Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: GVU Trojaner mit Malwarebyte entfernt, aber vollständig?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 31.08.2012, 15:26   #1
user154
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Hallo,
wie schon im Titel beschrieben, habe/hatte ich mir den GVU Trojaner eingefangen, diesen habe ich mit der Software Malwarebyte (entfernt) - es erscheint auf jeden Fall nicht mehr das nervige Bild.

Ich würde mich freuen, wenn Ihr mir sagen könntet, ob der Trojaner weg ist, hier die Logs:

defogger_disable

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:11 on 31/08/2012 (xxxxx)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
         
OTL
Code:
ATTFilter
OTL logfile created on: 31.08.2012 16:12:34 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Jonas\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,68 Gb Available Physical Memory | 83,73% Memory free
15,96 Gb Paging File | 14,50 Gb Available in Paging File | 90,85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 52,37 Gb Free Space | 43,95% Space Free | Partition Type: NTFS
Drive D: | 931,50 Gb Total Space | 473,26 Gb Free Space | 50,81% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 174,60 Gb Free Space | 74,98% Space Free | Partition Type: NTFS
Drive H: | 377,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive S: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
Drive T: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
Drive U: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
Drive V: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
 
Computer Name: JONASDESKTOP | User Name: Jonas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.31 12:17:21 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Jonas\Desktop\OTL.exe
PRC - [2012.08.28 12:35:11 | 001,193,176 | ---- | M] () -- C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2012.07.31 11:01:01 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.20 14:47:21 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.20 14:46:15 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.07.20 14:46:06 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.07.20 14:46:03 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.20 14:45:58 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
PRC - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) -- C:\Program Files (x86)\Skype\Updater\Updater.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
PRC - [2010.04.27 10:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.28 12:35:11 | 001,193,176 | ---- | M] () -- C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.08.27 21:50:24 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.25 03:59:11 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.20 14:47:21 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.20 14:46:15 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.07.20 14:46:06 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.07.20 14:46:03 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.20 14:45:58 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Running] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe -- (Radio.fx)
SRV - [2011.09.19 15:56:20 | 000,017,920 | ---- | M] (Microsoft) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\MouseWithoutBordersSvc.exe -- (MouseWithoutBordersSvc)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.07.21 02:42:38 | 000,061,976 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.03.30 04:02:56 | 057,617,752 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS)
SRV - [2009.03.30 04:01:06 | 000,427,880 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$SQLEXPRESS)
SRV - [2008.07.10 05:31:10 | 000,157,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.22 22:29:39 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.07.21 16:16:01 | 000,031,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pmxdrv.sys -- (pmxdrv)
DRV:64bit: - [2012.07.20 15:16:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.07.20 15:16:11 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.20 15:16:07 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.07.20 15:16:06 | 000,139,360 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avfwot.sys -- (avfwot)
DRV:64bit: - [2012.07.20 15:16:06 | 000,114,128 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avfwim.sys -- (avfwim)
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.06.05 16:03:52 | 000,147,288 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.07.29 13:54:56 | 000,016,776 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv)
DRV:64bit: - [2011.07.29 13:54:56 | 000,009,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 12:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010.11.12 09:10:50 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010.10.19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.09.30 13:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.09.30 13:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.09.13 12:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.09.03 07:59:26 | 000,349,800 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009.07.09 03:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2003.09.23 16:42:34 | 000,007,296 | ---- | M] (GARMIN Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\grmnusb.sys -- (grmnusb)
DRV - [2011.07.29 13:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv)
DRV - [2011.07.29 13:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2010.06.25 16:56:14 | 000,017,808 | ---- | M] (Foxconn (R) Corporation) [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\Foxconn\FOXDMI~1\FoxAwdWINFLASH64.sys -- (FoxAwdWINFLASH)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = F0 60 C6 BD 97 71 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: linkuryfirefoxremoteplugin@linkury.com:1.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100908
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8
FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2.1
FF - prefs.js..extensions.enabledItems: maps@ovi.com:4.0.12.12
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.2.26
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.3
FF - prefs.js..extensions.enabledItems: {1ced4832-f06e-413f-aa14-9eb63ad40ace}:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {D0AD45D6-8518-11DF-8AD2-3F67DFD72085}:1.0.7
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.2.1
FF - prefs.js..extensions.enabledItems: synoext@masterfix.mine.nu:0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\Users\\Jonas\\AppData\\Local\\Temp\\proxtube.pac"
FF - prefs.js..network.proxy.http: "localhost"
FF - prefs.js..network.proxy.http_port: 9666
FF - prefs.js..network.proxy.socks: "localhost"
FF - prefs.js..network.proxy.socks_port: 9050
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.ssl: "localhost"
FF - prefs.js..network.proxy.ssl_port: 9666
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: D:\Programme\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jonas\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jonas\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.28 20:38:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.07.20 14:44:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.08.28 20:39:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Extensions
[2011.07.30 13:59:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Extensions\uploadr@flickr.com
[2012.08.30 10:17:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\0juducq7.Outdoordeals\extensions
[2012.08.30 10:17:25 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\0juducq7.Outdoordeals\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.08.28 23:59:30 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\0juducq7.Outdoordeals\extensions\de-DE@dictionaries.addons.mozilla.org
[2012.08.29 12:30:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\0xelmwvm.WSeminar\extensions
[2012.08.28 19:59:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\2p1n40z9.DieTester.eu\extensions
[2012.08.30 11:01:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\jb7bzk4g.Kiddideals\extensions
[2012.08.28 23:54:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\s1itmmrk.default\extensions
[2012.08.30 00:14:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\x16iw5jk.Raddeals\extensions
[2012.08.30 00:14:44 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\x16iw5jk.Raddeals\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.08.28 23:59:11 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\x16iw5jk.Raddeals\extensions\de-DE@dictionaries.addons.mozilla.org
[2012.08.28 23:59:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\xg5ibzne.Survivaldeals\extensions
[2012.08.28 23:59:12 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\xg5ibzne.Survivaldeals\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012.08.28 23:59:12 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Users\Jonas\AppData\Roaming\mozilla\Firefox\Profiles\xg5ibzne.Survivaldeals\extensions\de-DE@dictionaries.addons.mozilla.org
[2012.08.28 20:38:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.08.25 04:00:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.08.25 04:49:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.25 04:49:52 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.08.25 04:49:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.08.25 04:49:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.08.25 04:49:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.08.25 04:49:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: about:home
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: about:home
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Jonas\AppData\Local\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Jonas\AppData\Local\Google\Chrome\Application\21.0.1180.83\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Jonas\AppData\Local\Google\Chrome\Application\21.0.1180.83\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\Microsoft Office\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\Microsoft Office\Office14\NPSPWRAP.DLL
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\npDeployJava1.dll
CHR - plugin: Java(TM) Platform SE 7 U5 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Windows Live\\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Jonas\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - Extension: YouTube = C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.07.29 17:21:55 | 000,000,922 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1                   activate.adobe.com
O1 - Hosts: 127.0.0.1                   practivate.adobe.com
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [EDO-Soft Sticky Notes] C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe File not found
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [rfxsrvtray] C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe (Tobit.Software)
O4 - HKCU..\Run: [Schindlers PC-LATEIN: Spruch] D:\Programme\Schindlers PC-LATEIN\spruch.DLL (Schindlers Software)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Jonas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - Startup: C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Jonas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\Microsoft Office\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\Microsoft Office\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\Microsoft Office\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\Microsoft Office\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63C80402-988E-4A68-BC23-C1292FDAAE1C}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.31 12:47:12 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{20E985BF-DC13-4536-AF23-D8BC4002D144}
[2012.08.31 12:17:26 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Jonas\Desktop\OTL.exe
[2012.08.31 11:54:12 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Malwarebytes
[2012.08.31 11:54:05 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.31 11:54:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.31 11:54:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.31 11:54:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.30 23:12:15 | 000,000,000 | ---D | C] -- C:\Program Files\MouseWithoutBorders
[2012.08.30 16:40:08 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{0606CCBC-64A8-43DB-A8BB-ABA0A0F1DCE5}
[2012.08.29 20:28:41 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Garage
[2012.08.29 20:28:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Garage
[2012.08.29 18:10:02 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\UBTv1.1
[2012.08.29 16:47:16 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{2714F040-DD0F-4294-A6EB-EDB81CB51BF7}
[2012.08.29 11:52:06 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Softland
[2012.08.29 11:52:05 | 000,024,968 | ---- | C] (Softland) -- C:\Windows\SysNative\dopdfmn7.dll
[2012.08.29 11:52:05 | 000,021,384 | ---- | C] (Softland) -- C:\Windows\SysNative\dopdfmi7.dll
[2012.08.29 11:52:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\doPDF 7
[2012.08.29 11:52:02 | 000,000,000 | ---D | C] -- C:\Program Files\Softland
[2012.08.29 11:49:37 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\pdfforge
[2012.08.28 23:10:27 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\Profiles
[2012.08.28 22:55:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.08.28 20:38:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.08.28 20:18:07 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\Neuer Ordner
[2012.08.28 20:15:58 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\Mozilla
[2012.08.28 19:43:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware
[2012.08.28 19:43:50 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Documents\Anti-Malware
[2012.08.28 12:48:25 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{71A57F2C-FD8D-481E-948F-AADAD9B0BE9B}
[2012.08.28 12:14:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Perion
[2012.08.28 12:07:55 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Documents\My Kindle Content
[2012.08.28 11:53:54 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
[2012.08.28 11:53:54 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\Amazon
[2012.08.28 11:53:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Amazon
[2012.08.27 23:04:45 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\Desktop
[2012.08.27 22:12:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2012.08.27 22:12:36 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\InstallShield
[2012.08.27 19:45:19 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{7674999A-1E5A-4026-9617-7E9F01C9EBB0}
[2012.08.12 17:26:56 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{113577F8-4CEB-4EBD-8EFD-D2E2AA64B254}
[2012.08.12 17:26:45 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{3760B608-7411-4856-BD7C-F82C5F177C62}
[2012.08.12 12:56:59 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{4F3873B7-D6E6-47A4-A97A-75E201B4B595}
[2012.08.11 22:38:17 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{09AE1C81-5318-4FB5-BC37-12D2920DDF4A}
[2012.08.11 22:38:06 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{6094402A-AAA6-422D-BDBF-3716ED5028F5}
[2012.08.11 16:18:11 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\Microsoft Office
[2012.08.11 10:36:23 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{40D72B1D-64AA-4B93-9B92-4162B0B3CD0F}
[2012.08.11 10:36:12 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{81B84E83-6EB1-4D62-A25F-B9AAADAEA8D3}
[2012.08.10 11:11:14 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{C6AF6D4A-3173-4005-9632-3CB1B64C39A7}
[2012.08.10 11:10:53 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{41650DF7-6EBB-4738-A7B4-2D32925E6017}
[2012.08.09 23:10:42 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{7709E1BF-D2B7-41A4-BD0F-5F7DDE15ABC8}
[2012.08.09 23:10:31 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{A86C8488-C927-49D9-A6D0-46A6DDAA4892}
[2012.08.08 20:05:39 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{1A03E34A-D523-49B7-8B9D-4E37B14734E7}
[2012.08.08 20:05:28 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{BEA80F0D-CEF4-40B7-898F-7989555B8774}
[2012.08.06 14:59:45 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012.08.06 14:59:45 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Adobe Mini Bridge CS5
[2012.08.06 13:28:41 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{15810115-4A18-4BEA-A07C-BEF8C53AA7C8}
[2012.08.06 13:28:30 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{84D0C9DC-4343-4F93-BDCA-E95DFA387C98}
[2012.08.05 16:30:47 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Mobile Atlas Creator
[2012.08.05 16:24:32 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Documents\Mein Garmin
[2012.08.05 16:24:07 | 000,017,536 | ---- | C] (GARMIN Corp.) -- C:\Windows\SysNative\drivers\grmn0200.sys
[2012.08.05 16:24:07 | 000,016,512 | ---- | C] (GARMIN Corp.) -- C:\Windows\SysNative\drivers\grmn0400.sys
[2012.08.05 16:24:07 | 000,011,776 | ---- | C] (GARMIN Corp.) -- C:\Windows\SysNative\drivers\grmn1200.sys
[2012.08.05 16:24:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2012.08.05 16:22:10 | 000,000,000 | ---D | C] -- C:\Garmin
[2012.08.05 13:15:47 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\MetroTwit
[2012.08.05 13:15:46 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pixel Tucker Pty Ltd
[2012.08.05 13:15:02 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\Deployment
[2012.08.05 13:15:02 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\Apps
[2012.08.05 12:30:26 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{841556EE-3CDF-4754-95C8-98127752CEAE}
[2012.08.05 12:30:16 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{20D0F74F-596D-4BA6-9B02-B04DE9990771}
[2012.08.05 12:11:38 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\Seminararbeit
[2012.08.05 12:05:37 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Desktop\Programme
[2012.08.04 13:50:14 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{7FFC4822-E43A-4D0F-B2D5-039E26D5D682}
[2012.08.04 13:50:03 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{BB28D544-07A0-4573-B613-A034CD536404}
[2012.08.03 18:00:15 | 000,000,000 | ---D | C] -- C:\Users\Jonas\Documents\Calibre Bibliothek
[2012.08.03 18:00:14 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\calibre
[2012.08.03 18:00:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Calibre2
[2012.08.03 18:00:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre - E-book Management
[2012.08.03 13:33:04 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\Secomba_GmbH
[2012.08.03 11:37:37 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{3752D84D-043E-44C5-835F-2938CA5E938D}
[2012.08.03 11:37:26 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{E19CCA3A-9A41-4A97-B568-D2E41C5F2AC1}
[2012.08.02 17:21:44 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Roaming\Klok2.DD7F2188B985C2439837C76B42A187050457E61B.1
[2012.08.02 17:21:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Klok2
[2012.08.02 16:27:52 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{0804B4C8-87A2-4B71-8B8B-077687BD6547}
[2012.08.02 16:27:42 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{3C8B103B-7BDB-4C0F-9F35-F5CCC8986AE8}
[2012.08.02 14:56:21 | 000,000,000 | ---D | C] -- C:\Users\Jonas\AppData\Local\{AE40D882-2D66-4BA6-AB46-BE0FB5F9C597}
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.31 16:11:25 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.31 16:11:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.31 16:11:14 | 2133,819,391 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.31 16:09:47 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4168481013-4061430455-1902992391-1000UA.job
[2012.08.31 16:09:47 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.31 16:09:47 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4168481013-4061430455-1902992391-1000Core.job
[2012.08.31 16:09:47 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.31 12:17:21 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Jonas\Desktop\OTL.exe
[2012.08.31 12:11:20 | 000,000,148 | ---- | M] () -- C:\Users\Jonas\defogger_reenable
[2012.08.31 12:10:34 | 000,050,477 | ---- | M] () -- C:\Users\Jonas\Desktop\Defogger.exe
[2012.08.31 12:05:42 | 000,018,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 12:05:42 | 000,018,624 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.31 12:04:27 | 001,799,210 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.31 12:04:27 | 000,762,792 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.31 12:04:27 | 000,718,110 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.31 12:04:27 | 000,173,178 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.31 12:04:27 | 000,146,132 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.31 11:54:05 | 000,001,131 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.31 11:31:15 | 083,023,306 | ---- | M] () -- C:\ProgramData\nud0repor.pad
[2012.08.30 23:53:10 | 000,001,479 | ---- | M] () -- C:\Users\Jonas\Desktop\filezilla - Verknüpfung.lnk
[2012.08.30 20:28:38 | 000,102,239 | ---- | M] () -- C:\Users\Jonas\392504_443436869000622_1685252155_n.jpg
[2012.08.30 20:28:37 | 000,030,715 | ---- | M] () -- C:\Users\Jonas\rrr.jpg
[2012.08.30 16:40:31 | 000,014,124 | ---- | M] () -- C:\Users\Jonas\Desktop\MobilePaymentUmfragemylookout.com.jpg
[2012.08.30 16:32:45 | 001,212,933 | ---- | M] () -- C:\Users\Jonas\Desktop\Mobile_Payments_Online_Shopping_Survey.pdf
[2012.08.30 16:23:05 | 000,011,671 | ---- | M] () -- C:\Users\Jonas\Desktop\TruaxisInfographik.jpg
[2012.08.30 16:15:26 | 000,225,384 | ---- | M] () -- C:\Users\Jonas\Desktop\Wissenschaftliche Hausarbeiten_Leitfaden.pdf
[2012.08.30 00:01:33 | 000,071,053 | ---- | M] () -- C:\Users\Jonas\Desktop\Jonas1.jpg
[2012.08.30 00:01:14 | 036,023,776 | ---- | M] () -- C:\Users\Jonas\Desktop\DSC09522.psd
[2012.08.29 23:57:34 | 000,075,971 | ---- | M] () -- C:\Users\Jonas\Desktop\Profilbild.jpg
[2012.08.29 23:50:24 | 006,233,830 | ---- | M] () -- C:\Users\Jonas\Desktop\DSC09522.jpg
[2012.08.29 18:08:33 | 000,732,474 | ---- | M] () -- C:\Users\Jonas\Desktop\UBTv1.1.zip
[2012.08.29 12:48:11 | 000,012,162 | ---- | M] () -- C:\Users\Jonas\Documents\NFC Forum _ About the Forum.pdf
[2012.08.29 11:54:27 | 000,041,881 | ---- | M] () -- C:\Users\Jonas\Documents\Security-Interview_ Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheit2.pdf
[2012.08.29 11:53:50 | 000,041,879 | ---- | M] () -- C:\Users\Jonas\Documents\Security-Interview_ Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheitw.pdf
[2012.08.29 11:52:43 | 000,041,780 | ---- | M] () -- C:\Users\Jonas\Documents\Security-Interview_ Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheit.pdf
[2012.08.29 11:49:34 | 000,084,610 | ---- | M] () -- C:\Users\Jonas\Desktop\Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheit.info.pdf
[2012.08.28 20:38:09 | 000,001,134 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.08.28 19:54:46 | 000,001,542 | ---- | M] () -- C:\Users\Jonas\Desktop\Firefox Boarderdeals.lnk
[2012.08.28 19:54:27 | 000,001,538 | ---- | M] () -- C:\Users\Jonas\Desktop\Firefox Kiddideals.lnk
[2012.08.28 19:53:47 | 000,001,536 | ---- | M] () -- C:\Users\Jonas\Desktop\Firefox DieTester.lnk
[2012.08.28 14:21:58 | 000,078,998 | ---- | M] () -- C:\Users\Jonas\Desktop\volkszaehler.org - web frontend - Google Chrome_2012-08-28_14-21-07.png
[2012.08.28 11:53:54 | 000,001,998 | ---- | M] () -- C:\Users\Jonas\Desktop\Kindle.lnk
[2012.08.28 11:50:02 | 000,001,011 | ---- | M] () -- C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.08.27 22:09:53 | 000,251,251 | ---- | M] () -- C:\Users\Jonas\Desktop\r.jpg
[2012.08.27 21:41:28 | 004,904,656 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.27 19:44:40 | 000,002,417 | ---- | M] () -- C:\Users\Jonas\Desktop\Google Chrome.lnk
[2012.08.12 18:14:06 | 000,057,377 | ---- | M] () -- C:\Users\Jonas\Desktop\Bite Away Cobra Stichheiler für 19,95€–33% günstiger _EXKLUSIV_.pdf
[2012.08.08 23:09:17 | 000,873,253 | ---- | M] () -- C:\Users\Jonas\Desktop\IMG_20110318_135810.jpg
[2012.08.08 23:08:41 | 000,664,770 | ---- | M] () -- C:\Users\Jonas\Desktop\IMG_20110323_124053.jpg
[2012.08.08 23:07:31 | 000,807,216 | ---- | M] () -- C:\Users\Jonas\Desktop\IMG_20110323_134620.jpg
[2012.08.06 21:07:36 | 000,141,857 | ---- | M] () -- C:\Users\Jonas\Desktop\BA_Inf_TI_Studienverlaufsplan.pdf
[2012.08.06 15:10:21 | 000,250,107 | ---- | M] () -- C:\Users\Jonas\Desktop\f2.jpg
[2012.08.06 15:09:44 | 000,194,336 | ---- | M] () -- C:\Users\Jonas\Desktop\f1.jpg
[2012.08.05 19:40:04 | 000,024,674 | ---- | M] () -- C:\Users\Jonas\Desktop\NotificationView_2012-08-05_19-20-15.png
[2012.08.05 13:15:46 | 000,000,308 | ---- | M] () -- C:\Users\Jonas\Desktop\MetroTwit.appref-ms
[2012.08.05 12:08:34 | 000,000,783 | ---- | M] () -- C:\Users\Jonas\Desktop\Ablage - Verknüpfung.lnk
[2012.08.02 10:55:49 | 000,000,961 | ---- | M] () -- C:\Users\Jonas\Desktop\arduino - Verknüpfung.lnk
 
========== Files Created - No Company Name ==========
 
[2012.08.31 12:11:20 | 000,000,148 | ---- | C] () -- C:\Users\Jonas\defogger_reenable
[2012.08.31 12:10:33 | 000,050,477 | ---- | C] () -- C:\Users\Jonas\Desktop\Defogger.exe
[2012.08.31 11:54:05 | 000,001,131 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.31 00:34:32 | 083,023,306 | ---- | C] () -- C:\ProgramData\nud0repor.pad
[2012.08.30 23:53:10 | 000,001,479 | ---- | C] () -- C:\Users\Jonas\Desktop\filezilla - Verknüpfung.lnk
[2012.08.30 20:28:35 | 000,102,239 | ---- | C] () -- C:\Users\Jonas\392504_443436869000622_1685252155_n.jpg
[2012.08.30 20:28:35 | 000,030,715 | ---- | C] () -- C:\Users\Jonas\rrr.jpg
[2012.08.30 16:40:31 | 000,014,124 | ---- | C] () -- C:\Users\Jonas\Desktop\MobilePaymentUmfragemylookout.com.jpg
[2012.08.30 16:32:45 | 001,212,933 | ---- | C] () -- C:\Users\Jonas\Desktop\Mobile_Payments_Online_Shopping_Survey.pdf
[2012.08.30 16:23:05 | 000,011,671 | ---- | C] () -- C:\Users\Jonas\Desktop\TruaxisInfographik.jpg
[2012.08.30 16:15:26 | 000,225,384 | ---- | C] () -- C:\Users\Jonas\Desktop\Wissenschaftliche Hausarbeiten_Leitfaden.pdf
[2012.08.30 00:01:32 | 000,071,053 | ---- | C] () -- C:\Users\Jonas\Desktop\Jonas1.jpg
[2012.08.29 23:57:34 | 000,075,971 | ---- | C] () -- C:\Users\Jonas\Desktop\Profilbild.jpg
[2012.08.29 23:50:21 | 006,233,830 | ---- | C] () -- C:\Users\Jonas\Desktop\DSC09522.jpg
[2012.08.29 18:09:59 | 000,732,474 | ---- | C] () -- C:\Users\Jonas\Desktop\UBTv1.1.zip
[2012.08.29 12:48:10 | 000,012,162 | ---- | C] () -- C:\Users\Jonas\Documents\NFC Forum _ About the Forum.pdf
[2012.08.29 11:54:25 | 000,041,881 | ---- | C] () -- C:\Users\Jonas\Documents\Security-Interview_ Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheit2.pdf
[2012.08.29 11:53:48 | 000,041,879 | ---- | C] () -- C:\Users\Jonas\Documents\Security-Interview_ Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheitw.pdf
[2012.08.29 11:52:42 | 000,041,780 | ---- | C] () -- C:\Users\Jonas\Documents\Security-Interview_ Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheit.pdf
[2012.08.29 11:52:05 | 000,007,549 | ---- | C] () -- C:\Windows\SysNative\dopdf7.ctm
[2012.08.29 11:49:34 | 000,084,610 | ---- | C] () -- C:\Users\Jonas\Desktop\Axel Schmidt, Geschäftsführer, Salto Systems GmbH _ sicherheit.info.pdf
[2012.08.28 20:38:09 | 000,001,146 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.08.28 20:38:09 | 000,001,134 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.08.28 19:53:36 | 000,001,542 | ---- | C] () -- C:\Users\Jonas\Desktop\Firefox Boarderdeals.lnk
[2012.08.28 19:53:36 | 000,001,538 | ---- | C] () -- C:\Users\Jonas\Desktop\Firefox Kiddideals.lnk
[2012.08.28 19:53:36 | 000,001,536 | ---- | C] () -- C:\Users\Jonas\Desktop\Firefox DieTester.lnk
[2012.08.28 19:24:55 | 036,023,776 | ---- | C] () -- C:\Users\Jonas\Desktop\DSC09522.psd
[2012.08.28 14:21:57 | 000,078,998 | ---- | C] () -- C:\Users\Jonas\Desktop\volkszaehler.org - web frontend - Google Chrome_2012-08-28_14-21-07.png
[2012.08.28 11:53:54 | 000,001,998 | ---- | C] () -- C:\Users\Jonas\Desktop\Kindle.lnk
[2012.08.27 22:09:49 | 000,251,251 | ---- | C] () -- C:\Users\Jonas\Desktop\r.jpg
[2012.08.12 18:13:12 | 000,057,377 | ---- | C] () -- C:\Users\Jonas\Desktop\Bite Away Cobra Stichheiler für 19,95€–33% günstiger _EXKLUSIV_.pdf
[2012.08.08 23:09:09 | 000,873,253 | ---- | C] () -- C:\Users\Jonas\Desktop\IMG_20110318_135810.jpg
[2012.08.08 23:08:34 | 000,664,770 | ---- | C] () -- C:\Users\Jonas\Desktop\IMG_20110323_124053.jpg
[2012.08.08 23:07:23 | 000,807,216 | ---- | C] () -- C:\Users\Jonas\Desktop\IMG_20110323_134620.jpg
[2012.08.06 21:07:33 | 000,141,857 | ---- | C] () -- C:\Users\Jonas\Desktop\BA_Inf_TI_Studienverlaufsplan.pdf
[2012.08.06 15:10:18 | 000,250,107 | ---- | C] () -- C:\Users\Jonas\Desktop\f2.jpg
[2012.08.06 15:09:42 | 000,194,336 | ---- | C] () -- C:\Users\Jonas\Desktop\f1.jpg
[2012.08.05 19:40:03 | 000,024,674 | ---- | C] () -- C:\Users\Jonas\Desktop\NotificationView_2012-08-05_19-20-15.png
[2012.08.05 13:15:46 | 000,000,308 | ---- | C] () -- C:\Users\Jonas\Desktop\MetroTwit.appref-ms
[2012.08.05 12:08:36 | 000,000,783 | ---- | C] () -- C:\Users\Jonas\Desktop\Ablage - Verknüpfung.lnk
[2012.08.02 17:21:43 | 000,000,845 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Klok2.lnk
[2012.08.02 10:55:49 | 000,000,961 | ---- | C] () -- C:\Users\Jonas\Desktop\arduino - Verknüpfung.lnk
[2012.07.31 11:23:45 | 001,389,600 | ---- | C] () -- C:\Users\Jonas\cachercard_Rückseite.pdf
[2012.07.31 11:23:45 | 001,375,294 | ---- | C] () -- C:\Users\Jonas\cachercard_Vorderseite.pdf
[2012.07.29 10:52:33 | 000,007,601 | ---- | C] () -- C:\Users\Jonas\AppData\Local\Resmon.ResmonCfg
[2012.07.27 16:04:08 | 000,271,301 | ---- | C] () -- C:\Users\Jonas\m0_01.jpg
[2012.07.27 16:04:08 | 000,162,277 | ---- | C] () -- C:\Users\Jonas\fb5oben.jpg
[2012.07.23 15:03:42 | 000,000,173 | ---- | C] () -- C:\Users\Jonas\AppData\Local\msmathematics.qat.Jonas
[2012.07.22 22:28:27 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2012.07.22 22:28:27 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2012.07.22 22:28:27 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2012.07.22 22:28:27 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2012.07.22 22:28:27 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2012.07.22 15:44:15 | 000,001,158 | ---- | C] () -- C:\Users\Jonas\AppData\Roaming\ShiftN.ini
[2012.07.20 15:47:25 | 000,000,641 | ---- | C] () -- C:\Users\Jonas\Jonas - Verknüpfung.lnk
[2012.07.20 15:14:36 | 002,681,344 | ---- | C] () -- C:\Windows\SysWow64\dvmsg.dll
[2012.07.20 13:41:14 | 001,589,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.07.20 13:02:19 | 000,008,192 | R--- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
 
========== LOP Check ==========
 
[2012.07.22 15:32:41 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Arduino
[2012.07.21 17:29:37 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\ASCOMP Software
[2012.08.28 12:27:48 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\calibre
[2012.07.22 15:37:57 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Canneverbe Limited
[2012.07.22 22:31:15 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\DAEMON Tools Lite
[2012.08.31 16:11:36 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Dropbox
[2012.08.31 00:03:23 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\FileZilla
[2012.08.31 16:11:46 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\ICQ
[2012.07.22 15:51:28 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\IrfanView
[2012.08.02 17:21:44 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Klok2.DD7F2188B985C2439837C76B42A187050457E61B.1
[2012.08.05 13:29:28 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\MetroTwit
[2012.08.05 16:30:47 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Mobile Atlas Creator
[2012.07.22 23:08:15 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Notepad++
[2012.08.29 11:49:37 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\pdfforge
[2012.08.29 11:52:06 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Softland
[2012.08.30 16:56:13 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Spotify
[2012.08.06 14:59:45 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2012.07.20 14:44:51 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Thunderbird
[2012.07.20 15:15:40 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Tobit
[2012.07.20 15:32:51 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2012.07.20 15:41:55 | 000,000,000 | ---D | M] -- C:\Users\Jonas\AppData\Roaming\Windows Live Writer
[2012.08.28 22:39:27 | 000,017,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         
Extras
Code:
ATTFilter
OTL Extras logfile created on: 31.08.2012 16:12:34 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Jonas\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,68 Gb Available Physical Memory | 83,73% Memory free
15,96 Gb Paging File | 14,50 Gb Available in Paging File | 90,85% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 119,14 Gb Total Space | 52,37 Gb Free Space | 43,95% Space Free | Partition Type: NTFS
Drive D: | 931,50 Gb Total Space | 473,26 Gb Free Space | 50,81% Space Free | Partition Type: NTFS
Drive E: | 232,88 Gb Total Space | 174,60 Gb Free Space | 74,98% Space Free | Partition Type: NTFS
Drive H: | 377,40 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive S: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
Drive T: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
Drive U: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
Drive V: | 1829,35 Gb Total Space | 109,75 Gb Free Space | 6,00% Space Free | Partition Type: NTFS
 
Computer Name: JONASDESKTOP | User Name: Jonas | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- D:\Programme\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6DA19E18-F350-4D59-9B58-8DF3DF7D97E1}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{B47251A5-E34F-4EE4-8678-FBEEB78835FF}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1D796187-3C2A-476A-86CB-74FC1FD7FE25}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{2B757358-ED34-4CFB-97F5-ADC3EE4970CD}" = protocol=6 | dir=in | app=c:\program files (x86)\tobit radio.fx\server\rfx-server.exe | 
"{30CBCE2D-4AC8-43FE-B6D9-3D85789318F4}" = dir=in | app=c:\program files (x86)\microsoft garage\mouse without borders\mousewithoutborders.exe | 
"{31F8B342-34A8-4B35-9BC3-A881912ACB5B}" = protocol=6 | dir=in | app=c:\users\jonas\appdata\roaming\dropbox\bin\dropbox.exe | 
"{33A5803B-18D3-465D-9303-90AD9246A379}" = protocol=6 | dir=in | app=c:\users\jonas\appdata\roaming\spotify\spotify.exe | 
"{3DD22AFC-C8D2-44E4-AB3E-1CD90A24AAC7}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe | 
"{41A8E364-764C-4407-9012-91C92D6C7BF9}" = protocol=17 | dir=in | app=c:\program files (x86)\tobit radio.fx\server\rfx-server.exe | 
"{59589E1E-BDF5-47E2-AE83-FC972D7D32E5}" = protocol=17 | dir=in | app=c:\users\jonas\appdata\roaming\dropbox\bin\dropbox.exe | 
"{5B7880D8-FE8B-45C1-98FC-71B25DEF8354}" = protocol=17 | dir=in | app=c:\program files (x86)\tobit radio.fx\client\rfx-client.exe | 
"{70597AB4-587D-4F07-8B28-933C30C26724}" = protocol=6 | dir=in | app=c:\program files (x86)\tobit radio.fx\client\rfx-client.exe | 
"{7997807C-9978-4BF1-A489-ABC24ED9DE9E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{92825FEB-112D-4939-AE94-1A3F218F1AD4}" = protocol=17 | dir=in | app=c:\users\jonas\appdata\roaming\spotify\spotify.exe | 
"{92BA9B2C-9678-494B-9C77-26762122EE6B}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{96AF22AD-6277-48A0-8910-E6B69B31C4F8}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | 
"{97D05743-F91B-454B-B4E0-6E029DEF1FB4}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe | 
"{B4A45829-CF38-4D08-9B28-8E4322138388}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe | 
"{B93FED22-3741-4691-A49C-FB4736F104B8}" = protocol=17 | dir=in | app=c:\users\jonas\appdata\roaming\spotify\spotify.exe | 
"{CF9BAE31-1114-478F-A33A-2AE649C1187D}" = protocol=6 | dir=in | app=c:\users\jonas\appdata\roaming\spotify\spotify.exe | 
"{F9D30E0D-E1AD-47E8-BF3D-379CABAA4369}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{03AC245F-4C64-425C-89CF-7783C1D3AB2C}" = Microsoft Sync Framework 2.0 Provider Services (x64) ENU 
"{09782D89-1CA6-4B7D-82C5-2DE01AF5601B}" = Microsoft SQL Server 2008 Common Files
"{0ADF605D-2D94-4467-91F7-D75C71CF328D}" = Microsoft SQL Server 2008 Database Engine Shared
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5300_series" = Canon MG5300 series MP Drivers
"{11EB3D68-A5BE-43EA-8D31-43B08ADB0DA4}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x64) de
"{197B3774-B7E6-4D50-AD0D-7F99B1E264D2}" = Microsoft SQL Server System CLR Types (x64)
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1CB6C387-65A7-327F-B4A5-7DDC75A291AF}" = Microsoft Visual Studio 2010 Office Developer Tools (x64)
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{28D06854-572C-4A65-83E5-F8CAF26B9FDC}" = Microsoft SQL Server VSS Writer
"{2DF4C5DD-7417-301D-935D-939D3B7B5997}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{440668AA-7524-40DB-966A-60BE535E1B3F}" = Microsoft SQL Server 2008 Database Engine Services
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{47BA3A3A-6B4E-307F-A43B-724079FE90C6}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4EE61784-10C6-4B7C-A0B2-5BED17B05741}" = Oracle VM VirtualBox 4.1.18
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{53952792-BF16-300E-ADF2-E7E4367E00CF}" = Visual Studio 2010 Prerequisites - English
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6AF73222-EE90-434C-AE7E-B96F70A68D89}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup 
"{789C9644-9F82-44d3-B4CA-AC31F46F5883}" = Python 3.2.3 (64-bit)
"{7AC5FFA7-6815-4AED-B16D-8E0D7CC4B221}" = Microsoft Sync Framework Runtime v1.0 SP1 (x64) de
"{7ACE202B-1B01-4B43-B6AE-03D66D621CDE}" = Microsoft SQL Server 2008 RsFx Driver
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8325FD0C-2FDB-46C3-921A-3A78385EA972}" = Microsoft SQL Server 2008 Native Client
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8583E7E3-2237-4981-B957-E28E5E9AB678}" = Microsoft SQL Server 2008 R2 Management Objects (x64)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}" = Microsoft Sync Framework 2.0 Core Components (x64) ENU 
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95A2AD24-BD44-3E39-A31F-CE928276577E}" = Microsoft Visual C++ 2010  x64 Designtime - 10.0.30319
"{A1F50E06-E514-393D-AAEB-2F989F0B7C68}" = Microsoft Team Foundation Server 2010 Object Model - DEU
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 266.71
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 266.71
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.1.13.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{C3EAE456-7E7A-451F-80EF-F34C7A13C558}" = Microsoft SQL Server Compact 3.5 SP2 x64 DEU
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{E57B7E0A-8BE5-42E2-BE60-C07ED680A063}" = Microsoft Mathematics (64-bit)
"{E802A021-0F24-3484-97F7-D74D74CB93A0}" = Microsoft Visual Studio 2010 Office Developer Tools (x64) Language Pack - DEU
"{EF9A1373-9238-4E11-8FF8-7B83996F5BE5}" = Microsoft Sync Framework Services v1.0 SP1 (x64) de
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"doPDF 7 printer_is1" = doPDF 7.3 printer
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"Microsoft Team Foundation Server 2010 Object Model - DEU" = Microsoft Team Foundation Server 2010-Objektmodell - DEU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU
"VLC media player" = VLC media player 2.0.2
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0536BCDF-7EF6-48F6-8765-A3C065A065A5}" = Microsoft Expression Blend SDK for .NET 4
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{08DA8E46-ED67-451A-9246-50E0FF6959C9}" = Microsoft Sync Framework SDK v1.0 SP1 de
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0B49663C-B8DE-4F17-8B45-79CCC7E9FBBD}" = FOX LiveUpdate
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{166FCF01-AC98-4288-A01C-90BEB808C059}" = Sony RAW Driver
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2012098D-EEE9-4769-8DD3-B038050854D4}" = Microsoft Silverlight 3 SDK
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{27FF5F79-9C03-4FD7-966F-AA874B5FEB12}" = calibre
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{28F73A0D-D3F8-97C1-E932-E192EEEFDBD7}" = Klok 2
"{31C3C6EA-E991-405F-A3AA-2C070CCCC47C}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3FF8E8A7-5BA8-4D9E-B976-B05B2B00B0AE}" = Microsoft Expression Web 4
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}" = Dotfuscator Software Services - Community Edition
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{4D26B533-269B-4C01-B59E-80A6864824A5}" = Microsoft Expression Encoder 4
"{5242B252-01BB-4F2E-BBF4-5C01BC3B6619}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5EE6E987-1B79-4A93-832B-27472C7D1579}" = WPF Toolkit February 2010 (Version 3.5.50211.1)
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{626B3D60-A661-4444-AAF5-6C75E55936E8}" = Adobe Creative Suite 5 Production Premium
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{67B9AF41-C0B9-4960-84D9-A61D23DE85D8}" = Garmin Trip and Waypoint Manager v4
"{681F4E9F-34E0-36BD-BF2C-100554E403A5}" = Microsoft Visual F# 2.0 Runtime Language Pack - DEU
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6854A2CA-361F-4DD9-A8D8-C229E5EF4654}" = Fox DMI
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319
"{6B4788A3-C009-4327-89BE-04F26B8A0C8D}" = Schindlers PC-LATEIN
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}" = ICQ7M
"{7BEC151D-ADA9-3EA9-9273-99BA82881971}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{801B0DA3-A3FF-46CC-B97F-D76D510AF5AE}" = Microsoft Silverlight 4 SDK
"{81419AF6-6300-4123-AE84-1555ABB7A87E}" = FOX LOGO
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FD0F94D-4594-48A0-BE99-5265367603D8}" = Microsoft Expression Design 4
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.SingleImage_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch
"{92C5C058-E941-47C3-B7E8-38A79C605969}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C3B8582-A72A-4835-8903-877A834407BB}" = Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B006B9E9-41DD-4479-9177-3743A53B7735}" = Microsoft Expression Blend 3 SDK
"{B0682940-6FFB-4850-80BA-B2FEF0D64BA8}" = Microsoft Expression Blend SDK for Silverlight 4
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3F6EF04-8292-482D-9A2B-47CF5758C8FC}" = Microsoft Expression Studio 4
"{CAD6AA29-9CA1-384D-8034-566261CFCC9B}" = Microsoft Visual Studio 2010 Professional - DEU
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CE9BAD6E-60FC-46CC-82A2-5B0F2B1A0E36}" = Dotfuscator Software Services - Community Edition - DEU
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D3BC954F-D661-474C-B367-30EB6E56542E}" = Microsoft Garage Mouse without Borders
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU
"{EC66418E-DAA2-36D5-809E-40BEC94E622A}" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F21D2032-60FE-4729-9C87-46F1615FB965}" = Microsoft Expression Encoder 4 Screen Capture Codec
"{F5993FCC-DF5D-4879-B70D-AA1F379C5C6B}" = Microsoft Expression Web 4 Service Pack 2
"{F7800FC1-6948-4D64-A9BC-3EEDDA408D25}" = Microsoft Expression Blend 4
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FD895382-50E6-4F16-A725-00094DC30A14}" = FOX ONE
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon Kindle" = Amazon Kindle
"Avira AntiVir Desktop" = Avira Internet Security 2012
"Blend_4.0.20621.0" = Microsoft Expression Blend 4
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"CrystalDiskInfo_is1" = CrystalDiskInfo 5.0.0
"DAEMON Tools Lite" = DAEMON Tools Lite
"Design_7.0.20516.0" = Microsoft Expression Design 4
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.1 Home Edition
"Encoder_4.0.1651.0" = Microsoft Expression Encoder 4
"ESET Online Scanner" = ESET Online Scanner v3
"ExpressionStudio_4.0.20705.0" = Microsoft Expression Studio 4
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"IrfanView" = IrfanView (remove only)
"Klok2.DD7F2188B985C2439837C76B42A187050457E61B.1" = Klok 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft Visual Studio 2010 Professional - DEU" = Microsoft Visual Studio 2010 Professional - DEU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Studio Macro Tools - DEU Language Pack" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"Mozilla Thunderbird 15.0 (x86 de)" = Mozilla Thunderbird 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Picasa 3" = Picasa 3
"Precision" = EVGA Precision 2.0.2
"SSD Fresh_is1" = SSD Fresh
"Synchredible_is1" = Synchredible v4.0
"Tobit Radio.fx Server" = Radio.fx
"Web_4.0.1303.0" = Microsoft Expression Web 4
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"eec89cd0692c9aed" = MetroTwit
"Google Chrome" = Google Chrome
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 28.08.2012 13:02:42 | Computer Name = JonasDesktop | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 14.0.1.4577 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 183c    Startzeit:
 01cd853b3b616ab5    Endzeit: 58    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 2c1b8739-f132-11e1-a82e-d0278863fd78  
 
Error - 28.08.2012 13:03:52 | Computer Name = JonasDesktop | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 14.0.1.4577 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 2d74    Startzeit:
 01cd853ef2d193ef    Endzeit: 40    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 56624a71-f132-11e1-a82e-d0278863fd78  
 
Error - 28.08.2012 13:51:44 | Computer Name = JonasDesktop | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 14.0.1.4577 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 17f0    Startzeit:
 01cd85431622faea    Endzeit: 79    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 05422c80-f139-11e1-a82e-d0278863fd78  
 
Error - 28.08.2012 15:42:57 | Computer Name = JonasDesktop | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 15.0.0.4619 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 544    Startzeit: 
01cd8554f1b49680    Endzeit: 44    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 8f183db3-f148-11e1-a82e-d0278863fd78  
 
Error - 28.08.2012 16:55:23 | Computer Name = JonasDesktop | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "D:\Daten2\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 28.08.2012 17:24:49 | Computer Name = JonasDesktop | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "D:\Daten2\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 30.08.2012 11:31:24 | Computer Name = JonasDesktop | Source = MsiInstaller | ID = 11706
Description = 
 
Error - 30.08.2012 11:31:41 | Computer Name = JonasDesktop | Source = MsiInstaller | ID = 11706
Description = 
 
Error - 30.08.2012 18:37:20 | Computer Name = JonasDesktop | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 15.0.0.4619 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 6b70    Startzeit:
 01cd86be75de72cd    Endzeit: 83    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 40492b02-f2f3-11e1-8005-d0278863fd78  
 
Error - 31.08.2012 02:54:11 | Computer Name = JonasDesktop | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 15.0.0.4619 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1620    Startzeit:
 01cd87455b49edfd    Endzeit: 27    Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID:
 a9adf3f0-f338-11e1-b14d-d0278863fd78  
 
[ System Events ]
Error - 31.08.2012 02:35:31 | Computer Name = JonasDesktop | Source = DCOM | ID = 10016
Description = 
 
Error - 31.08.2012 02:36:21 | Computer Name = JonasDesktop | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 31.08.2012 02:54:09 | Computer Name = JonasDesktop | Source = DCOM | ID = 10016
Description = 
 
Error - 31.08.2012 02:55:11 | Computer Name = JonasDesktop | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 31.08.2012 05:32:00 | Computer Name = JonasDesktop | Source = DCOM | ID = 10016
Description = 
 
Error - 31.08.2012 05:33:04 | Computer Name = JonasDesktop | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 31.08.2012 05:59:38 | Computer Name = JonasDesktop | Source = DCOM | ID = 10016
Description = 
 
Error - 31.08.2012 06:00:40 | Computer Name = JonasDesktop | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
Error - 31.08.2012 10:12:25 | Computer Name = JonasDesktop | Source = DCOM | ID = 10016
Description = 
 
Error - 31.08.2012 10:13:27 | Computer Name = JonasDesktop | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:   %%2
 
 
< End of report >
         
Und hier noch die Malwarebyte Logs:

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.31.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonas :: JONASDESKTOP [Administrator]

Schutz: Aktiviert

31.08.2012 11:56:23
mbam-log-2012-08-31 (11-56-23).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 196736
Laufzeit: 1 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Users\Jonas\AppData\Local\Temp\ROPER0DUN.EXE (Trojan.Ransom) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Jonas\AppData\Local\Temp\ROPER0DUN.EXE (Trojan.Ransom) -> Löschen bei Neustart.
C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.31.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonas :: JONASDESKTOP [Administrator]

Schutz: Aktiviert

31.08.2012 12:03:54
mbam-log-2012-08-31 (12-03-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|I:\|T:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 726936
Laufzeit: 3 Stunde(n), 6 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\39347aac-4fbf89e4 (Trojan.Ransom) -> Erfolgreich gelöscht und in Quarantäne gestellt.
I:\Jonas\AppData\Local\Temp\roper0dun.exe (Trojan.Ransom) -> Erfolgreich gelöscht und in Quarantäne gestellt.
I:\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\39347aac-4fbf89e4 (Trojan.Ransom) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         
Vielen Dank schon einmal für Eure Hilfe!

Alt 31.08.2012, 16:19   #2
t'john
/// Helfer-Team
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?





Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
ATTFilter
:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKCU\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\Users\\Jonas\\AppData\\Local\\Temp\\proxtube.pac" 
FF - prefs.js..network.proxy.http: "localhost" 
FF - prefs.js..network.proxy.http_port: 9666 
FF - prefs.js..network.proxy.socks: "localhost" 
FF - prefs.js..network.proxy.socks_port: 9050 
FF - prefs.js..network.proxy.socks_remote_dns: true 
FF - prefs.js..network.proxy.ssl: "localhost" 
FF - prefs.js..network.proxy.ssl_port: 9666 
FF - prefs.js..network.proxy.type: 0 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found 
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll File not found 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found 
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found 
O4 - HKCU..\Run: [AdobeBridge] File not found 
O4 - HKCU..\Run: [EDO-Soft Sticky Notes] C:\Program Files (x86)\Evernote Sticky Notes\StickyNotes.Wpf.exe File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found 
O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\Microsoft Office\Office14\ONBttnIE.dll/105 File not found 
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\Microsoft Office\Office14\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\Microsoft Office\Office14\ONBttnIE.dll/105 File not found 
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\Microsoft Office\Office14\EXCEL.EXE/3000 File not found 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 

[2012.08.31 11:31:15 | 083,023,306 | ---- | M] () -- C:\ProgramData\nud0repor.pad 

:Files

C:\Users\Jonas\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Jonas\AppData\Local\Temp\*.exe
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
%SystemRoot%\System32\*.tmp
%SystemRoot%\SysWOW64\*.tmp
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

3. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.



4. Schritt
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.
__________________

__________________

Alt 31.08.2012, 18:36   #3
user154
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Moin, erstmal ein rieeeßen für diesen TOP Service hier

Ich habe die Anleitung soweit abgearbeitet:

1. OTL
Code:
ATTFilter
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "file:///C:\\Users\\Jonas\\AppData\\Local\\Temp\\proxtube.pac" removed from network.proxy.autoconfig_url
Prefs.js: "localhost" removed from network.proxy.http
Prefs.js: 9666 removed from network.proxy.http_port
Prefs.js: "localhost" removed from network.proxy.socks
Prefs.js: 9050 removed from network.proxy.socks_port
Prefs.js: true removed from network.proxy.socks_remote_dns
Prefs.js: "localhost" removed from network.proxy.ssl
Prefs.js: 9666 removed from network.proxy.ssl_port
Prefs.js: 0 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EDO-Soft Sticky Notes deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Add to Google Photos Screensa&ver\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote s&enden\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xcel exportieren\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\An OneNote s&enden\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft E&xcel exportieren\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\ProgramData\nud0repor.pad moved successfully.
========== FILES ==========
C:\Users\Jonas\AppData\Local\{015B02CE-1CE5-4775-A243-FA136396EFCD} folder moved successfully.
C:\Users\Jonas\AppData\Local\{05FD327B-F65E-4CB0-90CB-F8850748880B} folder moved successfully.
C:\Users\Jonas\AppData\Local\{0606CCBC-64A8-43DB-A8BB-ABA0A0F1DCE5} folder moved successfully.
C:\Users\Jonas\AppData\Local\{0804B4C8-87A2-4B71-8B8B-077687BD6547} folder moved successfully.
C:\Users\Jonas\AppData\Local\{0996F430-C371-42DC-8C52-C863D48B60BF} folder moved successfully.
C:\Users\Jonas\AppData\Local\{09AE1C81-5318-4FB5-BC37-12D2920DDF4A} folder moved successfully.
C:\Users\Jonas\AppData\Local\{113577F8-4CEB-4EBD-8EFD-D2E2AA64B254} folder moved successfully.
C:\Users\Jonas\AppData\Local\{15810115-4A18-4BEA-A07C-BEF8C53AA7C8} folder moved successfully.
C:\Users\Jonas\AppData\Local\{1A03E34A-D523-49B7-8B9D-4E37B14734E7} folder moved successfully.
C:\Users\Jonas\AppData\Local\{20D0F74F-596D-4BA6-9B02-B04DE9990771} folder moved successfully.
C:\Users\Jonas\AppData\Local\{20E985BF-DC13-4536-AF23-D8BC4002D144} folder moved successfully.
C:\Users\Jonas\AppData\Local\{2714F040-DD0F-4294-A6EB-EDB81CB51BF7} folder moved successfully.
C:\Users\Jonas\AppData\Local\{2BF0C356-12F7-4B8C-B3D8-022C2EA24DE7} folder moved successfully.
C:\Users\Jonas\AppData\Local\{2ED1AFF1-FB5F-4FB0-9F07-DE395714B050} folder moved successfully.
C:\Users\Jonas\AppData\Local\{34DBF5EC-C3F2-4565-9723-8B50C72AA52D} folder moved successfully.
C:\Users\Jonas\AppData\Local\{3752D84D-043E-44C5-835F-2938CA5E938D} folder moved successfully.
C:\Users\Jonas\AppData\Local\{3760B608-7411-4856-BD7C-F82C5F177C62} folder moved successfully.
C:\Users\Jonas\AppData\Local\{3C8B103B-7BDB-4C0F-9F35-F5CCC8986AE8} folder moved successfully.
C:\Users\Jonas\AppData\Local\{40D72B1D-64AA-4B93-9B92-4162B0B3CD0F} folder moved successfully.
C:\Users\Jonas\AppData\Local\{41650DF7-6EBB-4738-A7B4-2D32925E6017} folder moved successfully.
C:\Users\Jonas\AppData\Local\{4611DFC8-32B9-48B0-92DD-52E35E486226} folder moved successfully.
C:\Users\Jonas\AppData\Local\{4F3873B7-D6E6-47A4-A97A-75E201B4B595} folder moved successfully.
C:\Users\Jonas\AppData\Local\{6094402A-AAA6-422D-BDBF-3716ED5028F5} folder moved successfully.
C:\Users\Jonas\AppData\Local\{6940EA01-92D9-41E2-9A64-8E7792E072B9} folder moved successfully.
C:\Users\Jonas\AppData\Local\{71A57F2C-FD8D-481E-948F-AADAD9B0BE9B} folder moved successfully.
C:\Users\Jonas\AppData\Local\{723B8E45-57D8-4F7B-9087-D54DE86F9CF1} folder moved successfully.
C:\Users\Jonas\AppData\Local\{743C5480-3509-4E47-9686-00F55EB58197} folder moved successfully.
C:\Users\Jonas\AppData\Local\{7674999A-1E5A-4026-9617-7E9F01C9EBB0} folder moved successfully.
C:\Users\Jonas\AppData\Local\{7709E1BF-D2B7-41A4-BD0F-5F7DDE15ABC8} folder moved successfully.
C:\Users\Jonas\AppData\Local\{77642D08-277E-4AED-8265-BBB786308136} folder moved successfully.
C:\Users\Jonas\AppData\Local\{7D0A8C8D-8CB6-4318-AAF1-84D3D36D23DF} folder moved successfully.
C:\Users\Jonas\AppData\Local\{7DEA4DDA-95EB-49BA-8D59-417A25777AC1} folder moved successfully.
C:\Users\Jonas\AppData\Local\{7FFC4822-E43A-4D0F-B2D5-039E26D5D682} folder moved successfully.
C:\Users\Jonas\AppData\Local\{81B84E83-6EB1-4D62-A25F-B9AAADAEA8D3} folder moved successfully.
C:\Users\Jonas\AppData\Local\{841556EE-3CDF-4754-95C8-98127752CEAE} folder moved successfully.
C:\Users\Jonas\AppData\Local\{84D0C9DC-4343-4F93-BDCA-E95DFA387C98} folder moved successfully.
C:\Users\Jonas\AppData\Local\{8E429753-ECCC-4D72-9AFA-3A451B01C4E0} folder moved successfully.
C:\Users\Jonas\AppData\Local\{961B440C-0A43-40F0-82BE-11F846E56583} folder moved successfully.
C:\Users\Jonas\AppData\Local\{9809F4E7-A863-496C-9D7F-0C4FAA88F994} folder moved successfully.
C:\Users\Jonas\AppData\Local\{9CFB24D6-3C89-4446-80F1-7794CF906FFC} folder moved successfully.
C:\Users\Jonas\AppData\Local\{A55A4F0D-9950-4E08-8381-59E27B725119} folder moved successfully.
C:\Users\Jonas\AppData\Local\{A86C8488-C927-49D9-A6D0-46A6DDAA4892} folder moved successfully.
C:\Users\Jonas\AppData\Local\{AAAF1E27-5DED-4B91-B82B-F7744A19511A} folder moved successfully.
C:\Users\Jonas\AppData\Local\{AE40D882-2D66-4BA6-AB46-BE0FB5F9C597} folder moved successfully.
C:\Users\Jonas\AppData\Local\{B0051270-285C-43B7-8B52-078DD023F83D} folder moved successfully.
C:\Users\Jonas\AppData\Local\{B26AED9F-B158-4879-A331-510A801A2CD1} folder moved successfully.
C:\Users\Jonas\AppData\Local\{BB0CB9A3-83FE-4010-A93D-9B37B9B0D4E0} folder moved successfully.
C:\Users\Jonas\AppData\Local\{BB28D544-07A0-4573-B613-A034CD536404} folder moved successfully.
C:\Users\Jonas\AppData\Local\{BC68062A-6562-4BD2-B72B-27D1296CE002} folder moved successfully.
C:\Users\Jonas\AppData\Local\{BEA80F0D-CEF4-40B7-898F-7989555B8774} folder moved successfully.
C:\Users\Jonas\AppData\Local\{C6AF6D4A-3173-4005-9632-3CB1B64C39A7} folder moved successfully.
C:\Users\Jonas\AppData\Local\{D834CB4F-D1AD-4DE9-B876-D5593884AB7B} folder moved successfully.
C:\Users\Jonas\AppData\Local\{D9FF6F02-7C28-422D-895A-CD75C5DE4F0F} folder moved successfully.
C:\Users\Jonas\AppData\Local\{E180C4F5-A404-42E2-A158-24B7D94A60DB} folder moved successfully.
C:\Users\Jonas\AppData\Local\{E19CCA3A-9A41-4A97-B568-D2E41C5F2AC1} folder moved successfully.
C:\Users\Jonas\AppData\Local\{E26F7DC2-40FA-4896-875F-3511458B3BAB} folder moved successfully.
C:\Users\Jonas\AppData\Local\{E7EBDADF-3B1C-4338-B1D7-097DD472F1BF} folder moved successfully.
C:\Users\Jonas\AppData\Local\{EBCD400F-60F7-44D1-B1DB-43C8000C1A50} folder moved successfully.
C:\Users\Jonas\AppData\Local\{ECE496EB-0C12-4561-A6D6-294C0223FFB0} folder moved successfully.
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\TEMP not found.
C:\Users\Jonas\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
File/Folder C:\Windows\System32\*.tmp not found.
File/Folder C:\Windows\SysWOW64\*.tmp not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Jonas\Desktop\cmd.bat deleted successfully.
C:\Users\Jonas\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56504 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Jonas
->Temp folder emptied: 988923 bytes
->Temporary Internet Files folder emptied: 273857705 bytes
->FireFox cache emptied: 843240818 bytes
->Google Chrome cache emptied: 146172213 bytes
->Flash cache emptied: 139580 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 158218146 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46396283 bytes
RecycleBin emptied: 2644940983 bytes
 
Total Files Cleaned = 3.923,00 mb
 
 
OTL by OldTimer - Version 3.2.59.1 log created on 08312012_172211

Files\Folders moved on Reboot...
C:\Users\Jonas\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         
2. Malwarebytes

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.31.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Jonas :: JONASDESKTOP [Administrator]

Schutz: Aktiviert

31.08.2012 17:28:29
mbam-log-2012-08-31 (17-28-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 644474
Laufzeit: 1 Stunde(n), 57 Minute(n), 7 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
3. AdwCleaner Search

Code:
ATTFilter
# AdwCleaner v2.000 - Datei am 08/31/2012 um 19:27:33 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Jonas - JONASDESKTOP
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Jonas\Desktop\adwcleaner(1).exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\Users\Jonas\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v15.0 (de)

Profilname : default [Profil par défaut]
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : Outdoordeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0juducq7.Outdoordeals\prefs.js

[OK] Die Datei ist sauber.

Profilname : Survivaldeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\xg5ibzne.Survivaldeals\prefs.js

[OK] Die Datei ist sauber.

Profilname : Raddeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\x16iw5jk.Raddeals\prefs.js

[OK] Die Datei ist sauber.

Profilname : WSeminar 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0xelmwvm.WSeminar\prefs.js

[OK] Die Datei ist sauber.

Profilname : DieTester 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\2p1n40z9.DieTester.eu\prefs.js

[OK] Die Datei ist sauber.

Profilname : Kiddideals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\jb7bzk4g.Kiddideals\prefs.js

[OK] Die Datei ist sauber.

Profilname : Boarderdeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ykl69wkl.Boarderdeals.\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v21.0.1180.83

Datei : C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [38813 octets] - [28/08/2012 23:02:21]
AdwCleaner[S1].txt - [38903 octets] - [28/08/2012 23:02:44]
AdwCleaner[R2].txt - [2177 octets] - [31/08/2012 19:27:33]

########## EOF - C:\AdwCleaner[R2].txt - [2237 octets] ##########
         
4. AdwCleaner Delete

Code:
ATTFilter
# AdwCleaner v2.000 - Datei am 08/31/2012 um 19:29:21 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Jonas - JONASDESKTOP
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Jonas\Desktop\adwcleaner(1).exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Users\Jonas\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0 (de)

Profilname : default [Profil par défaut]
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : Outdoordeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0juducq7.Outdoordeals\prefs.js

[OK] Die Datei ist sauber.

Profilname : Survivaldeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\xg5ibzne.Survivaldeals\prefs.js

[OK] Die Datei ist sauber.

Profilname : Raddeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\x16iw5jk.Raddeals\prefs.js

[OK] Die Datei ist sauber.

Profilname : WSeminar 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0xelmwvm.WSeminar\prefs.js

[OK] Die Datei ist sauber.

Profilname : DieTester 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\2p1n40z9.DieTester.eu\prefs.js

[OK] Die Datei ist sauber.

Profilname : Kiddideals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\jb7bzk4g.Kiddideals\prefs.js

[OK] Die Datei ist sauber.

Profilname : Boarderdeals 
Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ykl69wkl.Boarderdeals.\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v21.0.1180.83

Datei : C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [38813 octets] - [28/08/2012 23:02:21]
AdwCleaner[S1].txt - [38903 octets] - [28/08/2012 23:02:44]
AdwCleaner[R2].txt - [2306 octets] - [31/08/2012 19:27:33]
AdwCleaner[S2].txt - [2896 octets] - [31/08/2012 19:29:21]

########## EOF - C:\AdwCleaner[S2].txt - [2956 octets] ##########
         
__________________

Alt 01.09.2012, 00:04   #4
t'john
/// Helfer-Team
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Sehr gut!

Wie laeuft der Rechner?

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
Mfg, t'john
Das TB unterstützen

Alt 01.09.2012, 11:16   #5
user154
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Moin,

ja der Rechner läuft ausgezeichnet wieder,

Anti-Malware hat auch "nur" irgendwelche Altlasten gefunden:

Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 01.09.2012 10:22:10

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	01.09.2012 10:22:34

D:\Datenold\Jonas\Desktop\sicherungusb4\Data\miranda-im-v0.9.32-unicode.exe 	gefunden: Trojan-Clicker.Win32.NSIS!E1

Gescannt	905044
Gefunden	1

Scan Ende:	01.09.2012 12:06:42
Scan Zeit:	1:44:08
         
Ich habe aber, wie nach der Anleitung, noch nichts gelöscht.


Alt 02.09.2012, 05:40   #6
t'john
/// Helfer-Team
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Wo ist AdwCleaner[S1].txt?


Sehr gut!

Lasse die Funde in Quarantaene verschieben, dann:

Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
--> GVU Trojaner mit Malwarebyte entfernt, aber vollständig?

Alt 02.09.2012, 10:57   #7
user154
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Hier:

Code:
ATTFilter
# AdwCleaner v1.801 - Logfile created 08/28/2012 at 23:02:44
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Jonas - JONASDESKTOP
# Boot Mode : Normal
# Running from : D:\Daten2\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : Web Assistant Updater

***** [Files / Folders] *****

Folder Deleted : C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Folder Deleted : C:\Users\Jonas\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\Conduit
Folder Deleted : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\ConduitEngine
Folder Deleted : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\CT2431245
Folder Deleted : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
Folder Deleted : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\extensions\engine@conduit.com
Folder Deleted : C:\Program Files\Web Assistant
File Deleted : C:\user.js

***** [Registry] *****

Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Key Deleted : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Web Assistant
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]
[x64] Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
[x64] Key Deleted : HKLM\SOFTWARE\Web Assistant

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403a-B9D2-65C292C39087}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{22B0769F-794B-4422-AC84-47B123C8986D}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{255E0B2A-D747-4EEF-B7CE-159D73A3656D}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{28ED590D-F5ED-4E05-A87F-1D759F1C6169}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{45D5B93F-E2ED-4AF2-915E-DCDDBDA8C33C}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{771B99AB-636F-4A11-9039-8DFEB927B061}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A8321AA2-2227-40C7-8525-6C2F4E1B0EBE}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AA41A731-6814-4A70-A6F1-C0A20FBBFBD5}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ABBB8A9E-D8AF-40D1-94BE-5175077465FC}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BF737694-56F6-46FA-9FDC-FA99A5B25FAD}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CFCD164E-8AC9-478E-9ECC-B616A932016C}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D5961CC0-B442-4567-8030-67E241EF4CC2}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E450067F-1C93-41A7-928E-07E5C2EEC680}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F977D9F2-4BDC-44A6-B508-7C0284C61EED}
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://mystart.incredibar.com/mb155?a=6R8DrlofCo&i=26 --> hxxp://www.google.com

-\\ Mozilla Firefox v15.0 (de)

Profile name : default [Profil par défaut]
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\prefs.js

C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\s1itmmrk.default\user.js ... Deleted !

Deleted : user_pref("CT2431245.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2431245.CTID", "CT2431245");
Deleted : user_pref("CT2431245.CurrentServerDate", "21-4-2010");
Deleted : user_pref("CT2431245.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2431245.EMailNotifierPollDate", "Wed Apr 21 2010 19:24:52 GMT+0200");
Deleted : user_pref("CT2431245.FeedLastCount129009402595187825", 501);
Deleted : user_pref("CT2431245.FeedPollDate7470634014180506963", "Wed Apr 21 2010 18:59:51 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634014269327586", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634014329599698", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634014537505092", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634014970726540", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634015410831318", "Wed Apr 21 2010 18:59:52 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634015483395460", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634015636754705", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634015768347545", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634015855543602", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634016030710453", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634016114705611", "Wed Apr 21 2010 18:59:51 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634016129205152", "Wed Apr 21 2010 18:59:51 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634016143724791", "Wed Apr 21 2010 18:59:52 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634016271239162", "Wed Apr 21 2010 18:59:52 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634016568520719", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634016726993788", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017109031809", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017132743740", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017299547668", "Wed Apr 21 2010 18:59:51 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017302327846", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017344111490", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017478360748", "Wed Apr 21 2010 18:59:52 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017732797593", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634017821686064", "Wed Apr 21 2010 18:59:52 GMT+0200");
Deleted : user_pref("CT2431245.FeedPollDate7470634018090228721", "Wed Apr 21 2010 18:59:51 GMT+0200");
Deleted : user_pref("CT2431245.FeedTTL7470634014269327586", 5);
Deleted : user_pref("CT2431245.FeedTTL7470634014537505092", 5);
Deleted : user_pref("CT2431245.FeedTTL7470634015636754705", 5);
Deleted : user_pref("CT2431245.FeedTTL7470634016568520719", 30);
Deleted : user_pref("CT2431245.FirstServerDate", "21-4-2010");
Deleted : user_pref("CT2431245.FirstTime", true);
Deleted : user_pref("CT2431245.FirstTimeFF3", true);
Deleted : user_pref("CT2431245.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2431245.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2431245.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2431245.Initialize", true);
Deleted : user_pref("CT2431245.InitializeCommonPrefs", true);
Deleted : user_pref("CT2431245.InstalledDate", "Wed Apr 21 2010 18:59:47 GMT+0200");
Deleted : user_pref("CT2431245.InvalidateCache", false);
Deleted : user_pref("CT2431245.IsGrouping", false);
Deleted : user_pref("CT2431245.IsMulticommunity", false);
Deleted : user_pref("CT2431245.IsOpenThankYouPage", false);
Deleted : user_pref("CT2431245.IsOpenUninstallPage", true);
Deleted : user_pref("CT2431245.LanguagePackLastCheckTime", "Wed Apr 21 2010 18:59:58 GMT+0200");
Deleted : user_pref("CT2431245.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2431245.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2431245.LastLogin_2.5.8.6", "Wed Apr 21 2010 18:59:49 GMT+0200");
Deleted : user_pref("CT2431245.LatestVersion", "2.1.0.18");
Deleted : user_pref("CT2431245.Locale", "de-de");
Deleted : user_pref("CT2431245.LoginCache", 4);
Deleted : user_pref("CT2431245.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2431245.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2431245.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2431245.RadioIsPodcast", false);
Deleted : user_pref("CT2431245.RadioLastCheckTime", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT2431245.RadioLastUpdateServer", "3");
Deleted : user_pref("CT2431245.RadioMediaID", "9962");
Deleted : user_pref("CT2431245.RadioMediaType", "Media Player");
Deleted : user_pref("CT2431245.RadioMenuSelectedID", "EBRadioMenu_CT24312459962");
Deleted : user_pref("CT2431245.RadioStationName", "California%20Rock");
Deleted : user_pref("CT2431245.RadioStationURL", "hxxp://feedlive.net/california.asx");
Deleted : user_pref("CT2431245.SHRINK_TOOLBAR", 1);
Deleted : user_pref("CT2431245.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2431245.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT243[...]
Deleted : user_pref("CT2431245.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2431245.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2431245.SearchInNewTabLastCheckTime", "Wed Apr 21 2010 18:59:50 GMT+0200");
Deleted : user_pref("CT2431245.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2431245.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Deleted : user_pref("CT2431245.SearchInNewTabUserEnabled", false);
Deleted : user_pref("CT2431245.SettingsCheckIntervalMin", 120);
Deleted : user_pref("CT2431245.SettingsLastCheckTime", "Wed Apr 21 2010 18:59:45 GMT+0200");
Deleted : user_pref("CT2431245.SettingsLastUpdate", "1271839082");
Deleted : user_pref("CT2431245.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2431245.ThirdPartyComponentsLastCheck", "Wed Apr 21 2010 18:59:44 GMT+0200");
Deleted : user_pref("CT2431245.ThirdPartyComponentsLastUpdate", "1265977679");
Deleted : user_pref("CT2431245.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Deleted : user_pref("CT2431245.UserID", "UN28628238243573856");
Deleted : user_pref("CT2431245.ValidationData_Toolbar", 2);
Deleted : user_pref("CT2431245.WeatherNetwork", "");
Deleted : user_pref("CT2431245.WeatherPollDate", "Wed Apr 21 2010 18:59:53 GMT+0200");
Deleted : user_pref("CT2431245.WeatherUnit", "C");
Deleted : user_pref("CT2431245.alertChannelId", "825452");
Deleted : user_pref("CT2431245.clientLogIsEnabled", false);
Deleted : user_pref("CT2431245.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Deleted : user_pref("CT2431245.myStuffEnabled", true);
Deleted : user_pref("CT2431245.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2431245.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2431245.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2431245.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2431245.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1248439/1244112/DE", "\"0\"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2856415", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.0[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2856415",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=12/30/2[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2856415/CT2856415[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"634[...]
Deleted : user_pref("CommunityToolbar.EngineHiddenByUser", true);
Deleted : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");
Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "engine@conduit.com");
Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");
Deleted : user_pref("CommunityToolbar.IsEngineShown", false);
Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2856415");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{22e03916-85c5-44b0-8dc9-1830c11238d9}");
Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "elf_1");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2431245,ConduitEngine");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2431245");
Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Sat Nov 19 2011 09:55:55 GMT+01[...]
Deleted : user_pref("CommunityToolbar.alert.alertEnabled", false);
Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 60);
Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Sat Jan 01 2011 18:48:33 GMT+0100");
Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.locale", "en");
Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Thu Jun 07 2012 23:26:09 GMT+0200");
Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.alert.userId", "545c3e0c-e64c-4fe5-80d2-e7e65e91a750");
Deleted : user_pref("CommunityToolbar.globalUserId", "f18c7c08-987f-48f9-9147-07a4b0a051b6");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Thu Jun 07 2012 10:42:54 GMT+0200");
Deleted : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Fri Nov 18 2011 21:20:34 GMT+0100");
Deleted : user_pref("ConduitEngine.FirstServerDate", "01/01/2011 20");
Deleted : user_pref("ConduitEngine.FirstTime", true);
Deleted : user_pref("ConduitEngine.FirstTimeFF3", true);
Deleted : user_pref("ConduitEngine.HasUserGlobalKeys", true);
Deleted : user_pref("ConduitEngine.HideEngineAfterRestart", false);
Deleted : user_pref("ConduitEngine.Initialize", true);
Deleted : user_pref("ConduitEngine.InitializeCommonPrefs", true);
Deleted : user_pref("ConduitEngine.InstalledDate", "Sat Jan 01 2011 18:48:26 GMT+0100");
Deleted : user_pref("ConduitEngine.IsMulticommunity", false);
Deleted : user_pref("ConduitEngine.IsOpenThankYouPage", false);
Deleted : user_pref("ConduitEngine.IsOpenUninstallPage", true);
Deleted : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Fri Nov 18 2011 21:20:34 GMT+0100");
Deleted : user_pref("ConduitEngine.LastLogin_3.3.0.19", "Sat Jan 01 2011 18:48:27 GMT+0100");
Deleted : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Fri Nov 18 2011 21:20:35 GMT+0100");
Deleted : user_pref("ConduitEngine.PublisherContainerWidth", 0);
Deleted : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
Deleted : user_pref("ConduitEngine.SettingsLastCheckTime", "Fri Nov 18 2011 21:20:35 GMT+0100");
Deleted : user_pref("ConduitEngine.UserID", "UN85759779785385656");
Deleted : user_pref("ConduitEngine.approveUntrustedApps", true);
Deleted : user_pref("ConduitEngine.componentAlertEnabled", false);
Deleted : user_pref("ConduitEngine.engineLocale", "de");
Deleted : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Fri Nov 18 2011 21:20:34 GMT+0100");
Deleted : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Fri Nov 18 2011 21:20:35 GMT+0100");
Deleted : user_pref("ConduitEngine.initDone", true);
Deleted : user_pref("ConduitEngine.isAppTrackingManagerOn", true);
Deleted : user_pref("ConduitEngine.isDetectionEnabled", false);
Deleted : user_pref("ConduitEngine.usageEnabled", false);
Deleted : user_pref("ConduitEngine.usagesFlag", 2);
Deleted : user_pref("browser.newtab.url", "hxxp://mystart.incredibar.com/mb155?a=6R8DrlofCo&loc=FF_NT");
Deleted : user_pref("browser.search.defaultenginename", "MyStart Search");
Deleted : user_pref("browser.search.selectedEngine", "MyStart Search");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10657");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15580");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8DrlofCo&loc=IB[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

Profile name : Outdoordeals 
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0juducq7.Outdoordeals\prefs.js

C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0juducq7.Outdoordeals\user.js ... Deleted !

Deleted : user_pref("extensions.ffxtlbr@incredibar.com.install-event-fired", true);
Deleted : user_pref("extensions.incredibar.admin", false);
Deleted : user_pref("extensions.incredibar.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar.cntry", "DE");
Deleted : user_pref("extensions.incredibar.dfltLng", "");
Deleted : user_pref("extensions.incredibar.dfltSrch", false);
Deleted : user_pref("extensions.incredibar.did", "10657");
Deleted : user_pref("extensions.incredibar.envrmnt", "production");
Deleted : user_pref("extensions.incredibar.excTlbr", false);
Deleted : user_pref("extensions.incredibar.hdrMd5", "3CF91A8A67DB3CFB29E12F357B2F21B2");
Deleted : user_pref("extensions.incredibar.hmpg", false);
Deleted : user_pref("extensions.incredibar.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar.installerproductid", "26");
Deleted : user_pref("extensions.incredibar.instlDay", "15580");
Deleted : user_pref("extensions.incredibar.instlRef", "");
Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true);
Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Deleted : user_pref("extensions.incredibar.newTab", false);
Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);
Deleted : user_pref("extensions.incredibar.ppd", "");
Deleted : user_pref("extensions.incredibar.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar.productid", "26");
Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar.sg", "none");
Deleted : user_pref("extensions.incredibar.smplGrp", "none");
Deleted : user_pref("extensions.incredibar.tlbrId", "base");
Deleted : user_pref("extensions.incredibar.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10657");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15580");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

Profile name : Survivaldeals 
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\xg5ibzne.Survivaldeals\prefs.js

C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\xg5ibzne.Survivaldeals\user.js ... Deleted !

Deleted : user_pref("extensions.ffxtlbr@incredibar.com.install-event-fired", true);
Deleted : user_pref("extensions.incredibar.admin", false);
Deleted : user_pref("extensions.incredibar.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar.cntry", "DE");
Deleted : user_pref("extensions.incredibar.dfltLng", "");
Deleted : user_pref("extensions.incredibar.dfltSrch", false);
Deleted : user_pref("extensions.incredibar.did", "10657");
Deleted : user_pref("extensions.incredibar.envrmnt", "production");
Deleted : user_pref("extensions.incredibar.excTlbr", false);
Deleted : user_pref("extensions.incredibar.hdrMd5", "3CF91A8A67DB3CFB29E12F357B2F21B2");
Deleted : user_pref("extensions.incredibar.hmpg", false);
Deleted : user_pref("extensions.incredibar.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar.installerproductid", "26");
Deleted : user_pref("extensions.incredibar.instlDay", "15580");
Deleted : user_pref("extensions.incredibar.instlRef", "");
Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true);
Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Deleted : user_pref("extensions.incredibar.newTab", false);
Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);
Deleted : user_pref("extensions.incredibar.ppd", "");
Deleted : user_pref("extensions.incredibar.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar.productid", "26");
Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar.sg", "none");
Deleted : user_pref("extensions.incredibar.smplGrp", "none");
Deleted : user_pref("extensions.incredibar.tlbrId", "base");
Deleted : user_pref("extensions.incredibar.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10657");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15580");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8DrlofCo&loc=IB[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

Profile name : Raddeals 
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\x16iw5jk.Raddeals\prefs.js

C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\x16iw5jk.Raddeals\user.js ... Deleted !

Deleted : user_pref("extensions.ffxtlbr@incredibar.com.install-event-fired", true);
Deleted : user_pref("extensions.incredibar.admin", false);
Deleted : user_pref("extensions.incredibar.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar.cntry", "DE");
Deleted : user_pref("extensions.incredibar.dfltLng", "");
Deleted : user_pref("extensions.incredibar.dfltSrch", false);
Deleted : user_pref("extensions.incredibar.did", "10657");
Deleted : user_pref("extensions.incredibar.envrmnt", "production");
Deleted : user_pref("extensions.incredibar.excTlbr", false);
Deleted : user_pref("extensions.incredibar.hdrMd5", "3CF91A8A67DB3CFB29E12F357B2F21B2");
Deleted : user_pref("extensions.incredibar.hmpg", false);
Deleted : user_pref("extensions.incredibar.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar.installerproductid", "26");
Deleted : user_pref("extensions.incredibar.instlDay", "15580");
Deleted : user_pref("extensions.incredibar.instlRef", "");
Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true);
Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Deleted : user_pref("extensions.incredibar.newTab", false);
Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);
Deleted : user_pref("extensions.incredibar.ppd", "");
Deleted : user_pref("extensions.incredibar.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar.productid", "26");
Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar.sg", "none");
Deleted : user_pref("extensions.incredibar.smplGrp", "none");
Deleted : user_pref("extensions.incredibar.tlbrId", "base");
Deleted : user_pref("extensions.incredibar.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10657");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15580");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8DrlofCo&loc=IB[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

Profile name : WSeminar 
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0xelmwvm.WSeminar\prefs.js

C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\0xelmwvm.WSeminar\user.js ... Deleted !

Deleted : user_pref("extensions.incredibar.admin", false);
Deleted : user_pref("extensions.incredibar.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar.cntry", "DE");
Deleted : user_pref("extensions.incredibar.dfltLng", "");
Deleted : user_pref("extensions.incredibar.dfltSrch", false);
Deleted : user_pref("extensions.incredibar.did", "10657");
Deleted : user_pref("extensions.incredibar.envrmnt", "production");
Deleted : user_pref("extensions.incredibar.excTlbr", false);
Deleted : user_pref("extensions.incredibar.hdrMd5", "3CF91A8A67DB3CFB29E12F357B2F21B2");
Deleted : user_pref("extensions.incredibar.hmpg", false);
Deleted : user_pref("extensions.incredibar.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar.installerproductid", "26");
Deleted : user_pref("extensions.incredibar.instlDay", "15580");
Deleted : user_pref("extensions.incredibar.instlRef", "");
Deleted : user_pref("extensions.incredibar.isDcmntCmplt", true);
Deleted : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Deleted : user_pref("extensions.incredibar.newTab", false);
Deleted : user_pref("extensions.incredibar.noFFXTlbr", false);
Deleted : user_pref("extensions.incredibar.ppd", "");
Deleted : user_pref("extensions.incredibar.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar.productid", "26");
Deleted : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar.sg", "none");
Deleted : user_pref("extensions.incredibar.smplGrp", "none");
Deleted : user_pref("extensions.incredibar.tlbrId", "base");
Deleted : user_pref("extensions.incredibar.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.aflt", "orgnl");
Deleted : user_pref("extensions.incredibar_i.dfltLng", "");
Deleted : user_pref("extensions.incredibar_i.did", "10657");
Deleted : user_pref("extensions.incredibar_i.excTlbr", false);
Deleted : user_pref("extensions.incredibar_i.id", "dc0dbdb1000000000000d0278863fd78");
Deleted : user_pref("extensions.incredibar_i.installerproductid", "26");
Deleted : user_pref("extensions.incredibar_i.instlDay", "15580");
Deleted : user_pref("extensions.incredibar_i.instlRef", "");
Deleted : user_pref("extensions.incredibar_i.ms_url_id", "");
Deleted : user_pref("extensions.incredibar_i.newTab", false);
Deleted : user_pref("extensions.incredibar_i.ppd", "");
Deleted : user_pref("extensions.incredibar_i.prdct", "incredibar");
Deleted : user_pref("extensions.incredibar_i.productid", "26");
Deleted : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Deleted : user_pref("extensions.incredibar_i.smplGrp", "none");
Deleted : user_pref("extensions.incredibar_i.tlbrId", "base");
Deleted : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8DrlofCo&loc=IB[...]
Deleted : user_pref("extensions.incredibar_i.upn2", "6R8DrlofCo");
Deleted : user_pref("extensions.incredibar_i.upn2n", "92824958051287672");
Deleted : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Deleted : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1412:14:00");
Deleted : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Deleted : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

Profile name : DieTester 
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\2p1n40z9.DieTester.eu\prefs.js

[OK] File is clean.

Profile name : Kiddideals 
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\jb7bzk4g.Kiddideals\prefs.js

[OK] File is clean.

Profile name : Boarderdeals 
File : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\ykl69wkl.Boarderdeals.\prefs.js

[OK] File is clean.

-\\ Google Chrome v21.0.1180.83

File : C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [38813 octets] - [28/08/2012 23:02:21]
AdwCleaner[S1].txt - [38810 octets] - [28/08/2012 23:02:44]

########## EOF - C:\AdwCleaner[S1].txt - [38939 octets] ##########
         
Das war aber wegen einer anderen Sache (dieser incredibar), die habe ich selbst entfernt.

Hier der Log von Eset:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=2803a5b34ac5b54da50f81f8b1215602
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-02 09:46:48
# local_time=2012-09-02 11:46:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 3781368 3781368 0 0
# compatibility_mode=5893 16776574 100 94 3337070 98201480 0 0
# compatibility_mode=8192 67108863 100 0 384307 384307 0 0
# scanned=467694
# found=3
# cleaned=3
# scan_time=7578
C:\Users\Jonas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\5f1101a5-2840fe52	a variant of Win32/Kryptik.ALET trojan (deleted - quarantined)	00000000000000000000000000000000	C
D:\Datenold\Jonas\AppData\Local\Temp\4da30d88-8a45-40ed-83bb-65fa1ef33a5c\LinkuryInstaller.msi	Win32/Toolbar.Linkury application (deleted - quarantined)	00000000000000000000000000000000	C
D:\Datenold\Jonas\AppData\Local\Temp\ICReinstall\cnet_FlexRena84_zip.exe	a variant of Win32/InstallCore.D application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

Alt 02.09.2012, 13:55   #8
t'john
/// Helfer-Team
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Wo surfst du eigentlich rum?
(so von den Seiten der Grauzone her)

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 7 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck
__________________
Mfg, t'john
Das TB unterstützen

Alt 02.09.2012, 14:06   #9
user154
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Hi,

hm eigentlicht auf nicht besonders schlimmen Websites - Diese ganzen Sachen von Datenold sind aber Daten von vor mindestens 1-2 Jahren, da ich danach den PC neuaufgesetzt habe

Java habe ich soweit alles installiert, hier die Daten von der Plugin Seite:

Code:
ATTFilter
    Firefox 15.0 ist aktuell

    Flash (11,4,402,265) ist aktuell.

    Java (1,7,0,7) ist aktuell.

    Adobe Reader 10,1,4,38 ist aktuell.
         

Alt 02.09.2012, 19:52   #10
t'john
/// Helfer-Team
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck




Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Uninstall.
  • Bestätige mit Ja.




Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

  • Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
  • temporäre Dateien löschen.




Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?
__________________
Mfg, t'john
Das TB unterstützen

Alt 02.09.2012, 21:38   #11
user154
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



So alles erledigt:

Code:
ATTFilter
    Firefox 15.0 ist aktuell

    Flash (11,4,402,265) ist aktuell.

    Java ist Installiert aber nicht aktiviert.

    Adobe Reader 10,1,4,38 ist aktuell.
         
ICh denke hiermit bin ich entlassen?

Dann auf jeden Fall noch einmal ein rieeeßen DANKESCHÖN! - Ich glaube so ein schneller und ausführlicher Service ist im Netz einfach einmal, DANKE !

Alt 03.09.2012, 19:40   #12
t'john
/// Helfer-Team
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Ich war Bla Bla
__________________
Mfg, t'john
Das TB unterstützen

Alt 03.09.2012, 19:42   #13
user154
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



Hab ich doch schon alles gemacht - siehe letzer Post von dir!

Alt 04.09.2012, 17:10   #14
t'john
/// Helfer-Team
 
GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Standard

GVU Trojaner mit Malwarebyte entfernt, aber vollständig?



ich war wohl blind

wuensche eine virenfreie Zeit
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu GVU Trojaner mit Malwarebyte entfernt, aber vollständig?
7-zip, antivir, avira, bho, crystaldiskinfo, document, emsisoft, error, fehler, firefox, flash player, format, google earth, homepage, install.exe, langs, logfile, mozilla, msiinstaller, pixel, port, realtek, registry, richtlinie, rundll, scan, senden, server, sicherheit, software, spotify web helper, trojaner, usb, usb 3.0, visual studio, windows



Ähnliche Themen: GVU Trojaner mit Malwarebyte entfernt, aber vollständig?


  1. Reveton Trojaner nicht vollständig entfernt
    Plagegeister aller Art und deren Bekämpfung - 17.12.2013 (63)
  2. PUP.Optional.Babylon.A - Von Malwarebyte identifiziert und entfernt - reicht das?
    Plagegeister aller Art und deren Bekämpfung - 02.10.2013 (9)
  3. Ist der GVU Trojaner vollständig entfernt worden? (Windows7)
    Log-Analyse und Auswertung - 10.07.2013 (21)
  4. Win8 64Bit GVU-Trojaner nicht vollständig entfernt
    Plagegeister aller Art und deren Bekämpfung - 06.06.2013 (11)
  5. Müssen isolierte Trojaner vollständig entfernt werden ?
    Plagegeister aller Art und deren Bekämpfung - 30.03.2013 (4)
  6. GVU-Trojaner wahrscheinlich nicht vollständig entfernt
    Plagegeister aller Art und deren Bekämpfung - 18.01.2013 (9)
  7. GVU Trojaner - vollständig entfernt?
    Log-Analyse und Auswertung - 01.11.2012 (6)
  8. GVU-Trojaner - vollständig entfernt?
    Log-Analyse und Auswertung - 18.09.2012 (17)
  9. ccdxmmde.dat, drss.dat & xessmsxe.dat gefunden - per Malwarebyte entfernt - was ist noch zu tun?
    Log-Analyse und Auswertung - 14.09.2012 (23)
  10. TR/Atraps.gen.2 Trojaner von AntiVir gemeldet und mit Malwarebyte entfernt - bitte Log prüfen
    Log-Analyse und Auswertung - 12.07.2012 (3)
  11. Gema BKA-Trojaner vollständig entfernt?
    Log-Analyse und Auswertung - 07.06.2012 (1)
  12. Trojaner vollständig entfernt von Festplatte?
    Plagegeister aller Art und deren Bekämpfung - 01.06.2012 (3)
  13. Ukash BKA Trojaner vollständig entfernt?
    Log-Analyse und Auswertung - 19.01.2012 (21)
  14. GEMA Trojaner vollständig entfernt?
    Log-Analyse und Auswertung - 18.12.2011 (1)
  15. Gefakte Data Restore Warnung eineholt /Trojaner nicht vollständig entfernt
    Plagegeister aller Art und deren Bekämpfung - 18.10.2011 (3)
  16. Malwarebyte Otl Avir Gmer können nicht vollständig ausgeführt werden. Prozess ist nicht killbar.
    Plagegeister aller Art und deren Bekämpfung - 10.10.2011 (3)
  17. Antimalware Doctor Trojaner vollständig entfernt?
    Log-Analyse und Auswertung - 03.05.2010 (8)

Zum Thema GVU Trojaner mit Malwarebyte entfernt, aber vollständig? - Hallo, wie schon im Titel beschrieben, habe/hatte ich mir den GVU Trojaner eingefangen, diesen habe ich mit der Software Malwarebyte (entfernt) - es erscheint auf jeden Fall nicht mehr das - GVU Trojaner mit Malwarebyte entfernt, aber vollständig?...
Archiv
Du betrachtest: GVU Trojaner mit Malwarebyte entfernt, aber vollständig? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.