20 19:59:11 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\DAEMON Tools
[2011.12.27 18:39:52 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\DAEMON Tools Lite
[2011.12.21 23:09:35 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\DesktopIconForAmazon
[2011.03.14 07:04:02 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\DeviceVm
[2011.05.31 06:52:12 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\GetRightToGo
[2011.07.05 20:29:21 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\go
[2011.01.13 07:28:14 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ICQ
[2011.05.27 23:16:06 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Jeskola
[2011.10.27 12:35:40 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Kalypso Media
[2010.12.08 07:10:12 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\LucasArts
[2011.11.08 09:21:33 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\MAGIX
[2011.11.05 20:46:28 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\MAXON
[2011.10.20 22:36:56 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Might & Magic Heroes VI
[2010.08.05 22:46:04 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\MilkShape 3D 1.x.x
[2010.07.24 10:29:12 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\mresreg
[2011.09.08 16:04:40 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Origin
[2011.12.21 22:53:08 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\PanoramaStudio2
[2011.11.08 09:29:54 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\ProtectDisc
[2011.06.03 22:03:08 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Rovio
[2011.09.01 07:17:40 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\runic games
[2011.07.25 22:29:43 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Splashtop
[2011.07.03 20:41:32 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Stellarium
[2010.09.24 20:35:19 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TeamViewer
[2011.12.09 13:41:32 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Trine2
[2011.12.27 18:39:50 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\TS3Client
[2011.11.27 18:39:20 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Ubisoft
[2011.12.23 00:10:18 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\uTorrent
[2011.11.17 12:29:15 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\Vso
[2011.01.27 23:45:56 | 000,000,000 | ---D | M] -- C:\Users\Christian\AppData\Roaming\xVideoServiceThief
[2011.12.27 21:47:00 | 000,000,504 | ---- | M] () -- C:\Windows\Tasks\At1.job
[2011.12.27 21:47:00 | 000,000,500 | ---- | M] () -- C:\Windows\Tasks\At2.job
[2011.12.27 23:52:55 | 000,000,324 | -HS- | M] () -- C:\Windows\Tasks\dmsv.job
[2011.11.01 16:57:32 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2008.02.07 10:42:10 | 073,648,762 | ---- | M] ()(C:\Users\Christian\[Sybase.PowerDesigner.11.???????-????].Sybase.PowerDesigner.11.zip) -- C:\Users\Christian\[Sybase.PowerDesigner.11.数据库建模工具-破解程序].Sybase.PowerDesigner.11.zip
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:C8B8CEBD

< End of report >
         
--- --- ---

--- --- ---

extra LOG

OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 27.12.2011 23:59:38 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Christian\Downloads
64bit- Enterprise Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 5,83 Gb Available Physical Memory | 73,06% Memory free
15,97 Gb Paging File | 13,39 Gb Available in Paging File | 83,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 297,99 Gb Total Space | 70,21 Gb Free Space | 23,56% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 13,37 Gb Free Space | 2,87% Space Free | Partition Type: NTFS
Drive I: | 298,08 Gb Total Space | 60,94 Gb Free Space | 20,45% Space Free | Partition Type: NTFS
Drive T: | 931,51 Gb Total Space | 246,06 Gb Free Space | 26,41% Space Free | Partition Type: NTFS
Drive Z: | 931,51 Gb Total Space | 57,51 Gb Free Space | 6,17% Space Free | Partition Type: NTFS
 
Computer Name: CHRISTIAN-PC | User Name: Christian | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\Müller Foto\Müller Foto\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Müller Foto] -- "C:\Program Files (x86)\Müller Foto\Müller Foto\Müller Foto.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [CEWE FOTOSCHAU] -- "C:\Program Files (x86)\Müller Foto\Müller Foto\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Müller Foto] -- "C:\Program Files (x86)\Müller Foto\Müller Foto\Müller Foto.exe" "%1" ()
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1 -- [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1 -- [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1 -- [2010.09.03 21:22:12 | 000,000,000 | ---D | M]
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\FlashFXP\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (OpenSight Software, LLC)
"C:\Program Files (x86)\FlashFXP\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (OpenSight Software, LLC)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\FlashFXP\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (OpenSight Software, LLC)
"C:\Program Files (x86)\FlashFXP\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (IniCom Networks, Inc.)
"C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe" = C:\Program Files (x86)\FlashFXP 4\FlashFXP.exe:*:Enabled:FlashFXP v3 -- (OpenSight Software, LLC)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{09782D89-1CA6-4B7D-82C5-2DE01AF5601B}" = Microsoft SQL Server 2008 Common Files
"{0ADF605D-2D94-4467-91F7-D75C71CF328D}" = Microsoft SQL Server 2008 Database Engine Shared
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG6100_series" = Canon MG6100 series MP Drivers
"{11EB3D68-A5BE-43EA-8D31-43B08ADB0DA4}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de
"{197B3774-B7E6-4D50-AD0D-7F99B1E264D2}" = Microsoft SQL Server System CLR Types (x64)
"{1CB6C387-65A7-327F-B4A5-7DDC75A291AF}" = Microsoft Visual Studio 2010 Office Developer Tools (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{28D06854-572C-4A65-83E5-F8CAF26B9FDC}" = Microsoft SQL Server VSS Writer
"{2DF4C5DD-7417-301D-935D-939D3B7B5997}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{440668AA-7524-40DB-966A-60BE535E1B3F}" = Microsoft SQL Server 2008 Database Engine Services
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{47BA3A3A-6B4E-307F-A43B-724079FE90C6}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{53952792-BF16-300E-ADF2-E7E4367E00CF}" = Visual Studio 2010 Prerequisites - English
"{5783F2D7-9004-0407-0102-0060B0CE6BBA}" = AutoCAD Architecture 2011 - Deutsch
"{5783F2D7-9004-0407-1102-0060B0CE6BBA}" = AutoCAD Architecture 2011 Language Pack - Deutsch
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6AF73222-EE90-434C-AE7E-B96F70A68D89}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup 
"{6CC95B76-D380-46B2-9022-9353938E48BA}" = Logitech GamePanel Software 3.03.133
"{7AC5FFA7-6815-4AED-B16D-8E0D7CC4B221}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64) de
"{7ACE202B-1B01-4B43-B6AE-03D66D621CDE}" = Microsoft SQL Server 2008 RsFx Driver
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8325FD0C-2FDB-46C3-921A-3A78385EA972}" = Microsoft SQL Server 2008 Native Client
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8476A22A-405F-3DCB-96CA-D98C6418C89B}" = Microsoft Visual Studio 2010 Performance Collection Tools - DEU
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8583E7E3-2237-4981-B957-E28E5E9AB678}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{8E134313-BC88-41EF-9B55-C729EC2C05A6}" = MySQL Server 5.1
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8F473675-D702-45F9-8EBC-342B40C17BF5}" = Apple Mobile Device Support
"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUS_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-1000-0000000FF1CE}_Office14.PROPLUS_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-1000-0000000FF1CE}_Office14.PROPLUS_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010
"{90140000-0043-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-1000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9545E9DB-6F4C-4404-BF25-E221BE8B44C5}" = iTunes
"{95A2AD24-BD44-3E39-A31F-CE928276577E}" = Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A1F50E06-E514-393D-AAEB-2F989F0B7C68}" = Microsoft Team Foundation Server 2010 Object Model - DEU
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 285.62
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{C3EAE456-7E7A-451F-80EF-F34C7A13C558}" = Microsoft SQL Server Compact 3.5 SP2 x64 DEU
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{E1C1D175-C23E-38F4-9AC1-ABE5167022CF}" = Microsoft Visual Studio 2010 IntelliTrace Collection (x64)
"{E802A021-0F24-3484-97F7-D74D74CB93A0}" = Microsoft Visual Studio 2010 Office Developer Tools (x64) Language Pack - DEU
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{EF9A1373-9238-4E11-8FF8-7B83996F5BE5}" = Microsoft Sync Framework Services v1.0 SP1 (x64) de
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"AutoCAD Architecture 2011 - Deutsch" = AutoCAD Architecture 2011 - Deutsch
"CCleaner" = CCleaner
"CPUID ROG CPU-Z_is1" = CPUID ROG CPU-Z 1.58
"DesktopIconAmazon" = Desktop Icon für Amazon
"MAXON8C02D5E0" = CINEMA 4D 12.016
"MAXON8C66D661" = NET Render Client 13.016
"MAXONB6EC381C" = CINEMA 4D 11.514
"MAXONF02E79F8" = NET Render Client 11.514
"MAXONFB05E576" = CINEMA 4D 13.016
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Team Foundation Server 2010 Object Model - DEU" = Microsoft Team Foundation Server 2010-Objektmodell - DEU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{08DA8E46-ED67-451A-9246-50E0FF6959C9}" = Microsoft Sync Framework SDK v1.0 SP1 de
"{0B7C79A5-5CB2-4ABD-A9C1-92A6213CE8DD}_is1" = MSI Kombustor 2.0.0
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0E197778-07D7-4896-B0B4-DD6141A656FA}" = Samsung PC Studio PC Sync
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{129FC9F8-206B-4C29-9B45-8D53B10EC6C7}" = xVideoServiceThief
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1F121516-E175-4E0B-AC4D-42DD5164E396}_is1" = Need for Speed: The Run
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{31C3C6EA-E991-405F-A3AA-2C070CCCC47C}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU
"{3B35725F-C623-4A1E-B5CC-99C0868679E3}" = Smart 6 B10.1023.1
"{3DECD372-76A1-4483-BF10-B547790A3261}" = ON_OFF Charge B10.0427.1
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{4135C790-0387-36D7-9C2A-1B09A5900460}" = Microsoft Visual Studio 2010 Ultimate - DEU
"{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}" = Dotfuscator Software Services - Community Edition
"{434D0831-3E0C-4D03-A5D4-5E1000008400}" = F1 2010
"{457D7505-D665-4F95-91C3-ECB8C56E9ACA}" = Easy Tune 6 B10.1024.1
"{48561B98-C7F7-4AE2-A06B-84D2187ADA93}_is1" = Battlefield 3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4F64A46D-67F7-4497-AEA2-313D4305A5F6}" = Torchlight
"{5242B252-01BB-4F2E-BBF4-5C01BC3B6619}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{675F86A8-E093-4002-87D5-915CC2C45571}" = DES 2.0
"{681F4E9F-34E0-36BD-BF2C-100554E403A5}" = Microsoft Visual F# 2.0 Runtime Language Pack - DEU
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{745D37C2-26F4-4B65-BA13-F9840EBFA75B}" = Might & Magic Heroes VI
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7BEC151D-ADA9-3EA9-9273-99BA82881971}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8D20B4D7-3422-4099-9332-39F27E617A6F}" = Autodesk Design Review 2011
"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch
"{92C5C058-E941-47C3-B7E8-38A79C605969}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}" = FARO LS 1.1.406.58
"{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}" = FlashFXP v4.0
"{975951E7-14D0-49AF-A630-89680D12D7F6}" = Autodesk Material Library 2011 Medium Image library
"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C3B8582-A72A-4835-8903-877A834407BB}" = Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework
"{9C916142-C18C-429D-BFED-40094A7E0BEB}" = Die Siedler 7
"{9DEABCB6-B759-4D52-92F8-51B34A2B4D40}" = Autodesk Material Library 2011
"{9F5FD796-86F0-4360-85F8-D54C0F5411EB}" = Steuer-Spar-Erklärung 2011
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = DivX H.264 Decoder Beta 3
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B82157D3-6D31-4650-93B4-FC39BB08D6CE}" = AAVUpdateManager
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C05DB3EA-72D9-4EF0-9D19-B0864AF582A5}" = WISO Haushaltsbuch 2009
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C75FAD21-EC08-42F3-92D6-C9C0AB355345}" = AutoGreen B10.1021.1
"{C79312BD-3E76-4474-A10C-1435D1856A4B}" = Adobe Dreamweaver CS5
"{CD1E078C-A6B9-47DA-B035-6365C85C7832}" = Autodesk Material Library 2011 Base Image library
"{CE9BAD6E-60FC-46CC-82A2-5B0F2B1A0E36}" = Dotfuscator Software Services - Community Edition - DEU
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.9 Game
"{D7B3493D-766C-40AA-9AA9-053B896D76DE}" = Angry Birds Rio
"{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}" = Steuer-Spar-Erklärung 2010
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.1.19.365
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DF1C6F727B034910BEC7B16715E08F94}" = DivX H.264 Player Plugin
"{DF6FE172-006A-4324-AF7F-ACFE4BA290FE}" = AAVUpdateManager
"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU
"{EC66418E-DAA2-36D5-809E-40BEC94E622A}" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"{ECCA8FE7-767A-4C8A-9DAA-BAB60F877C41}" = Sins of a Solar Empire
"{ECE3188A-3B11-4332-B1B9-43FAA9A02626}" = TheSkyX First Light Edition
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"ABC Amber DBX Converter" = ABC Amber DBX Converter
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced CSV Converter" = Advanced CSV Converter 2.65
"Afterburner" = MSI Afterburner 2.1.0
"ALchemy" = Creative ALchemy
"Astroart demo_is1" = Astroart 5.0 demo
"AudioCS" = Creative Audio-Systemsteuerung
"Audiograbber" = Audiograbber 1.83 SE 
"Audiograbber-Lame" = Audiograbber MP3-Plugin
"Autodesk Design Review 2011" = Autodesk Design Review 2011
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 7
"BayGenie eBay Auction Sniper Pro Edition_is1" = BayGenie eBay Auction Sniper Pro Edition 3.3.6.0
"Biet-O-Matic v2.14.8" = Biet-O-Matic v2.14.8
"Boulder Dash-XL_is1" = Boulder Dash-XL
"Call of Duty Black Ops_is1" = Call of Duty Black Ops
"Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data
"Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data
"Canon MG6100 series Benutzerregistrierung" = Canon MG6100 series Benutzerregistrierung
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"Catan - Staedte und Ritter" = Catan - Städte und Ritter
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cities XL 2012" = Cities XL 2012
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"Diablo II" = Diablo II
"DivX Setup.divx.com" = DivX-Setup
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-PhotoPrint Pro" = Canon Easy-PhotoPrint Pro
"E-Mail Converter_is1" = E-Mail Converter
"FeWo24" = FeWo24 2.3.3 
"FIFA 12 (c) EA_is1" = FIFA 12 (c) EA version 1
"FKC22153088_is1" = fotokasten comfort
"Fraps" = Fraps (remove only)
"Generic USB 108 Sound" = USB PnP Sound Device
"GFWL_{434D0831-3E0C-4D03-A5D4-5E1000008400}" = F1 2010
"Google Chrome" = Google Chrome
"InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}" = Easy Tune 6 B10.1024.1
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{C75FAD21-EC08-42F3-92D6-C9C0AB355345}" = AutoGreen B10.1021.1
"LiveVDO plugin" = LiveVDO plugin 1.3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"Microsoft Visual Studio 2010 Ultimate - DEU" = Microsoft Visual Studio 2010 Ultimate - DEU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Studio Macro Tools - DEU Language Pack" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"MilkShape 3D 1.8.4" = MilkShape 3D 1.8.4
"Minecraft (Beta v1.2_01) Beta v1.2_01" = Minecraft (Beta v1.2_01)
"Minecraft (Beta v1.3) Beta v1.3" = Minecraft (Beta v1.3)
"Minecraft Beta Cracked" = Minecraft Beta Cracked
"Mozilla Firefox 8.0.1 (x86 de)" = Mozilla Firefox 8.0.1 (x86 de)
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"Müller Foto" = Müller Foto
"MySSID_is1" = EXPERTool 7.20
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Origin" = Origin
"PFPortChecker" = PFPortChecker 1.0.39
"PiratesOfBlackCove_is1" = Pirates of Black Cove
"PokerStars.net" = PokerStars.net
"PremiumSoft Navicat 8.0 for MySQL_is1" = PremiumSoft Navicat 8.0 for MySQL
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Quittungsdrucker" = Quittungsdrucker 4.4.4 
"Rage_is1" = Rage
"Rainlendar2" = Rainlendar2 (remove only)
"SAMSUNG CDMA Modem" = SAMSUNG CDMA Modem Driver Set
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Sins of a Solar Empire" = Sins of a Solar Empire
"Sins of a Solar Empire Trinity_is1" = Sins of a Solar Empire Trinity
"Stellarium_is1" = Stellarium 0.11.0
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Trine 2_is1" = Trine 2
"Unimap_is1" = Unimap 0.0.3 pre-alpha
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.1.7
"WaveStudio 7" = Creative WaveStudio 7
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"Buzz x64_is1" = Buzz x64 build 1384
"Protect Disc License Helper" = Protect Disc License Helper 1.0.125 (IE)
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         
--- --- ---


Eine Hilfe wäre echt schön...

Gruß Christian
__________________


Geändert von Acidfood (28.12.2011 um 00:12 Uhr)

Alt 28.12.2011, 05:54   #3
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Zitat:
Malewarebyte und SpyBootSD habe ich durchlauffen lassen auch den cccleaner aber das Problem besteht immer noch.
Die Logs bitte alle nachreichen, v.a. die von Malwarebytes
__________________
__________________

Alt 28.12.2011, 09:40   #4
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Hier der letzte Log von Malewarebyte mit dem wahrscheinlichen Fehler der auch nach restart und Trennung vom Netzwerk nicht gelöscht werden konnte.

Zitat:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122704

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.12.2011 09:24:13
mbam-log-2011-12-28 (09-24-13).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 212984
Laufzeit: 3 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Backdoor.Agent) -> Value: Shell -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Vielen dank das sich jemand meinem Problem zuwendet.

Alt 28.12.2011, 16:56   #5
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 28.12.2011, 20:49   #6
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Habe jetzt den ganzen Tag mein System Prüfen lassen.

Malwarebyts voll scan auf allen Laufwerken durchlaufen lassen keine funde mehr.

Zur Zeit läuft noch eset Online Scanner zur Zeit 14 Funde wenn fertig poste ich das Log.

zwischendurch aber noch den log von MBR

Zitat:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Enterprise Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: Gigabyte Technology Co., Ltd.
BIOS Manufacturer: Award Software International, Inc.
System Manufacturer: Gigabyte Technology Co., Ltd.
System Product Name: P67A-UD3
Logical Drives Mask: 0x02080dfc

Kernel Drivers (total 168):
0x03661000 \SystemRoot\system32\ntoskrnl.exe
0x03618000 \SystemRoot\system32\hal.dll
0x00BB4000 \SystemRoot\system32\kdcom.dll
0x00C80000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00CC4000 \SystemRoot\system32\PSHED.dll
0x00CD8000 \SystemRoot\system32\CLFS.SYS
0x00D36000 \SystemRoot\system32\CI.dll
0x00EFC000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00FA0000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00E00000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00E57000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00E60000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00E6A000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00E77000 \SystemRoot\system32\DRIVERS\pci.sys
0x00EAA000 \SystemRoot\System32\drivers\partmgr.sys
0x00EBF000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00EC8000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00ED4000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00C00000 \SystemRoot\System32\drivers\volmgrx.sys
0x00EE9000 \SystemRoot\system32\DRIVERS\intelide.sys
0x00FAF000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x00FBF000 \SystemRoot\system32\DRIVERS\pciide.sys
0x00FC6000 \SystemRoot\System32\drivers\mountmgr.sys
0x00FE0000 \SystemRoot\system32\DRIVERS\atapi.sys
0x01004000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x0102E000 \SystemRoot\system32\drivers\amdxata.sys
0x01039000 \SystemRoot\system32\drivers\fltmgr.sys
0x01085000 \SystemRoot\system32\drivers\fileinfo.sys
0x01202000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01099000 \SystemRoot\System32\Drivers\msrpc.sys
0x013A4000 \SystemRoot\System32\Drivers\ksecdd.sys
0x010F7000 \SystemRoot\System32\Drivers\cng.sys
0x013BE000 \SystemRoot\System32\drivers\pcw.sys
0x013CF000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x0141B000 \SystemRoot\system32\drivers\ndis.sys
0x0150D000 \SystemRoot\system32\drivers\NETIO.SYS
0x0156D000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01602000 \SystemRoot\System32\drivers\tcpip.sys
0x01598000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x015E2000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x0116A000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x015F2000 \SystemRoot\System32\Drivers\spldr.sys
0x011B6000 \SystemRoot\System32\drivers\rdyboost.sys
0x01400000 \SystemRoot\System32\Drivers\mup.sys
0x01412000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01833000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0186D000 \SystemRoot\system32\DRIVERS\disk.sys
0x01883000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x018E9000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x01913000 \SystemRoot\System32\Drivers\Null.SYS
0x0191C000 \SystemRoot\System32\Drivers\Beep.SYS
0x01923000 \SystemRoot\System32\drivers\vga.sys
0x01931000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x01956000 \SystemRoot\System32\drivers\watchdog.sys
0x01966000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x0196F000 \SystemRoot\system32\drivers\rdpencdd.sys
0x01978000 \SystemRoot\system32\drivers\rdprefmp.sys
0x01981000 \SystemRoot\System32\Drivers\Msfs.SYS
0x0198C000 \SystemRoot\System32\Drivers\Npfs.SYS
0x0199D000 \SystemRoot\system32\DRIVERS\tdx.sys
0x019BB000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x02C02000 \SystemRoot\system32\drivers\afd.sys
0x02C8B000 \SystemRoot\System32\DRIVERS\netbt.sys
0x02CD0000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x02CD9000 \SystemRoot\system32\DRIVERS\pacer.sys
0x02CFF000 \SystemRoot\system32\DRIVERS\netbios.sys
0x02D0E000 \SystemRoot\system32\DRIVERS\serial.sys
0x02D2B000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x02D46000 \SystemRoot\system32\DRIVERS\termdd.sys
0x02D5A000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02DAB000 \SystemRoot\system32\drivers\nsiproxy.sys
0x02DB7000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x02DC2000 \SystemRoot\System32\drivers\discache.sys
0x03E36000 \SystemRoot\system32\drivers\csc.sys
0x03EB9000 \SystemRoot\System32\Drivers\dfsc.sys
0x03ED7000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x03EE8000 \SystemRoot\system32\DRIVERS\avkmgr.sys
0x03EF2000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x03F18000 \SystemRoot\system32\DRIVERS\AppleCharger.sys
0x03F20000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x03F46000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x0FE08000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x10A7F000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x10A81000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x10B75000 \SystemRoot\System32\drivers\dxgmms1.sys
0x10BBB000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x10BDF000 \SystemRoot\system32\DRIVERS\HECIx64.sys
0x03F5C000 \SystemRoot\system32\drivers\usbehci.sys
0x03F6D000 \SystemRoot\system32\drivers\USBPORT.SYS
0x03FC3000 \SystemRoot\system32\DRIVERS\nusb3xhc.sys
0x10BF0000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x04049000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x040A0000 \SystemRoot\system32\DRIVERS\fdc.sys
0x040AD000 \SystemRoot\system32\DRIVERS\serenum.sys
0x040B9000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x040C6000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x040D6000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x040EC000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04110000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x0411C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x0414B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x04166000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04187000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x041A1000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x041AC000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x041BB000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x041CA000 \SystemRoot\system32\DRIVERS\swenum.sys
0x04000000 \SystemRoot\system32\DRIVERS\ks.sys
0x041CC000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04490000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x044EA000 \SystemRoot\system32\DRIVERS\nusb3hub.sys
0x04502000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x04517000 \SystemRoot\system32\drivers\nvhda64v.sys
0x04544000 \SystemRoot\system32\drivers\portcls.sys
0x04581000 \SystemRoot\system32\drivers\drmk.sys
0x045A3000 \SystemRoot\system32\drivers\ksthunk.sys
0x050ED000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x05349000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x05366000 \SystemRoot\system32\DRIVERS\usbscan.sys
0x05377000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x05383000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x0563E000 \SystemRoot\system32\drivers\CM10864.sys
0x05600000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x0560E000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x05627000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x05630000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x0539E000 \SystemRoot\System32\Drivers\crashdmp.sys
0x057F3000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x053AC000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x053B5000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x053C8000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x00080000 \SystemRoot\System32\win32k.sys
0x053D6000 \SystemRoot\System32\drivers\Dxapi.sys
0x053E2000 \SystemRoot\system32\DRIVERS\monitor.sys
0x005B0000 \SystemRoot\System32\TSDDD.dll
0x00730000 \SystemRoot\System32\cdd.dll
0x00820000 \SystemRoot\System32\ATMFD.DLL
0x05000000 \SystemRoot\system32\drivers\luafv.sys
0x05023000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x05043000 \SystemRoot\system32\drivers\WudfPf.sys
0x05064000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x05079000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x0541A000 \SystemRoot\system32\drivers\HTTP.sys
0x054E2000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x0550F000 \SystemRoot\system32\DRIVERS\bowser.sys
0x0552D000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x0555A000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x055A8000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x04400000 \SystemRoot\System32\DRIVERS\srv2.sys
0x05864000 \SystemRoot\System32\DRIVERS\srv.sys
0x058F9000 \??\C:\Windows\system32\drivers\acedrv11.sys
0x05953000 \SystemRoot\system32\DRIVERS\atksgt.sys
0x059A2000 \??\C:\Windows\system32\drivers\cpuz135_x64.sys
0x059AB000 \SystemRoot\system32\DRIVERS\lirsgt.sys
0x06CCF000 \SystemRoot\system32\drivers\peauth.sys
0x06D75000 \SystemRoot\System32\Drivers\secdrv.SYS
0x06D80000 \SystemRoot\System32\drivers\tcpipreg.sys
0x06D92000 \??\C:\Windows\gdrv.sys
0x06D9B000 \??\C:\Program Files (x86)\MSI Afterburner\RTCore64.sys
0x06DA1000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x06DD2000 \??\C:\Windows\GVTDrv64.sys
0x06DDC000 \??\C:\Windows\SysWOW64\drivers\TBPANELX64.SYS
0x06DE4000 \??\C:\Windows\system32\drivers\mbam.sys
0x06C71000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x77990000 \Windows\System32\ntdll.dll
0x47AE0000 \Windows\System32\smss.exe
0xFFCB0000 \Windows\System32\apisetschema.dll
0xFF460000 \Windows\System32\autochk.exe

Processes (total 86):
0 System Idle Process
4 System
264 C:\Windows\System32\smss.exe
428 csrss.exe
488 csrss.exe
496 C:\Windows\System32\wininit.exe
536 C:\Windows\System32\winlogon.exe
628 C:\Windows\System32\services.exe
636 C:\Windows\System32\lsass.exe
644 C:\Windows\System32\lsm.exe
768 C:\Windows\System32\svchost.exe
840 C:\Windows\System32\nvvsvc.exe
864 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
916 C:\Windows\System32\svchost.exe
1020 C:\Windows\System32\svchost.exe
376 C:\Windows\System32\svchost.exe
424 C:\Windows\System32\svchost.exe
1000 C:\Windows\System32\audiodg.exe
1052 C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
1116 C:\Windows\System32\svchost.exe
1208 C:\Windows\System32\svchost.exe
1336 C:\Windows\System32\taskeng.exe
1396 C:\Windows\System32\spoolsv.exe
1404 C:\Windows\System32\rundll32.exe
1432 C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
1560 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
1576 C:\Windows\System32\nvvsvc.exe
1904 C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2028 C:\Windows\System32\taskhost.exe
1144 C:\Windows\System32\taskeng.exe
1492 C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
1508 C:\Windows\System32\dwm.exe
1804 C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
1836 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1868 C:\Windows\explorer.exe
1892 C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe
1956 C:\Windows\System32\svchost.exe
2056 C:\Windows\System32\svchost.exe
2088 C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
2140 C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
2336 C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
2400 C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
2428 C:\Windows\System32\conhost.exe
2436 C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
2492 C:\Program Files (x86)\GIGABYTE\smart6\timelock\TimeMgmtDaemon.exe
2512 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2576 C:\Windows\System32\svchost.exe
2632 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
2856 C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
2968 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
2672 C:\Windows\System32\SearchIndexer.exe
3084 WUDFHost.exe
3208 C:\Program Files\GIGABYTE\SMART6\Recovery\RPMDaemon.exe
3484 C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
3592 C:\Windows\SysWOW64\rundll32.exe
3632 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
3700 C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
3772 C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
3912 C:\Program Files (x86)\Vtune\TBPANEL.exe
3952 C:\Program Files (x86)\GIGABYTE\smart6\timelock\AlarmClock.exe
3960 C:\Program Files (x86)\Skype\Phone\Skype.exe
4064 C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
2736 C:\Windows\SysWOW64\rundll32.exe
1796 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2160 C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
4048 C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
3176 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
1300 C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
212 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
3780 C:\Windows\System32\svchost.exe
4104 C:\Program Files\Windows Media Player\wmpnetwk.exe
4352 C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
556 C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
2924 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
4164 C:\Windows\System32\wuauclt.exe
1612 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
1140 C:\Windows\explorer.exe
3028 C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
3004 C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
2788 C:\Windows\System32\conhost.exe
4236 C:\Windows\System32\SearchProtocolHost.exe
1800 C:\Windows\System32\SearchFilterHost.exe
3000 C:\Windows\System32\dllhost.exe
4424 C:\Users\Christian\Desktop\MBRCheck.exe
4792 C:\Windows\System32\conhost.exe
3092 <unknown>

\\.\C: --> \\.\PhysicalDrive3 at offset 0x00000000`06500000 (NTFS)
\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\I: --> \\.\PhysicalDrive4 at offset 0x00000000`00007e00 (NTFS)
\\.\T: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)
\\.\Z: --> \\.\PhysicalDrive2 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive3 Model Number: SAMSUNGHD321KJ, Rev: CP100-12
PhysicalDrive1 Model Number: ST3500830AS, Rev: 3.AAD
PhysicalDrive4 Model Number: SAMSUNGHD321KJ, Rev: CP100-12
PhysicalDrive0 Model Number: ST31000528AS, Rev: CC44
PhysicalDrive2 Model Number: ST31000340AS, Rev: SD15

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive3 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
465 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
298 GB \\.\PhysicalDrive4 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11
931 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
931 GB \\.\PhysicalDrive2 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!
Ich hoffe das hilft auch ein wenig weiter zum beheben...

Beim suchen eben über eset hat Antivir angeschlagen und sinowal.axnam gefunden, habe eben dazu ein wenig nachgeschlagen und deswegen auch MBR Log hier eingestellt. Ich hoffe ich komme um eine Neuinstallation herum.

Gruß Christian

Alt 28.12.2011, 23:12   #7
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Zitat:
Malwarebyts voll scan auf allen Laufwerken durchlaufen lassen keine funde mehr.
Du liest meine Postings aber schon richtig?
Wenn ja, wäre dir nicht entgangen, dass es mir nicht darum geht, dass "jetzt keine Funde" mehr da sind, sondern ich will wissen was insgesamt und auch in der Vergangenheit schon gefunden wurde. Deswegen einfach mal bitte alle Logs posten.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 28.12.2011, 23:38   #8
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Ja habe ich schon gelesen und wird nachgereicht.

eset läuft jetzt schon gut 5h 48 min mit 37 Funden und ist bei Laufwerk I angekommen, fehlen nur noch die 2 mit 1k gb keine Ahnung ob es überhaupt sinvoll ist das weiter laufen zu lassen, vielleicht kurz Antworten ob es notwendig ist es durchlaufen zu lassen.

Malwarebytes hat sich aktualisiert ich komme jetzt an die gesammten logs nicht ran. Wenn ich es jetzt starte bekomme ich einen Laufzeitfehler 453 DLL - Einsprungpunkt LanguagesetPath in mbam nicht gefunden.

Das Programm hat ja auch einen Neustart gefordert den ich aber wegen laufenden eset Verweigert habe.

Gruß Christian

So eset nach 6 h abgebrochen, Rechner neu gestartet,

Malewarebytes Logs

Log 1

Zitat:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122704

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

27.12.2011 21:23:30
mbam-log-2011-12-27 (21-23-30).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 213507
Laufzeit: 4 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 15
Infizierte Registrierungswerte: 5
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3

Infizierte Speicherprozesse:
c:\Windows\kmservice.exe (RiskWare.Tool.CK) -> 2312 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\4ECYTQ9SIC (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\W1WIWQ1NPG (Trojan.FakeAlert.SA) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Value: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Value: {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Backdoor.Agent) -> Value: Shell -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool (Trojan.Agent.WIMP) -> Value: NvCplDaemonTool -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemonTool (Trojan.Agent.WIMP) -> Value: NvCplDaemonTool -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\program files (x86)\startsearch plugin\ssbarlcher.dll (PUP.VShareRedir) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.
Log 2

Zitat:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122704

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

27.12.2011 22:05:19
mbam-log-2011-12-27 (22-05-19).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 213466
Laufzeit: 5 Minute(n), 0 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Backdoor.Agent) -> Value: Shell -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Log 3

Zitat:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122704

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.12.2011 09:24:13
mbam-log-2011-12-28 (09-24-13).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 212984
Laufzeit: 3 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Backdoor.Agent) -> Value: Shell -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Log 4 voller scan Laufwerk C Boot Partition

Zitat:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122704

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.12.2011 12:14:14
mbam-log-2011-12-28 (12-14-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 741121
Laufzeit: 2 Stunde(n), 27 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Log 5 Voller scan restliche Laufwerke

Zitat:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 911122704

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.12.2011 16:59:33
mbam-log-2011-12-28 (16-59-33).txt

Art des Suchlaufs: Vollständiger Suchlauf (E:\|I:\|T:\|Z:\|)
Durchsuchte Objekte: 1261653
Laufzeit: 4 Stunde(n), 32 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0121265.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0121304.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0127024.exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0127025.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0127493.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0128298.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
Protection Logs 1

Zitat:
21:17:32 Christian MESSAGE Protection started successfully
21:17:35 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
21:56:53 Christian MESSAGE Protection started successfully
21:56:56 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
22:10:26 Christian MESSAGE Protection started successfully
22:10:29 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
23:55:54 Christian MESSAGE Protection started successfully
23:55:57 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
protection Log 2

Zitat:
09:01:58 Christian MESSAGE Protection started successfully
09:02:01 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
09:33:15 Christian MESSAGE Protection started successfully
09:33:19 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
12:20:54 Christian MESSAGE Protection started successfully
12:20:57 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
17:18:14 Christian MESSAGE Protection started successfully
17:18:17 Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
20:06:30 Christian MESSAGE Database updated successfully
20:07:17 Christian MESSAGE Scheduled update executed successfully
2011/12/28 23:53:53 +0100 CHRISTIAN-PC Christian MESSAGE Starting protection
2011/12/28 23:53:55 +0100 CHRISTIAN-PC Christian MESSAGE Protection started successfully
2011/12/28 23:53:58 +0100 CHRISTIAN-PC Christian MESSAGE Starting IP protection
2011/12/28 23:53:58 +0100 CHRISTIAN-PC Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
2011/12/28 23:54:06 +0100 CHRISTIAN-PC Christian MESSAGE Starting IP protection
2011/12/28 23:54:06 +0100 CHRISTIAN-PC Christian ERROR IP protection failed: FwpmEngineOpen0 failed with error code 1753
Hoffe das hilft weiter.

Geändert von Acidfood (29.12.2011 um 00:02 Uhr)

Alt 29.12.2011, 00:06   #9
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Und zu guter letzt das Logfile von Eset solange wie es halt lief.

Zitat:
C:\Users\Christian\AppData\Local\4f0a8a5c\U\80000000.@ Win64/Sirefef.P trojan
C:\Users\Christian\AppData\Local\4f0a8a5c\U\800000cb.@ Win64/Sirefef.M trojan
C:\Users\Christian\AppData\Local\4f0a8a5c\U\800000cf.@ Win64/Sirefef.O trojan
C:\Users\Christian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\636b4be0-2f7b2bf4 a variant of Java/TrojanDownloader.OpenConnection.AQ trojan
C:\Users\Christian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\44c22af7-64460953 multiple threats
C:\Users\Christian\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\74141949-140c5110 Java/TrojanDownloader.OpenStream.NCM trojan
C:\Users\Christian\Downloads\SoftonicDownloader1723.exe a variant of Win32/SoftonicDownloader.A application
C:\Users\Christian\Downloads\SoftonicDownloader_for_autostitch.exe a variant of Win32/SoftonicDownloader.A application
C:\Users\Christian\Downloads\SoftonicDownloader_fuer_crawler-3d-tropical-aquarium-screensaver.exe a variant of Win32/SoftonicDownloader.A application
C:\Users\Christian\Downloads\vlc-1.1.7-win32.exe Win32/StartPage.OIE trojan
C:\Windows\System32\eaappprxy.dll Win32/BHO.ODS trojan
C:\Windows\System32\iaasnap.dll Win32/BHO.ODS trojan
C:\Windows\System32\kbdllk41a.dll a variant of Win32/BHO.ODP trojan
C:\Windows\System32\phhotowiz.dll a variant of Win32/BHO.ODP trojan
C:\Windows\SysWOW64\eaappprxy.dll Win32/BHO.ODS trojan
C:\Windows\SysWOW64\iaasnap.dll Win32/BHO.ODS trojan
C:\Windows\SysWOW64\kbdllk41a.dll a variant of Win32/BHO.ODP trojan
C:\Windows\SysWOW64\phhotowiz.dll a variant of Win32/BHO.ODP trojan
Danke für jede erdenkliche Hilfe.

Alt 29.12.2011, 00:33   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Zitat:
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0121304.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0127024.exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0127025.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0127493.exe (Trojan.Agent.CK) -> Quarantined and deleted successfully.
z:\system volume information\_restore{fb9c9541-fb60-4397-a044-96695fdb450f}\RP521\A0128298.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
Riskware und "Dont Steal our Software" sind handfeste Hinweise auf Crack/Keygen-Missbrauch!

Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 29.12.2011, 00:41   #11
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Kann sein Asche auf mein Haupt Laufwerk Z ist ein Reines Datenspeicherinstrument, möglich das mir mein Bruder dort mal was übergeschoben hat da dieses Volum auch transportabel ist und ich Ihn leider nicht freisprechen kann das eine oder andere Programm dort mal abgelegt zu haben.

Das Laufwerk war mal in seinem Rechner drin ist aber schon länger her.

Können wir trotzdem mein Problem versuchen sachlich zu lösen?

Gruß Christian

Alt 29.12.2011, 00:49   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Zitat:
Infizierte Speicherprozesse:
c:\Windows\kmservice.exe (RiskWare.Tool.CK) -> 2312 -> Unloaded process successfully.
Den gibt es ja auch noch. Gecrackte Office-Version ist installiert.

Zitat:
Kann sein Asche auf mein Haupt Laufwerk Z ist ein Reines Datenspeicherinstrument,
Zieht daher als Ausrede nicht mehr
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 29.12.2011, 00:55   #13
Acidfood
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Dann trotzdem vielen Dank.

Ich konnte mein System mit den vielen Systemscans von einigen Trojanern befreihen.

Das macht es nicht besser, aber geläutert bin ich schon. Schaden macht halt manchmal doch klug.

Gruß Christian

Alt 29.12.2011, 01:12   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Google Such Link leitet auf eine andere Seite um - Standard

Google Such Link leitet auf eine andere Seite um



Ja, lass bitte einfach die Finger von diesem illegalen Zeug. Nimm lieber kostenlose OpenSource-Alternativen.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Antwort

Themen zu Google Such Link leitet auf eine andere Seite um
adobe, antivir, avg, avira, bho, browser, cdburnerxp, desktop, explorer, firefox, google, helper, hängen, internet, internet explorer, logfile, mozilla, nvidia, nvidia update, problem, rundll, senden, software, studio, system, usb, usb 3.0, visual studio, windows



Ähnliche Themen: Google Such Link leitet auf eine andere Seite um


  1. Google leitet auf andere Seiten um....
    Log-Analyse und Auswertung - 25.04.2015 (13)
  2. www.google.de leitet auf andere Adresse um
    Plagegeister aller Art und deren Bekämpfung - 01.04.2015 (4)
  3. Google Chrome - öffnet eine andere Seite beim Starten von Google Chrome (Win7)
    Plagegeister aller Art und deren Bekämpfung - 19.01.2015 (29)
  4. Google leitet auf flasche Seite um!
    Log-Analyse und Auswertung - 06.10.2013 (1)
  5. Google leitet auf falsche Seite weiter
    Log-Analyse und Auswertung - 25.02.2013 (13)
  6. Google leitet mich immer auf andere Websites( manchmal sogar auf google selbst)
    Plagegeister aller Art und deren Bekämpfung - 29.03.2012 (21)
  7. Google leitet mich auf andere Seiten um wenn ich auf einen Link klicke
    Plagegeister aller Art und deren Bekämpfung - 21.07.2011 (35)
  8. google leitet mich auf 100ksearches Seite
    Plagegeister aller Art und deren Bekämpfung - 21.07.2011 (30)
  9. Google leitet Link um
    Log-Analyse und Auswertung - 09.06.2011 (26)
  10. Google Leitet dauert auf eine andere seite
    Log-Analyse und Auswertung - 15.05.2011 (10)
  11. Google leitet auf andere webseiten um
    Plagegeister aller Art und deren Bekämpfung - 02.05.2011 (43)
  12. Google leitet auf eine andere Seite um.
    Log-Analyse und Auswertung - 07.04.2011 (1)
  13. Google leitet auf andere Seiten um
    Log-Analyse und Auswertung - 05.04.2011 (1)
  14. Google leitet auf falsche Seite weiter
    Plagegeister aller Art und deren Bekämpfung - 03.03.2011 (8)
  15. Google leitet auf falsche Seite weiter
    Log-Analyse und Auswertung - 17.06.2009 (2)
  16. Google leitet auf ebay und andere Seiten um
    Log-Analyse und Auswertung - 07.05.2009 (1)
  17. Google leitet immer auf andere Seiten um !
    Log-Analyse und Auswertung - 13.04.2009 (23)

Zum Thema Google Such Link leitet auf eine andere Seite um - Hallo und Bitte um Hilfe, ich habe die Suchfunktion benutzt, aber noch keinen hilfreichen Beitrag zu meinem speziellen Thema gefunden. Eine Google Suche wird immer auf einen Präfix seite (hxxp://95p.com/...) - Google Such Link leitet auf eine andere Seite um...
Archiv
Du betrachtest: Google Such Link leitet auf eine andere Seite um auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.