Hallo ...,
auf meinem 64-Bit Windows7-PC erhielt ich die Meldung:
„Ihr Computer wurde durch das System der automatischen Informationskontrolle gesperrt. ... Bundespolizei Entsperren Sie mit Ukash ...“
Das gesamte System wurde blockiert.
Ich habe folgendes vorgenommen:
* Kaltstart im abgesicherten Modus mit Netzwerktreibern
* Programm “ Malwarebytes Anti-Malware ”, Vers. 1.61 aktuell heruntergeladen und installiert.
* Ausgewählt: „Quick-Scan“
* gefundene Viren:
* Backdoor.Agent.H
* Trojan.Agent.Gen
* Backdoor.Agent.H
* Backdoor.Agent.H
* Exploit.Drop2 (4 x angezeigt)
* Viren in Quarantäne verschoben
* PC herunter gefahren + Kaltstart
* PC im Normalmodus hochgefahren
* Wieder Systemblockade, wie oben beschrieben
* Kaltstart abgesicherter Modus
* Programm “ Malwarebytes Anti-Malware ”
+ Auswahl: „Vollständigen Suchlauf durchführen“
* Eine weitere infizierte Datei (GetUnique.dll) wurde gefunden (Malware.Packer.gen)
* Namensähnlichkeit mit Malware-Programm wurde nicht erkannt, deshalb:
* Virus gelöscht, auch in Quarantäne gelöscht
* Infizierte Datei war danach nicht mehr vorhanden.
* Gmer-Scan durchgeführt. Ergebnis „GMER hasn´t fournd any system modification:“

Kann ich nun einen Start im Normalmodus nochmal vornehmen oder ist noch etwas zu beachten ?
Vielen Dank schon vorab.
Maddin

Computer durch System der automatischen Informationskontrolle gesperrt
Hallo ...,
da ich keine Antwort erhielt hatte ich einen Normalstart von Windows7 versucht.
Die Systemblockade erfolgte wieder.

Hier die gewünschten Informationen/Dateien:
a) Defogger brachte keine Fehlermeldung

b) OTL.TXT hat folgenden Inhalt:OTL Logfile:

OTL logfile created on: 13.06.2012 17:46:09 - Run 1
OTL by OldTimer - Version 3.2.48.0     Folder = C:\Users\****\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,96 Gb Total Physical Memory | 3,36 Gb Available Physical Memory | 84,97% Memory free
7,92 Gb Paging File | 7,31 Gb Available in Paging File | 92,34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 458,50 Gb Total Space | 368,43 Gb Free Space | 80,36% Space Free | Partition Type: NTFS
Drive D: | 7,17 Gb Total Space | 0,92 Gb Free Space | 12,80% Space Free | Partition Type: NTFS
Drive F: | 1,86 Gb Total Space | 1,61 Gb Free Space | 86,89% Space Free | Partition Type: FAT
Drive K: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
Drive L: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
Drive P: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
Drive Q: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
 
Computer Name: PC01 | User Name: **** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.13 17:42:00 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2012.03.09 07:10:20 | 000,235,520 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010.09.22 11:05:24 | 000,165,032 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel(R) PROSet Monitoring Service) Intel(R)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009.01.28 11:54:04 | 002,790,400 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Auto | Stopped] -- C:\Windows\SysNative\hasplms.exe -- (hasplms)
SRV - [2012.05.06 14:33:25 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.03.30 01:09:18 | 000,071,024 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Haufe\iDesk\iDeskService\iDeskService.exe -- (HRService) Haufe iDesk-Service in C:\Program Files (x86)
SRV - [2011.12.09 03:20:00 | 000,079,872 | ---- | M] (DATEV eG) [Auto | Stopped] -- C:\DATEV\PROGRAMM\B0001442\PSNTServ.exe -- (DatevPrintService)
SRV - [2011.11.04 09:51:48 | 000,176,128 | ---- | M] (DATEV eG) [Auto | Stopped] -- C:\DATEV\PROGRAMM\B0000000\DFUEMNGR\DcManag.exe -- (Dcmanag)
SRV - [2011.09.26 12:16:00 | 000,260,424 | ---- | M] (HP) [Auto | Stopped] -- C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe -- (FPLService)
SRV - [2011.09.10 03:10:28 | 000,086,072 | ---- | M] (Hewlett-Packard Company) [Auto | Stopped] -- C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe -- (HP Support Assistant Service)
SRV - [2011.07.25 03:49:00 | 000,172,640 | ---- | M] (DATEV eG) [Auto | Stopped] -- C:\DATEV\PROGRAMM\Install\DvInesASDSvc.Exe -- (DATEV Update-Service)
SRV - [2011.06.28 10:18:54 | 002,409,056 | ---- | M] (DATEV eG) [Auto | Stopped] -- C:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe -- (DVckService)
SRV - [2011.06.22 17:32:56 | 001,430,024 | ---- | M] (G Data Software AG) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe -- (AVKProxy)
SRV - [2011.06.22 17:32:54 | 000,370,184 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe -- (GDScan)
SRV - [2011.06.22 17:20:24 | 001,740,792 | ---- | M] (G Data Software AG) [Auto | Stopped] -- C:\Program Files (x86)\G Data\AVKClient\AVKCl.exe -- (AntiVirusKit Client)
SRV - [2011.06.22 03:12:14 | 001,929,104 | ---- | M] (G Data Software AG) [Auto | Stopped] -- C:\Program Files (x86)\G Data\AVKClient\AVKWCtlX64.exe -- (AVKWCtl)
SRV - [2011.06.22 03:07:14 | 001,460,216 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- C:\Program Files (x86)\G Data\AVKClient\AVKBackupService.exe -- (GDBackupSvc)
SRV - [2011.05.09 15:52:04 | 000,271,456 | ---- | M] (Datev eG) [Auto | Stopped] -- C:\DATEV\PROGRAMM\B0000398\SiPaHostService.exe -- (Sicherheitspaket-Dienst)
SRV - [2011.03.29 03:07:50 | 000,094,264 | ---- | M] (Hewlett-Packard Company) [Auto | Stopped] -- C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2011.03.02 07:23:36 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 20:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011.02.24 10:10:24 | 000,212,944 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe -- (jhi_service) Intel(R)
SRV - [2011.01.17 18:42:04 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2011.01.17 18:42:02 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010.10.16 04:32:32 | 000,134,944 | ---- | M] (Nuance Communications, Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Nuance\PDF Professional 7\PDFProFiltSrv.exe -- (PDFProFiltSrv)
SRV - [2010.09.22 17:47:22 | 000,292,960 | ---- | M] (DATEV eG) [Auto | Stopped] -- C:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe -- (SCardService)
SRV - [2010.09.08 16:42:14 | 000,511,072 | ---- | M] (DATEV e.G.) [Auto | Stopped] -- C:\DATEV\PROGRAMM\B0001364\DtvScSer.exe -- (DATEV Logon Service)
SRV - [2010.08.25 08:54:06 | 000,194,144 | ---- | M] (KOBIL Systems GmbH) [Auto | Stopped] -- C:\DATEV\PROGRAMM\B0000404\msdisrv.exe -- (KOBIL_MSDI)
SRV - [2010.05.21 02:15:00 | 000,110,736 | R--- | M] (InterVideo) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2010.03.18 23:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.12 00:06:06 | 000,193,824 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.09 08:28:08 | 010,857,984 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.03.09 05:58:02 | 000,328,704 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.03 15:26:15 | 000,063,864 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd)
DRV:64bit: - [2012.01.03 15:26:10 | 000,110,456 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt)
DRV:64bit: - [2012.01.03 15:26:10 | 000,051,576 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre)
DRV:64bit: - [2012.01.03 15:26:10 | 000,050,040 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave)
DRV:64bit: - [2012.01.03 13:25:27 | 000,104,576 | ---- | M] (KOBIL Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\KOBCCID.sys -- (KOBCCID)
DRV:64bit: - [2012.01.03 13:25:27 | 000,025,344 | ---- | M] (KOBIL Systems GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KOBCCEX.sys -- (KOBCCEX)
DRV:64bit: - [2011.12.09 01:22:43 | 000,031,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pmxdrv.sys -- (pmxdrv)
DRV:64bit: - [2011.12.09 01:10:03 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.12.09 01:10:03 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.12.05 21:47:30 | 000,095,248 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2011.07.19 15:25:54 | 000,082,488 | ---- | M] (Datev eG) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\d3_kafm.sys -- (SC_SERV3D)
DRV:64bit: - [2010.12.21 11:31:00 | 000,316,080 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) Intel(R)
DRV:64bit: - [2010.11.29 07:23:16 | 012,252,192 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.06 10:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.10.20 03:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010.10.15 11:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010.08.14 00:16:52 | 000,065,808 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ifP52x64.sys -- (IFCoEVB)
DRV:64bit: - [2010.08.14 00:16:46 | 000,339,728 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ifM52x64.sys -- (IFCoEMP)
DRV:64bit: - [2010.02.27 01:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.02.03 04:10:26 | 000,318,464 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\hardlock.sys -- (Hardlock)
DRV:64bit: - [2009.01.08 11:55:04 | 000,129,280 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\aksfridge.sys -- (aksfridge)
DRV:64bit: - [2008.02.11 16:57:10 | 000,070,272 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/28
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/28
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMDTDF&pc=CMDTDF&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMDTDF
IE:64bit: - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMDTDF
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/28
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/28
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMDTDF&pc=CMDTDF&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMDTDF
IE - HKLM\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMDTDF
IE - HKLM\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://search.iminent.com/?appId=&ref=toolbox&q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/28
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [String data over 1000 bytes]
IE - HKCU\..\URLSearchHook: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=CMDTDF&pc=CMDTDF&src=IE-SearchBox
IE - HKCU\..\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}: "URL" = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMDTDF
IE - HKCU\..\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMDTDF
IE - HKCU\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://search.iminent.com/?appId=&ref=toolbox&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@datev.de/DATEV_BestellManager,version=1.7: C:\DATEV\PROGRAMM\A0000015\npdvbm.dll ( DATEV eG)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Professional 7\bin\nppdf.dll (Zeon Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.10 11:08:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.01.04 20:20:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Extensions
[2012.01.04 20:20:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Extensions\ideskbrowser@haufe.de
[2012.05.09 08:41:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\rd42lxr8.default\Extensions
[2012.04.22 14:30:29 | 000,000,000 | ---D | M] (IMinent Toolbar) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\rd42lxr8.default\Extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}
[2012.04.22 14:30:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.22 14:30:24 | 000,000,000 | ---D | M] (Iminent WebBooster) -- C:\Program Files (x86)\mozilla firefox\extensions\webbooster@iminent.com
[2012.01.08 11:37:20 | 000,000,000 | ---D | M] (TrueSuite Website Logon) -- C:\Program Files (x86)\mozilla firefox\extensions\websitelogon@truesuite.com
[2012.05.10 11:08:50 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.03.22 19:14:48 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.22 19:14:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.03.22 19:14:48 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.22 19:14:48 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.28 14:18:04 | 000,002,157 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchTheWeb.xml
[2012.03.22 19:14:48 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.22 19:14:48 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (DtvIePwdSafeBHO64 Class) - {557F4852-8868-44dd-B5E9-9890AC4B1FD5} - C:\DATEV\PROGRAMM\B0000397\DtvIePwdSafe64.dll (DATEV eG)
O2:64bit: - BHO: (no name) - {6EF6B546-25FB-455B-801F-FDB3B3D39F9E} - No CLSID value found.
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
O2:64bit: - BHO: (SCardBHOEvent Class) - {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} - C:\DATEV\SYSTEM\DVCCSASCardBHO64002.dll (DATEV eG)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (no name) - {557F4852-8868-44dd-B5E9-9890AC4B1FD5} - No CLSID value found.
O2 - BHO: (TBSB01620 Class) - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O2 - BHO: (DtvIePwdSafeBHO Class) - {6EF6B546-25FB-455B-801F-FDB3B3D39F9E} - C:\DATEV\PROGRAMM\B0000397\DtvIePwdSafe.dll (DATEV eG)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found.
O2 - BHO: (TrueSuite Website Log On) - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
O2 - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
O2 - BHO: (SCardBHOEvent Class) - {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} - C:\DATEV\SYSTEM\DVCCSASCardBHO002.dll (DATEV eG)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (IEHlprObj Class) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - c:\lotus\organize\iehelper.dll ()
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe (Hewlett-Packard)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AVK Client] C:\Program Files (x86)\G Data\AVKClient\AVKCl.exe (G Data Software AG)
O4 - HKLM..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files (x86)\Corel\Corel Graphics 12\Languages\DE\Programs\Registration.exe (Corel Corporation)
O4 - HKLM..\Run: [DATEV Update-Monitor] C:\DATEV\PROGRAMM\Install\DvInesASDMon.exe (DATEV eG)
O4 - HKLM..\Run: [DATEV_SCardMan] C:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG)
O4 - HKLM..\Run: [DVCCSAWTSSetEntryNTE] C:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG)
O4 - HKLM..\Run: [IMBooster] C:\Program Files (x86)\Iminent\IMBooster\imbooster.exe (Iminent)
O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Nuance PDF Converter Professional 7-reminder] C:\Program Files (x86)\Nuance\PDF Professional 7\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF7 Registry Controller] C:\Program Files (x86)\Nuance\PDF Professional 7\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Nuance\PDF Professional 7\pdfpro7hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SiPaHost] C:\DATEV\PROGRAMM\B0000398\SiPaHost.exe (DATEV eG)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [lntnqyanwdwgvwh] C:\ProgramData\lntnqyan.exe ()
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_235_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Datum Start PC01.lnk = P:\BAT\Datum_Start_Laptop.bat ()
O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\klickTel OEM Frühjahr 2010 - Schnellstarter.lnk = C:\Program Files (x86)\klickTel\klickTel OEM Frühjahr 2010\KSTART32.EXE (telegate MEDIA AG)
O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip6.exe (Lotus Development Corporation)
O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TK-Suite Client.lnk = C:\Program Files (x86)\AGFEO\Tk-Suite\tools\ctimon.exe (AGFEO      )
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8:64bit: - Extra context menu item: Inhalt der ausgewählten Links an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8:64bit: - Extra context menu item: Linkinhalt an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8:64bit: - Extra context menu item: Mit Nuance PDF Converter 7.0 öffnen - C:\Program Files (x86)\Nuance\PDF Professional 7\cnvres_ger.dll (Nuance Communications, Inc.)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: PDF-Datei aus Linkinhalt erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8:64bit: - Extra context menu item: PDF-Datei erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8:64bit: - Extra context menu item: PDF-Dateien aus den ausgewählten Links erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Inhalt der ausgewählten Links an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Linkinhalt an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Mit Nuance PDF Converter 7.0 öffnen - C:\Program Files (x86)\Nuance\PDF Professional 7\cnvres_ger.dll (Nuance Communications, Inc.)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: PDF-Datei aus Linkinhalt erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: PDF-Datei erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: PDF-Dateien aus den ausgewählten Links erstellen - C:\Program Files (x86)\Nuance\PDF Professional 7\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O9 - Extra Button: Web-Eintrag - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll ()
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: datev.at ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.at ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.com ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([]https is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datev.de ([www] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datev.de ([www] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] http is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevnet.de ([*.services] https is out of zone range -  5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]http is out of zone range - 5)
O15 - HKCU\..Trusted Domains: datevstadt.de ([]https is out of zone range - 5)
O16:64bit: - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex64-2.2.6.0.cab (DLM Control)
O16 - DPF: {15BE8BEE-4105-4A79-B385-25068AA967DB} hxxp://de1.iradiopop.com/IRD/pages/VBIMDPlayer.CAB (VBIRDPlayer.Player)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.199.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Kanzlei.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D3BA4BEC-0264-43CF-B7B3-57C797E79215}: DhcpNameServer = 192.168.199.10
O18:64bit: - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.13 17:42:17 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2012.06.13 00:39:22 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Malwarebytes
[2012.06.13 00:37:32 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.13 00:37:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.13 00:37:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.13 00:37:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.12 23:32:37 | 000,000,000 | ---D | C] -- C:\ProgramData\wqpzacjsrypnbbd
[2012.06.09 23:08:40 | 000,000,000 | ---D | C] -- C:\Users\****\Documents\StreamTransport
[2012.06.09 13:01:33 | 000,000,000 | R--D | C] -- C:\Users\****\Desktop\Video_Bearbeitungsprogramme
[2012.06.09 12:32:27 | 000,000,000 | ---D | C] -- C:\Users\****\Documents\Any Video Converter
[2012.06.09 12:32:25 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\AnvSoft
[2012.06.09 12:31:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AnvSoft
[2012.06.09 12:31:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AnvSoft
[2012.06.09 11:44:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StreamTransport
[2012.06.09 11:44:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\StreamTransport
[2012.05.26 19:01:39 | 000,163,840 | ---- | C] (Igor Pavlov) -- C:\Users\****\Desktop\7z.exe
[2012.05.26 18:58:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.05.26 18:58:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\7-Zip
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.13 17:42:00 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe
[2012.06.13 17:37:51 | 000,000,000 | ---- | M] () -- C:\Users\****\defogger_reenable
[2012.06.13 17:23:10 | 000,050,477 | ---- | M] () -- C:\Users\****\Desktop\Defogger.exe
[2012.06.13 14:26:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.13 14:26:39 | 3188,219,904 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.13 00:37:33 | 000,001,115 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.13 00:24:21 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.13 00:24:21 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.13 00:24:21 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.13 00:24:21 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.13 00:24:21 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.12 23:47:20 | 000,027,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.12 23:47:20 | 000,027,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.12 23:33:35 | 000,000,052 | ---- | M] () -- C:\ProgramData\ckpgxccjdmbsnlv
[2012.06.12 23:32:34 | 000,053,248 | ---- | M] () -- C:\ProgramData\lntnqyan.exe
[2012.06.12 23:32:34 | 000,053,248 | ---- | M] () -- C:\ProgramData\cyqwqism.exe
[2012.06.12 23:32:34 | 000,053,248 | ---- | M] () -- C:\ProgramData\altmwguz.exe
[2012.06.12 23:32:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.10 19:26:48 | 000,001,358 | ---- | M] () -- C:\Users\****\Desktop\DATEV Suche in Info-Datenbank.lnk
[2012.06.10 18:49:17 | 000,004,709 | ---- | M] () -- C:\Users\****\AppData\Local\EmptySettings.xml
[2012.06.09 20:04:21 | 037,146,213 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 19:20:02 | 104,321,216 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 17:37:25 | 087,752,611 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 16:50:11 | 031,460,692 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 16:30:36 | 020,193,965 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 16:16:19 | 020,193,965 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 15:49:45 | 112,184,460 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:56:36 | 030,934,092 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:41:51 | 015,021,103 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:37:59 | 001,775,245 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:26:36 | 067,797,611 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 12:18:45 | 039,030,038 | ---- | M] () -- C:\Users\****\Documents\*****.flv
[2012.06.06 14:51:02 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForPC01$.job
[2012.06.06 08:57:25 | 000,000,526 | ---- | M] () -- C:\Windows\ODBC.INI
[2012.06.03 13:15:14 | 000,001,336 | ---- | M] () -- C:\Users\****\Desktop\Explorer Suchbefehle.lnk
[2012.05.24 07:39:05 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleFor****.job
[2012.05.16 10:44:04 | 000,001,248 | ---- | M] () -- C:\Users\****\Desktop\Character Map.lnk
[2012.05.15 18:16:45 | 000,002,023 | ---- | M] () -- C:\Users\****\Desktop\LocoSoft Buchungs-Systematik Erloese Bestandsumbuchungen.lnk
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.13 17:37:51 | 000,000,000 | ---- | C] () -- C:\Users\****\defogger_reenable
[2012.06.13 17:24:28 | 000,050,477 | ---- | C] () -- C:\Users\****\Desktop\Defogger.exe
[2012.06.13 00:37:33 | 000,001,115 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.12 23:33:35 | 000,053,248 | ---- | C] () -- C:\ProgramData\lntnqyan.exe
[2012.06.12 23:33:35 | 000,053,248 | ---- | C] () -- C:\ProgramData\cyqwqism.exe
[2012.06.12 23:32:35 | 000,053,248 | ---- | C] () -- C:\ProgramData\altmwguz.exe
[2012.06.12 23:32:35 | 000,000,052 | ---- | C] () -- C:\ProgramData\ckpgxccjdmbsnlv
[2012.06.10 19:25:20 | 000,001,358 | ---- | C] () -- C:\Users\****\Desktop\DATEV Suche in Info-Datenbank.lnk
[2012.06.09 19:51:17 | 037,146,213 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 18:59:29 | 104,321,216 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 16:58:36 | 087,752,611 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 16:42:59 | 031,460,692 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 16:21:41 | 020,193,965 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 16:09:10 | 020,193,965 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 15:07:13 | 112,184,460 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:47:30 | 030,934,092 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:39:07 | 015,021,103 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:37:34 | 001,775,245 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.09 14:15:18 | 067,797,611 | ---- | C] () -- C:\Users\****\Documents\videos_1111111.flv
[2012.06.09 12:13:35 | 039,030,038 | ---- | C] () -- C:\Users\****\Documents\*****.flv
[2012.06.03 13:14:23 | 000,001,336 | ---- | C] () -- C:\Users\****\Desktop\Explorer Suchbefehle.lnk
[2012.05.17 11:12:51 | 000,002,637 | ---- | C] () -- C:\Users\****\Desktop\Corel PHOTO-PAINT 12.lnk
[2012.05.16 10:44:04 | 000,001,248 | ---- | C] () -- C:\Users\****\Desktop\Character Map.lnk
[2012.05.15 18:15:21 | 000,002,023 | ---- | C] () -- C:\Users\****\Desktop\LocoSoft Buchungs-Systematik Erloese Bestandsumbuchungen.lnk
[2012.05.14 07:27:49 | 000,012,619 | ---- | C] () -- C:\Windows\SysWow64\UpdateAction_30032012.exe.dmp
[2012.03.09 06:31:26 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.03.09 06:31:26 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.03.09 01:26:20 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2012.03.07 19:32:57 | 001,335,296 | ---- | C] () -- C:\Windows\SysWow64\p2pfilter.dll
[2012.03.07 19:32:57 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\DSPlayer.dll
[2012.02.07 10:47:33 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2012.02.07 10:47:33 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2012.02.07 10:47:33 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2012.01.31 07:00:24 | 000,016,896 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.01.23 19:44:25 | 000,004,709 | ---- | C] () -- C:\Users\****\AppData\Local\EmptySettings.xml
[2012.01.14 13:36:51 | 000,035,328 | ---- | C] () -- C:\Windows\SysWow64\INETWH32.DLL
[2012.01.14 13:36:51 | 000,009,136 | ---- | C] () -- C:\Windows\SysWow64\INETWH16.DLL
[2012.01.14 12:39:58 | 000,000,196 | ---- | C] () -- C:\Windows\ktel.ini
[2012.01.06 01:00:41 | 000,000,033 | ---- | C] () -- C:\Windows\SysWow64\Opera6.ini
[2012.01.03 15:47:17 | 000,001,471 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2012.01.03 15:42:58 | 000,000,046 | ---- | C] () -- C:\Windows\BRUNVPC.INI
[2012.01.03 13:42:36 | 000,000,526 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.01.03 13:21:37 | 000,000,021 | ---- | C] () -- C:\Windows\DvInesKurusOleServer003.INI
[2012.01.03 13:19:42 | 000,000,096 | ---- | C] () -- C:\Windows\dvinesinstalllocation001.INI
[2012.01.03 13:12:14 | 000,000,097 | ---- | C] () -- C:\Windows\Startup.INI
[2012.01.03 12:48:38 | 000,004,426 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012.01.03 09:28:19 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.12.09 01:10:23 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.12.09 01:10:23 | 000,206,952 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.12.09 01:10:22 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.09.13 01:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.02.11 22:29:00 | 001,589,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.09.22 17:48:26 | 000,032,352 | ---- | C] () -- C:\Windows\SysWow64\JNILibrary.dll
[2010.09.22 17:48:06 | 000,114,272 | ---- | C] () -- C:\Windows\SysWow64\INetCert.dll
 
========== LOP Check ==========
 
[2012.01.19 16:42:46 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\AGFEO
[2012.06.09 12:32:25 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\AnvSoft
[2012.02.07 10:48:24 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\concept design
[2012.01.23 19:46:28 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\DATEV
[2012.01.03 15:24:23 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\DMS
[2012.02.07 11:38:54 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Engelmann Media
[2012.01.04 20:20:42 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Haufe Mediengruppe
[2012.01.14 12:46:05 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\klickTel
[2012.03.29 11:34:17 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Nuance
[2012.01.03 19:02:39 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Opera
[2012.01.12 10:46:02 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\TeamViewer
[2012.03.01 12:34:50 | 000,000,000 | ---D | M] -- C:\Users\****\AppData\Roaming\Zeon
[2012.04.06 16:58:05 | 000,032,624 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 255 bytes -> C:\ProgramData\Temp:0574215C
@Alternate Data Stream - 247 bytes -> C:\ProgramData\Temp:D95ACC7D
 
< End of report >
         

--- --- ---


c) Extra.TXT hat folgenden Inhalt:OTL Logfile:

OTL Extras logfile created on: 13.06.2012 17:46:09 - Run 1
OTL by OldTimer - Version 3.2.48.0     Folder = C:\Users\****\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,96 Gb Total Physical Memory | 3,36 Gb Available Physical Memory | 84,97% Memory free
7,92 Gb Paging File | 7,31 Gb Available in Paging File | 92,34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 458,50 Gb Total Space | 368,43 Gb Free Space | 80,36% Space Free | Partition Type: NTFS
Drive D: | 7,17 Gb Total Space | 0,92 Gb Free Space | 12,80% Space Free | Partition Type: NTFS
Drive F: | 1,86 Gb Total Space | 1,61 Gb Free Space | 86,89% Space Free | Partition Type: FAT
Drive K: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
Drive L: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
Drive P: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
Drive Q: | 55,85 Gb Total Space | 3,41 Gb Free Space | 6,11% Space Free | Partition Type: NTFS
 
Computer Name: PC**** | User Name: **** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office\msohtmed.exe" %1
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office\msohtmed.exe" /p %1
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office\msohtmed.exe" %1
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office\msohtmed.exe" /p %1
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\D****\PROGRAMM\Numzus\NumZus.exe" = C:\D****\PROGRAMM\Numzus\NumZus.exe:*:Enabled:NumZus.exe -- (D**** eG)
"C:\D****\SYSTEM\DvpExe.exe" = C:\D****\SYSTEM\DvpExe.exe:*:Enabled:DvpExe.exe -- (D**** eG)
"C:\D****\SYSTEM\DcomSrv.exe" = C:\D****\SYSTEM\DcomSrv.exe:*:Enabled:DcomSrv.exe -- (D**** eG)
"C:\D****\PROGRAMM\RWApplic\D****.Irw.Managed.ServiceProvider.exe" = C:\D****\PROGRAMM\RWAPPLIC\D****.Irw.Managed.ServiceProvider.exe:*:Enabled:D**** IRW ServiceProvider -- (D**** eG)
"C:\D****\PROGRAMM\M****\M****.exe" = C:\D****\PROGRAMM\M****\M****.exe:*:Enabled:M****.exe -- (D**** eG)
"C:\D****\PROGRAMM\Numzus\NumZus.exe" = C:\D****\PROGRAMM\Numzus\NumZus.exe:*:Enabled:NumZus.exe -- (D**** eG)
"C:\D****\SYSTEM\DvpExe.exe" = C:\D****\SYSTEM\DvpExe.exe:*:Enabled:DvpExe.exe -- (D**** eG)
"C:\D****\SYSTEM\DcomSrv.exe" = C:\D****\SYSTEM\DcomSrv.exe:*:Enabled:DcomSrv.exe -- (D**** eG)
"C:\D****\PROGRAMM\RWApplic\D****.Irw.Managed.ServiceProvider.exe" = C:\D****\PROGRAMM\RWAPPLIC\D****.Irw.Managed.ServiceProvider.exe:*:Enabled:D**** IRW ServiceProvider -- (D**** eG)
"C:\D****\PROGRAMM\M****\M****.exe" = C:\D****\PROGRAMM\M****\M****.exe:*:Enabled:M****.exe -- (D**** eG)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\D****\PROGRAMM\Numzus\NumZus.exe" = C:\D****\PROGRAMM\Numzus\NumZus.exe:*:Enabled:NumZus.exe -- (D**** eG)
"C:\D****\SYSTEM\DvpExe.exe" = C:\D****\SYSTEM\DvpExe.exe:*:Enabled:DvpExe.exe -- (D**** eG)
"C:\D****\SYSTEM\DcomSrv.exe" = C:\D****\SYSTEM\DcomSrv.exe:*:Enabled:DcomSrv.exe -- (D**** eG)
"C:\D****\PROGRAMM\RWApplic\D****.Irw.Managed.ServiceProvider.exe" = C:\D****\PROGRAMM\RWAPPLIC\D****.Irw.Managed.ServiceProvider.exe:*:Enabled:D**** IRW ServiceProvider -- (D**** eG)
"C:\D****\PROGRAMM\M****\M****.exe" = C:\D****\PROGRAMM\M****\M****.exe:*:Enabled:M****.exe -- (D**** eG)
"C:\D****\PROGRAMM\Numzus\NumZus.exe" = C:\D****\PROGRAMM\Numzus\NumZus.exe:*:Enabled:NumZus.exe -- (D**** eG)
"C:\D****\SYSTEM\DvpExe.exe" = C:\D****\SYSTEM\DvpExe.exe:*:Enabled:DvpExe.exe -- (D**** eG)
"C:\D****\SYSTEM\DcomSrv.exe" = C:\D****\SYSTEM\DcomSrv.exe:*:Enabled:DcomSrv.exe -- (D**** eG)
"C:\D****\PROGRAMM\RWApplic\D****.Irw.Managed.ServiceProvider.exe" = C:\D****\PROGRAMM\RWAPPLIC\D****.Irw.Managed.ServiceProvider.exe:*:Enabled:D**** IRW ServiceProvider -- (D**** eG)
"C:\D****\PROGRAMM\M****\M****.exe" = C:\D****\PROGRAMM\M****\M****.exe:*:Enabled:M****.exe -- (D**** eG)
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10C4A4DC-DC10-4D70-8DEE-4B5D2B3B2248}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{8ED5ED28-E9CA-48AF-9CE8-DC98A0EC921F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | 
"{D5D2FE1F-7D32-4E8D-8EB1-0246E90EECC4}" = lport=1947 | protocol=17 | dir=in | name=hasp srm  | 
"{E912A675-D7AD-4B1F-B6C9-B589B1646E1C}" = lport=1947 | protocol=6 | dir=in | name=hasp srm  | 
"{EF9CDC5C-1F9F-4F3E-963C-7E7AAC7FF6B9}" = lport=58432 | protocol=6 | dir=in | app=c:\D****\programm\sws\limaservice.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{009B521A-2746-4566-9D18-304E489AAE6F}" = protocol=6 | dir=out | app=c:\program files (x86)\iminent\imbooster\imbooster.exe | 
"{01BB4464-A7B9-4556-8F7D-5FFBDD9BB093}" = protocol=6 | dir=in | app=c:\D****\programm\rwapplic\D****.irw.managed.serviceprovider.exe | 
"{0C29C4AF-2379-476E-A769-29B22F27DAAB}" = protocol=6 | dir=in | app=c:\D****\programm\b0000195\addman\D****addman.exe | 
"{12EA362A-5D82-46E0-B2FA-5DA6707BD17C}" = protocol=6 | dir=in | app=c:\D****\programm\dfueisdn\secclt\secclt.exe | 
"{145BE8C9-20FA-48F5-AD71-EEBB06E97CC7}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{163EDC05-D6CE-414F-AB80-95473ADA63F2}" = protocol=6 | dir=in | app=c:\D****\system\ccsrv3.exe | 
"{37853316-8405-4D28-A25C-8D478CC96B46}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{3D9B21EB-2E06-49F0-A639-800B73DB3A2D}" = protocol=6 | dir=in | app=c:\D****\programm\b0000000\dfuemngr\dfueman.exe | 
"{433CAD54-798E-4C3F-8C54-5BCD39463810}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 
"{46BA131E-2531-4C4A-8D51-0D12B2C9E425}" = protocol=6 | dir=in | app=c:\D****\programm\rzkomm\empftest.exe | 
"{46D73661-4D30-44F4-930A-88A8764A96FC}" = protocol=6 | dir=in | app=c:\D****\programm\dfueisdn\sslclt\sslclt.exe | 
"{57810D97-4E0D-4FC2-9347-31113040E07A}" = protocol=6 | dir=in | app=c:\D****\programm\rzkomm\callauferst.exe | 
"{5FC9C4CF-0976-4FB1-8E59-43A04ED7E88F}" = protocol=6 | dir=out | app=c:\program files (x86)\iminent\mmserver\iminent.mmserver.exe | 
"{74BB54F9-E6EC-4B4D-BD36-8F58C1A28DCC}" = protocol=6 | dir=in | app=c:\D****\programm\dfuews\mntbna\mntbna.exe | 
"{82B24634-B99E-479D-A000-F6F96F508B46}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{8A6B822F-7368-4AC2-9043-3769A8BF205F}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | 
"{8E0BDC2A-E338-4FEB-809A-F44B0AF3FDA1}" = protocol=6 | dir=in | app=c:\D****\programm\b0000000\dfuemngr\dcmanag.exe | 
"{93689ED4-EC44-4E05-8FB8-6C58C890E8E0}" = protocol=6 | dir=in | app=c:\program files (x86)\iminent\mmserver\iminent.mmserver.exe | 
"{93E338CA-D75E-4AF6-B309-593E5424E936}" = protocol=6 | dir=in | app=c:\program files (x86)\g data\avkclient\avkcl.exe | 
"{9DBCF94A-B3E8-4044-A3BF-78013A181D45}" = protocol=6 | dir=in | app=c:\D****\programm\b0000398\sipahost.exe | 
"{9F03F527-B70E-4EEF-9DD6-513B247AC292}" = protocol=6 | dir=in | app=c:\program files (x86)\iminent\imbooster\imbooster.exe | 
"{9F2CB48E-0684-4A11-9852-3663B50426E1}" = protocol=6 | dir=in | app=c:\D****\programm\rzkomm\dfuesammlerdienst.exe | 
"{CEE6D5F1-4F6B-4D1B-BDB6-00F7A065FB3E}" = protocol=6 | dir=in | app=c:\D****\programm\rzkomm\funkt_fv.exe | 
"{E1872177-5C4C-48B7-9B52-81AF886E767E}" = protocol=6 | dir=in | app=c:\D****\programm\k0005000\arbeitsplatz.exe | 
"{E8F9144E-2C44-47F0-A8D2-01945C002780}" = protocol=17 | dir=in | app=c:\program files (x86)\g data\avkclient\avkcl.exe | 
"{E9D740B0-C36B-4CFC-8A56-CD6D92546E2B}" = protocol=6 | dir=in | app=c:\D****\programm\b0000391\D****.security.dokumentenschutz.exe | 
"{EBA9312D-1198-4AE2-B475-5854A8A613E9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{FA2686B8-40DE-4BB0-A771-6ACEDF493DFE}" = protocol=6 | dir=in | app=c:\D****\programm\rzkomm\funktest.exe | 
"TCP Query User{2DE4F6D0-E676-4B10-A585-357516B63CC3}C:\program files (x86)\g data\avkclient\avkcl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\g data\avkclient\avkcl.exe | 
"TCP Query User{58BEF8A0-A005-4777-BC57-295BB38CCD85}C:\D****\programm\dfueisdn\sslclt\sslclt.exe" = protocol=6 | dir=in | app=c:\D****\programm\dfueisdn\sslclt\sslclt.exe | 
"UDP Query User{1DA03D52-7559-4F7C-B2CB-A263D5BBFBA5}C:\program files (x86)\g data\avkclient\avkcl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\g data\avkclient\avkcl.exe | 
"UDP Query User{44B8ED4F-BB55-4CCE-83A0-E9516688A66C}C:\D****\programm\dfueisdn\sslclt\sslclt.exe" = protocol=17 | dir=in | app=c:\D****\programm\dfueisdn\sslclt\sslclt.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{054EF02F-95D8-48F4-9EEB-2F9CE3072ED8}" = AuthenTec TrueAPI
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{13815D81-44B6-7ADA-2A41-FFFC64DD6FAB}" = ccc-utility64
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{36B72E6E-E433-45FC-A929-C416FF63415A}" = Microsoft SQL Server 2005-Abwärtskompatibilität
"{3987279A-3504-2916-D063-741B910F0747}" = AMD Accelerated Video Transcoding
"{4D533F05-A3F6-F8A9-F1F6-FA6812089D36}" = AMD Drag and Drop Transcoding
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{7C39E0D1-E138-42B1-B083-213EC2CF7692}" = Microsoft SQL Server Native Client
"{7C5CAFD6-F51C-0011-410B-001EF3E342A7}" = AMD Media Foundation Decoders
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C9B6B1F-0A8E-402A-A60C-110BBB38D67E}" = Intel(R) Network Connections 15.7.176.0
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{90CB2C55-426D-0752-968D-9B0F1110202A}" = AMD Catalyst Install Manager
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B625EA74-59BE-4F69-9400-357F453368FD}" = Nuance PDF Converter Professional 7
"{BFBF33B5-AEFE-454B-A189-DF5013028535}" = SQLXML4
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{D79A02E9-6713-4335-9668-AAC7474C0C0E}" = HP Vision Hardware Diagnostics
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"PROSetDX" = Intel(R) Network Connections 15.7.176.0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{03046EBB-CB7C-4B98-BEFB-690EB955DA22}" = HP Setup
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Professional
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{0881ECE5-DCA1-462D-B515-F1732875EC74}" = D**** Infragistics Runtime V.3.2
"{0A590981-75A9-B968-4A29-718E5A8E1416}" = CCC Help Dutch
"{0E6B8EA7-4FDF-F730-8F28-05720874BE71}" = CCC Help Chinese Traditional
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{1003E625-BE5B-390B-7B60-D483D0B75A26}" = CCC Help Russian
"{1690611F-D4EA-A00D-DAAD-91D216869679}" = CCC Help Polish
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}" = Bing Bar
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{26EED5E6-EC40-35A9-602A-C3CF03A9C1E6}" = CCC Help Portuguese
"{2C33E65D-9187-8F2E-40D8-BD9E24E341FB}" = CCC Help Italian
"{36B6FF8B-38E3-E64C-F840-75F6AAEBE3EA}" = Catalyst Control Center Graphics Previews Common
"{38F6C932-2274-4897-479D-03AA6BA5B567}" = CCC Help Turkish
"{3AB00888-CA03-0BFD-3F3C-C877767192B0}" = CCC Help Swedish
"{3ACA2563-E786-BDD4-C87B-09909BB3F61C}" = CCC Help Thai
"{3BC2C64B-0DA0-974B-6311-AED4F3711DCE}" = CCC Help Danish
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{5BAC4DE5-4062-EE34-3337-5F92FE5D5032}" = CCC Help Spanish
"{5C1F18D2-F6B7-4242-B803-B5A78648185D}" = Corel WinDVD
"{5FCFEBE0-EBDA-42A5-BC6E-67B94A47D6F0}" = kobdfu x64x86 driver installation
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.2.0
"{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}" = HP Support Assistant
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{7ADCABE0-E651-6EA5-5128-26E203DAA5E1}" = CCC Help Korean
"{7F26BC94-9AAA-4FD2-A38A-F13B3ECA3426}" = Crystal Reports Runtime XI
"{80364245-BC33-41EF-9FEF-3A64C2F1682C}" = Haufe Steuer Office
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8815F011-43AF-4F50-BBD8-D78ED3D6F5B9}" = VR-NetWorld
"{8A261769-9640-4DB4-B877-3E00C61967F3}_is1" = SAD onlineTV 5
"{8F80DAA3-8A1D-09E9-57E6-DB0223CF2CE4}" = CCC Help French
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2010 Primary Interop Assemblies
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{990C85A1-0630-4F22-9F1B-7DBE44B44F2D}" = Dialogseminar online V.3.0
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FECD1F1-4B1E-499D-BAF4-B9BDE655554D}" = HP SimplePass PE 2011
"{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}" = IMinent Toolbar
"{AC172E9C-D9E6-4853-BEDB-FB6D72042F42}" = klickTel OEM Frühjahr 2010
"{AC76BA86-7AD7-1031-7B44-A80000000002}" = Adobe Reader 8 - Deutsch
"{AFC71277-DE19-6505-8CBC-71D29163F44A}" = CCC Help German
"{B2B7B1C8-7C8B-476C-BE2C-049731C55992}" = HP Support Information
"{B3406262-5701-E9CC-D6B3-BA38C34125A9}" = CCC Help English
"{B625EA74-59BE-4F69-9400-357F453368FD}" = Nuance PDF Converter Professional 7
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{BBC2068D-CE9C-48F5-A6EA-4B44B9DB14A5}" = Catalyst Control Center - Branding
"{BD136CE7-6666-4273-A056-8D92F8625AAB}" = Sun ODF Plugin for Microsoft Office 3.2
"{C01A86F5-56E7-101F-9BC9-E3F1025EB779}" = Intel(R) Identity Protection Technology 1.1.2.0
"{C5B6078F-5D37-A122-2E6E-EDC623E8C787}" = CCC Help Czech
"{C5CBEBFF-3DB4-4271-A706-757BBE3BD5AE}" = KOBIL CCID driver x64x86
"{C7068E1F-22C6-9408-7B24-584F32F66D70}" = CCC Help Finnish
"{C87B855D-DD8F-E419-C640-34936E813EA9}" = CCC Help Greek
"{CC2BAF9A-926F-791D-772C-F582CD8A47B0}" = Catalyst Control Center InstallProxy
"{CE1CA06F-0AD8-CA2A-3A3A-872E8191C198}" = CCC Help Norwegian
"{CE7F2CA3-ADA3-4907-9013-8B61C370B6E4}" = Haufe Formular-Manager
"{CECECCED-B7F3-B1A3-3241-0C5D775F8E70}" = CCC Help Chinese Standard
"{D3CEF909-78DC-9D3D-37BD-52F5324C01DA}" = CCC Help Hungarian
"{D3D88E2B-0853-4C17-8FAF-962D0A93D776}" = COLLEGA K****
"{D7DFBD32-0A46-4606-BE00-39E2E5B17D12}" = Haufe Personal Office Standard
"{DD4CEACE-8B19-4B1C-AE82-DE0FC5787D4C}" = Iminent
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E71AFF36-199E-4013-0001-8DB5FD1561EC}" = audio converter 2.0
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1EA61A2-B88F-44AD-3143-419ECB6C7E9A}" = CCC Help Japanese
"{F6567C5A-C3EA-2E05-E89E-C8C52E33150D}" = Catalyst Control Center
"{F713C6A9-AB4A-4332-9306-736C2F4F18B8}" = NWB steuerXpert
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F8AEA743-A9CB-453C-9B3C-53D7F1D0CC22}" = B1315AppGuid
"{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.2171
"{FA6F3900-79FF-11E1-97DC-005056B12123}" = Haufe iDesk-Service
"{FB3FA4C6-98A3-41C0-8713-6BADBBCB4FBC}" = ADAC Gebrauchtwagen 2010-2011
"{FE54AF33-9364-7053-670F-A15AD658214C}" = Catalyst Control Center Localization All
"{FF50CC0F-0759-418A-0001-8C8AF87A60AC}" = Notifier
"7-Zip" = 7-Zip 9.20
"Any Video Converter_is1" = Any Video Converter 3.3.9
"Ashampoo Snap 3_is1" = Ashampoo Snap 3.50
"D****B00000482.0" = D**** Installation V.2.9
"Dialogseminar online V.3.0" = Dialogseminar online V.3.0
"ElsterFormular 12.4.1.7699k" = ElsterFormular
"IMBoosterARP" = Iminent
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Opera 11.64.1403" = Opera 11.64
"Organizer V99.1" = Lotus Organizer 6.0
"test und FINANZtest Archiv CD-Rom 2010" = test und FINANZtest Archiv CD-Rom 2010
"tksuite_tksuite_client" = AGFEO TK-Suite Client
"VIP Access SDK" = VIP Access SDK (1.0.1.4) 
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Betriebspr&uuml;fungs-Kartei" = Betriebsprüfungs-Kartei
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 26.05.2012 08:40:55 | Computer Name = PC****.K****.local | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 14.0.6024.1000 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 10a4    Startzeit: 01cd3b3b1eb01eec    Endzeit: 0    Anwendungspfad: 
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE    Berichts-ID: 00a9cd3a-a730-11e1-b6ce-2c4138ac8f87
 
 
Error - 26.05.2012 08:45:48 | Computer Name = PC****.K****.local | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 14.0.6024.1000 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: c40    Startzeit: 01cd3b3ccb1902ac    Endzeit: 0    Anwendungspfad: C:\Program
 Files (x86)\Microsoft Office\Office14\WINWORD.EXE    Berichts-ID: af4897ff-a730-11e1-b6ce-2c4138ac8f87
 
 
Error - 26.05.2012 08:58:39 | Computer Name = PC****.K****.local | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 14.0.6024.1000 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 1178    Startzeit: 01cd3b3d79d15cac    Endzeit: 0    Anwendungspfad: 
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE    Berichts-ID: 7b0c9d82-a732-11e1-b6ce-2c4138ac8f87
 
 
Error - 26.05.2012 09:24:26 | Computer Name = PC****.K****.local | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 14.0.6024.1000 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 624    Startzeit: 01cd3b40dd1c24ae    Endzeit: 0    Anwendungspfad: C:\Program
 Files (x86)\Microsoft Office\Office14\WINWORD.EXE    Berichts-ID: 14f60a93-a736-11e1-b6ce-2c4138ac8f87
 
 
Error - 26.05.2012 09:57:57 | Computer Name = PC****.K****.local | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 14.0.6024.1000 kann nicht mehr unter
 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 1298    Startzeit: 01cd3b433a2e75b8    Endzeit: 0    Anwendungspfad: 
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE    Berichts-ID: c6a361ea-a73a-11e1-b6ce-2c4138ac8f87
 
 
Error - 26.05.2012 18:57:19 | Computer Name = PC****.K****.local | Source = DFÜ-Manager | ID = 2
Description = Das DFÜ-System ist inkonsistent.
 
Error - 27.05.2012 17:46:31 | Computer Name = PC****.K****.local | Source = DFÜ-Manager | ID = 2
Description = Das DFÜ-System ist inkonsistent.
 
Error - 28.05.2012 19:21:59 | Computer Name = PC****.K****.local | Source = DFÜ-Manager | ID = 2
Description = Das DFÜ-System ist inkonsistent.
 
Error - 29.05.2012 17:30:22 | Computer Name = PC****.K****.local | Source = DFÜ-Manager | ID = 2
Description = Das DFÜ-System ist inkonsistent.
 
Error - 30.05.2012 17:27:00 | Computer Name = PC****.K****.local | Source = DFÜ-Manager | ID = 2
Description = Das DFÜ-System ist inkonsistent.
 
[ Hewlett-Packard Events ]
Error - 30.12.2011 08:54:16 | Computer Name = PC**** | Source = HPSFMsgr.exe | ID = 4000
Description = HP Error ID: -2147221164   bei System.RuntimeTypeHandle.CreateInstance(RuntimeType
 type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle&
 ctor, Boolean& bNeedSecurityCheck)     bei System.RuntimeType.CreateInstanceSlow(Boolean
 publicOnly, Boolean fillCache)     bei System.RuntimeType.CreateInstanceImpl(Boolean
 publicOnly, Boolean skipVisibilityChecks, Boolean fillCache)     bei System.Activator.CreateInstance(Type
 type, Boolean nonPublic)     bei HPSA_Messenger.MessengerCom.TrayDeskBand.isTaskbarDisplayed()
StackTrace:
   bei System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly,
 Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle& ctor, Boolean& bNeedSecurityCheck)
 
   bei System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean fillCache)
 
   bei System.RuntimeType.CreateInstanceImpl(Boolean publicOnly, Boolean skipVisibilityChecks,
 Boolean fillCache)     bei System.Activator.CreateInstance(Type type, Boolean nonPublic)
 
   bei HPSA_Messenger.MessengerCom.TrayDeskBand.isTaskbarDisplayed()  Source: mscorlib
 
Name:
 HPSFMsgr.exe  Version: 01.00.00.00  Path: C:\Program Files (x86)\Hewlett-Packard\HP
 Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe  Format: de-DE  RAM: 3984  Ram
 Utilization: 20  TargetSite: System.Object CreateInstance(System.RuntimeType, Boolean,
 Boolean, Boolean ByRef, System.RuntimeMethodHandle ByRef, Boolean ByRef)  
 
[ System Events ]
Error - 21.05.2012 02:07:24 | Computer Name = PC****.K****.local | Source = DCOM | ID = 10010
Description = 
 
Error - 22.05.2012 01:53:29 | Computer Name = PC****.K****.local | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597
 (Definition 1.127.390.0)
 
Error - 23.05.2012 10:01:21 | Computer Name = PC****.K****.local | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 80. Der interne Fehlerstatus
 lautet: 301.
 
Error - 29.05.2012 03:00:43 | Computer Name = PC****.K****.local | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 29.05.2012 03:00:44 | Computer Name = PC****.K****.local | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 03.06.2012 02:38:10 | Computer Name = PC****.K****.local | Source = Service Control Manager | ID = 7034
Description = Dienst "G Data Dateisystem Wächter" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 10.06.2012 03:57:14 | Computer Name = PC****.K****.local | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
 
Error - 10.06.2012 03:57:15 | Computer Name = PC****.K****.local | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
 
Error - 10.06.2012 03:57:15 | Computer Name = PC****.K****.local | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
 
Error - 10.06.2012 03:57:16 | Computer Name = PC****.K****.local | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
 
 
< End of report >
         

--- --- ---

d) es handelt sich um einen x64 basierten PC

e) Die Gmer.txt ist leer (nichts gefunden)

Vielen Dank schon vorab.
Grüße an die Spezialisten

Zwischenzeitlich wurde das Problem durch externe Hilfe gelöst.
Der Beitrag könnte gelöscht werden.

Warum postest du nicht einfach 1:1 alle Logdateien von malwarebytes!
Dann braucht man sich auch keine eigene Darstellungsformen ausdenken und erspart sich Beschreibungen über die Funde, die eh unvollständig sind!