Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: BKA-Trojaner V. 1.15 - Windows 7 64bit

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 17.09.2012, 21:59   #1
jar31
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Hallo!

Gestern tauchte bei mir auch der BKA Trojaner (V. 1.15, laut bka-trojaner.de) auf.

Als Anti-Viren Software benutze ich G Data Internet Security 2011 (immer auf dem neusten Signatur-Stand)

Nachdem sich der Taskmanager nicht oeffnen ließ schaltete ich den PC aus und fuhr ihn erneut im abgesichteren Modus hoch um kurz zu recherchieren und kappte danach direkt die Internetverbindung.
Danach fuehrte ich einen Scan mit Malwarebytes durch (log siehe unten).
Habe ebenfalls einen Quick-Scan mit OTL durchgefuehrt, der Log ist ebenfalls unten.

Ich habe sowieso vor Windows neuzuinstallieren (da ich bald eine SSD einbauen werde).
Momentan habe ich meine Festplatte in eine Partition fuer Windows und den Rest fuer Daten (dorthin werden auch fast alle Programme installiert) aufgeteilt.
Da ich aber vorher noch ein paar Daten sichern moechte (und vor allem nach Einbau der SSD fuer Windows, die zwei bisherigen Partitionen auf der Festplatte zusammenfassen moechte und auch zum Zeitpunkt der Infektion eine externe Festplatte angeschlossen war (diese hab ich sofort weggenommen), wollte ich gerne mein System von dem Trojaner befreien und sicherstellen, dass meine externe HDD nicht befallen ist.

Momentan benutze ich Ubuntu von einem USB Stick (um diesen Text zu schreiben und meine Daten dann abzusichern, wenn frei von Infektion).


Nachdem ich den Scan von Malwarebytes (im abgesichertem Modus) durchgefuehrt habe und ein Neustart erforderlich war, ließ ich Windows normal starten, was auch ohne Probleme klappte. Jedoch blinkte kurz danach oben rechts am Bildschirm ganz kurz ein roter Kasten auf, was mir auch kurz bevor der Sperrscreen des BKA Trojaners auftauchte auffiel, weshalb ich den PC direkt herunterfuhr, um weiteren Schaden zu vermindern.

Ich bedanke mich schonmal fuer eure Hilfe.
Lg
jar31

(Ubuntu hat hier nur englisches Layout, bitte entschuldigt die fehlende oe,ae und ue)

Hier die Logs:

Malwarebytes

Code:
ATTFilter
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.16.11

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Lukas :: LUKAS-PC [Administrator]

16.09.2012 21:27:28
mbam-log-2012-09-16 (21-27-28).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 687738
Laufzeit: 1 Stunde(n), 2 Minute(n), 45 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|{B7D26961-C836-2B35-29BD-2A0EE276765B} (Trojan.ZbotR.Gen) -> Daten: C:\Users\Lukas\AppData\Roaming\Uvbe\oqod.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\Lukas\AppData\Roaming\hellomoto (Trojan.Ransom.FGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 2
C:\Users\Lukas\AppData\Roaming\hellomoto\TujP.dat (Trojan.Ransom.FGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Lukas\AppData\Roaming\hellomoto\BukF.dat (Trojan.Ransom.FGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

OTL Logs:

OTL
Code:
ATTFilter
OTL logfile created on: 17.09.2012 20:22:31 - Run 1
OTL by OldTimer - Version 3.2.61.5     Folder = C:\Users\Lukas\Desktop
64bit- Professional  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,85 Gb Available Physical Memory | 71,21% Memory free
8,00 Gb Paging File | 6,86 Gb Available in Paging File | 85,81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,73 Gb Total Space | 10,67 Gb Free Space | 21,89% Space Free | Partition Type: NTFS
Drive D: | 4,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 416,93 Gb Total Space | 19,18 Gb Free Space | 4,60% Space Free | Partition Type: NTFS
Drive F: | 14,90 Gb Total Space | 14,21 Gb Free Space | 95,35% Space Free | Partition Type: FAT32
 
Computer Name: LUKAS-PC | User Name: Lukas | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.17 18:12:18 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Lukas\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2010.02.03 06:17:10 | 000,202,752 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.09.10 21:54:05 | 004,537,664 | ---- | M] () [Auto | Stopped] -- c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll -- (Akamai)
SRV - [2012.09.08 15:56:49 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.09.08 15:55:24 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.08.11 00:03:57 | 000,103,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.06.04 11:50:20 | 001,766,464 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- E:\Program Files (x86)\Firewall\GDFwSvcx64.exe -- (GDFwSvc)
SRV - [2012.06.01 05:05:18 | 002,011,056 | ---- | M] (G Data Software AG) [Auto | Stopped] -- E:\Program Files (x86)\AVK\AVKWCtlx64.exe -- (AVKWCtl)
SRV - [2012.05.25 14:19:24 | 001,540,120 | ---- | M] (G Data Software AG) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe -- (AVKProxy)
SRV - [2012.03.29 04:42:27 | 000,470,008 | ---- | M] (G Data Software AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe -- (GDScan)
SRV - [2012.01.27 05:43:33 | 000,468,472 | ---- | M] (G Data Software AG) [Auto | Stopped] -- E:\Program Files (x86)\AVK\AVKService.exe -- (AVKService)
SRV - [2011.08.12 17:13:26 | 000,087,040 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2011.05.26 21:28:56 | 000,040,960 | ---- | M] () [Auto | Stopped] -- C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer)
SRV - [2011.04.07 17:37:16 | 005,352,960 | ---- | M] (Native Instruments GmbH) [Auto | Stopped] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService)
SRV - [2011.03.28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.04.24 01:10:34 | 000,209,768 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2010.04.24 01:10:28 | 000,483,688 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010.03.04 00:49:01 | 000,075,064 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.02.03 12:40:50 | 000,094,440 | ---- | M] (tzuk) [Auto | Stopped] -- e:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.04.30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Stopped] -- e:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)
SRV - [2009.02.10 18:01:49 | 000,116,104 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE -- (IJPLMSVC)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.06.03 11:50:01 | 000,106,648 | ---- | M] (G Data Software) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\GRD.sys -- (GRD)
DRV:64bit: - [2012.06.03 11:40:21 | 000,059,768 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PktIcpt.sys -- (GDPkIcpt)
DRV:64bit: - [2012.06.03 11:36:43 | 000,064,376 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\HookCentre.sys -- (HookCentre)
DRV:64bit: - [2012.06.03 11:36:32 | 000,122,744 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\MiniIcpt.sys -- (GDMnIcpt)
DRV:64bit: - [2012.06.03 11:36:32 | 000,065,912 | ---- | M] (G Data Software AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\gdwfpcd64.sys -- (gdwfpcd)
DRV:64bit: - [2012.06.03 11:36:32 | 000,054,136 | ---- | M] (G Data Software AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GDBehave.sys -- (GDBehave)
DRV:64bit: - [2012.01.05 11:41:20 | 000,060,248 | ---- | M] (Focusrite Audio Engineering Limited.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ffusb2audio.sys -- (ffusb2audio)
DRV:64bit: - [2011.08.20 15:51:05 | 000,031,448 | ---- | M] (G Data Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GdNetMon64.sys -- (GdNetMon)
DRV:64bit: - [2011.07.07 18:42:38 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2011.05.10 08:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.04.09 18:42:56 | 000,013,824 | ---- | M] (nerds.de) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\loopbe1.sys -- (LoopBeMidi1)
DRV:64bit: - [2010.06.25 16:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot)
DRV:64bit: - [2010.04.24 01:10:32 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2010.04.24 01:10:28 | 000,269,672 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2010.04.24 01:10:28 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2010.04.24 01:10:20 | 000,721,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2010.04.07 20:57:08 | 000,073,784 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.04.07 20:57:08 | 000,028,728 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.02.27 10:36:18 | 000,834,544 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.02.03 06:55:18 | 006,366,720 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.02.03 05:23:58 | 000,186,880 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.01.28 16:33:38 | 000,116,736 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.08.17 13:20:46 | 001,235,968 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2009.07.16 05:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.22 16:52:30 | 000,215,040 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.05.05 06:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV:64bit: - [2008.11.04 10:52:36 | 000,145,960 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018unic.sys -- (s1018unic)
DRV:64bit: - [2008.11.04 10:52:36 | 000,132,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018mgmt.sys -- (s1018mgmt)
DRV:64bit: - [2008.11.04 10:52:36 | 000,128,552 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018obex.sys -- (s1018obex)
DRV:64bit: - [2008.11.04 10:52:36 | 000,034,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018nd5.sys -- (s1018nd5)
DRV:64bit: - [2008.11.04 10:52:32 | 000,152,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018mdm.sys -- (s1018mdm)
DRV:64bit: - [2008.11.04 10:52:32 | 000,019,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018mdfl.sys -- (s1018mdfl)
DRV:64bit: - [2008.11.04 10:52:30 | 000,113,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\s1018bus.sys -- (s1018bus)
DRV:64bit: - [2008.06.27 08:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
DRV:64bit: - [2008.06.23 10:08:41 | 001,358,336 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cmudaxp.sys -- (cmudaxp)
DRV:64bit: - [2008.02.21 03:10:36 | 000,196,992 | ---- | M] (Omnivision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ov550ivx.sys -- (OV550I)
DRV:64bit: - [2008.01.09 12:28:20 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri)
DRV - [2011.05.12 20:11:41 | 000,106,224 | ---- | M] (G Data Software) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\GRD.sys -- (GRD)
DRV - [2010.02.03 12:40:44 | 000,134,760 | ---- | M] (tzuk) [Kernel | On_Demand | Stopped] -- e:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 68 00 E5 A2 5D E7 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKCU\..\SearchScopes\{0259B413-E84B-4C02-9409-6D3D00205873}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F464F524D3D4945464D3126713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0
IE - HKCU\..\SearchScopes\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{12F10CC7-00CE-420D-911F-96F182B8225B}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{2B0E84CC-90FE-4913-B7AF-096971E474A7}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E636F6E647569742E636F6D2F526573756C74734578742E617370783F713D7B7365617263685465726D737D26536561726368536F757263653D3426637469643D435432333034313537&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0
IE - HKCU\..\SearchScopes\{C0058E40-BD96-4946-A978-D98908C6C9F0}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;<local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.gopro.com/|hxxp://www.guardian.co.uk/|hxxp://uk.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: artur.dubovoy@gmail.com:3.6.2
FF - prefs.js..extensions.enabledAddons: ffextension@weheartit.com:2.3.1
FF - prefs.js..extensions.enabledAddons: foxmarks@kei.com:4.0.5
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.2
FF - prefs.js..extensions.enabledAddons: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.5
FF - prefs.js..extensions.enabledAddons: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17
FF - prefs.js..extensions.enabledAddons: {906305f7-aafc-45e9-8bbd-941950a84dad}:1.1.11215.1124
FF - prefs.js..extensions.enabledAddons: {9051303c-7e41-4311-a783-d6fe5ef2832d}:14.0.4
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.10
FF - prefs.js..extensions.enabledItems: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.3
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997
FF - prefs.js..extensions.enabledItems: X-pireprototype@x-pire.net:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://www.bing.com/search?FORM=IEFM1&q="
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\Users\\Lukas\\AppData\\Local\\Temp\\proxtube.pac"
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Lukas\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 15:55:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.08 15:55:20 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.08 15:55:25 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.08 15:55:20 | 000,000,000 | ---D | M]
 
[2012.05.19 14:31:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\Extensions
[2012.05.19 14:31:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\Extensions\ideskbrowser@haufe.de
[2012.09.15 14:40:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions
[2011.11.26 03:49:58 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2011.05.15 00:51:41 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2012.09.15 14:40:59 | 000,000,000 | ---D | M] ("FVD Suite Addon") -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}
[2011.12.31 20:34:24 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\foxmarks@kei.com
[2012.05.17 21:46:07 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Lukas\AppData\Roaming\mozilla\Firefox\Profiles\wp4l5jes.default\extensions\ich@maltegoetz.de
[2012.07.09 19:49:36 | 000,185,600 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\artur.dubovoy@gmail.com.xpi
[2012.07.08 19:34:40 | 000,057,159 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\ffextension@weheartit.com.xpi
[2011.12.31 00:38:19 | 000,074,526 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\{11483926-db67-4190-91b1-ef20fcec5f33}.xpi
[2012.06.30 00:39:41 | 000,525,327 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2012.07.04 15:45:08 | 000,743,290 | ---- | M] () (No name found) -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.05.26 21:29:01 | 000,001,123 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\conduit.xml
[2011.05.26 22:27:22 | 000,001,030 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\wikipedia-de.xml
[2012.09.08 15:55:15 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.08 15:55:15 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.09.08 15:55:15 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\mozilla firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}
[2012.09.08 15:55:24 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.05.04 10:14:47 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.29 11:52:58 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.05.04 10:14:47 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.04 10:14:47 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.04 10:14:47 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.04 10:14:47 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.07.24 17:33:40 | 000,396,541 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 3dns.adobe.com
O1 - Hosts: 127.0.0.1 3dns-1.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-1.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-4.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-5.adobe.com
O1 - Hosts: 127.0.0.1 hh-software.com
O1 - Hosts: 127.0.0.1 www.hh-software.com
O1 - Hosts: 13690 more lines...
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G Data\AVKProxy\BanksafeBHO.dll (G Data Software AG)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [Cmaudio8788] C:\Windows\Syswow64\cmicnfgp.cpl (C-Media Corporation)
O4:64bit: - HKLM..\Run: [Cmaudio8788GX] C:\Windows\syswow64\HsMgr.exe ()
O4:64bit: - HKLM..\Run: [Cmaudio8788GX64] C:\Windows\system\HsMgr64.exe ()
O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [boincmgr] E:\Program Files (x86)\BOINC\boincmgr.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [boinctray] E:\Program Files (x86)\BOINC\boinctray.exe (Space Sciences Laboratory)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] E:\Program Files (x86)\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] E:\Program Files (x86)\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Lukas\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKCU..\Run: [ONAIR] C:\Programme\ONAIR\ONAIR.exe (DJMASTER.COM)
O4 - HKCU..\Run: [SandboxieControl] e:\Program Files\Sandboxie\SbieCtrl.exe (tzuk)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Lukas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] e:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe File not found
O4 - HKCU..\Run: [UIRibbon] C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe ()
O4 - Startup: C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Lukas\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7692B860-8954-4F13-8019-0406A17CEFDF}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\gopher - No CLSID value found
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.04.23 16:38:12 | 000,000,135 | ---- | M] () - F:\autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.17 20:21:12 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\Lukas\Desktop\OTL.exe
[2012.09.17 01:15:01 | 000,000,000 | ---D | C] -- C:\Users\Lukas\AppData\Roaming\hellomoto
[2012.09.16 21:25:06 | 000,000,000 | ---D | C] -- C:\Users\Lukas\AppData\Roaming\Malwarebytes
[2012.09.16 21:24:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.16 21:24:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.16 21:24:56 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.16 21:24:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.09.08 15:55:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.09.03 21:11:58 | 000,000,000 | ---D | C] -- C:\Users\Lukas\Desktop\Wolves Carry My Name - Amongst Ruins And Ashes
[2012.08.30 22:57:20 | 000,000,000 | ---D | C] -- C:\Users\Lukas\Desktop\EBAY_BMTH
[2012.08.23 15:20:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ONAIR
[2012.08.23 15:20:31 | 000,000,000 | ---D | C] -- C:\Program Files\ONAIR
[2012.08.23 15:18:27 | 000,000,000 | ---D | C] -- C:\Users\Lukas\Desktop\Neuer Ordner
[2010.05.28 14:17:59 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe8767.dll
[2010.05.28 14:12:30 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe8297.dll
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.17 20:22:07 | 001,500,018 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.17 20:22:07 | 000,654,372 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.17 20:22:07 | 000,616,254 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.17 20:22:07 | 000,129,986 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.17 20:22:07 | 000,106,376 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.17 20:21:58 | 000,000,020 | ---- | M] () -- C:\Users\Lukas\defogger_reenable
[2012.09.17 20:20:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.17 20:20:12 | 3220,574,208 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.17 18:12:18 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Lukas\Desktop\OTL.exe
[2012.09.17 18:12:12 | 000,050,477 | ---- | M] () -- C:\Users\Lukas\Desktop\Defogger.exe
[2012.09.16 21:24:57 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.16 15:03:33 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.16 15:03:33 | 000,013,248 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.12 16:21:04 | 000,063,959 | ---- | M] () -- C:\Users\Lukas\Desktop\67498_1313092368014_7053341_n.jpg
[2012.09.07 21:03:24 | 000,059,966 | ---- | M] () -- C:\Users\Lukas\Desktop\kuendigungshelfer_491601690001.pdf
[2012.09.07 17:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.05 00:02:12 | 000,031,775 | ---- | M] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.pdf
[2012.09.05 00:02:02 | 000,015,765 | ---- | M] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.odt
[2012.09.02 13:05:30 | 000,853,368 | ---- | M] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch.JPG
[2012.09.02 13:05:30 | 000,648,094 | ---- | M] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0001.JPG
[2012.09.02 13:05:30 | 000,633,785 | ---- | M] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0002.JPG
[2012.09.01 20:25:14 | 000,027,374 | ---- | M] () -- C:\Users\Lukas\Desktop\kirk-and-spock.jpg
[2012.09.01 20:25:12 | 000,034,912 | ---- | M] () -- C:\Users\Lukas\Desktop\Kirk_Spock_McCoy_bridge_2267.jpg
[2012.09.01 19:55:43 | 000,080,276 | ---- | M] () -- C:\Users\Lukas\Desktop\star_trek_csg_031.jpg
[2012.08.29 20:06:06 | 000,014,799 | ---- | M] () -- C:\Users\Public\Documents\Unbenannt 1.ods
[2012.08.28 15:51:04 | 002,755,832 | ---- | M] () -- C:\Users\Lukas\Desktop\trial.png
[2012.08.28 12:48:26 | 000,023,056 | ---- | M] () -- C:\Users\Lukas\Desktop\554572_10151055993617620_1395222658_n.jpg
[2012.08.25 21:59:50 | 000,069,300 | ---- | M] () -- C:\Users\Lukas\Desktop\tab_25_08_96432_rinoa_fires_in_the_distant_north_gpx.gp5
[2012.08.22 20:25:28 | 000,001,502 | ---- | M] () -- C:\Users\Lukas\Desktop\csgo - Verknüpfung.lnk
[2012.08.22 20:25:06 | 000,000,117 | ---- | M] () -- C:\Users\Lukas\Desktop\tick128.cfg
[2012.08.22 20:24:50 | 000,000,115 | ---- | M] () -- C:\Users\Lukas\Desktop\tick64.cfg
[2012.08.21 21:19:21 | 000,011,551 | ---- | M] () -- C:\Users\Lukas\Desktop\valve (2).rc
[2012.08.21 16:19:11 | 000,770,883 | ---- | M] () -- C:\Windows\SysWow64\sig.bin
[2012.08.21 16:19:11 | 000,043,211 | ---- | M] () -- C:\Windows\SysWow64\nmp.map
[2012.08.21 00:17:14 | 000,005,506 | ---- | M] () -- C:\Windows\Sandboxie.ini
[2012.08.20 15:38:26 | 000,001,805 | ---- | M] () -- C:\Users\Lukas\Desktop\Spotify.lnk
[2012.08.19 18:39:26 | 000,948,940 | ---- | M] () -- C:\Users\Lukas\Desktop\The+xx+GIF.gif
[2012.08.19 16:48:54 | 000,144,265 | ---- | M] () -- C:\Users\Lukas\Desktop\explosions_in_the_sky_catastrophe_and_the_cure.gp5
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.17 20:21:58 | 000,000,020 | ---- | C] () -- C:\Users\Lukas\defogger_reenable
[2012.09.17 20:21:13 | 000,050,477 | ---- | C] () -- C:\Users\Lukas\Desktop\Defogger.exe
[2012.09.16 21:24:57 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.09.12 16:21:03 | 000,063,959 | ---- | C] () -- C:\Users\Lukas\Desktop\67498_1313092368014_7053341_n.jpg
[2012.09.07 21:03:28 | 000,059,966 | ---- | C] () -- C:\Users\Lukas\Desktop\kuendigungshelfer_491601690001.pdf
[2012.09.05 00:02:10 | 000,031,775 | ---- | C] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.pdf
[2012.09.05 00:02:01 | 000,015,765 | ---- | C] () -- C:\Users\Lukas\Desktop\lebenslauf_mama.odt
[2012.09.02 14:06:04 | 000,853,368 | ---- | C] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch.JPG
[2012.09.02 14:06:04 | 000,648,094 | ---- | C] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0001.JPG
[2012.09.02 14:06:04 | 000,633,785 | ---- | C] () -- C:\Users\Lukas\Desktop\Centr_Luk_Besch0002.JPG
[2012.09.01 20:25:14 | 000,027,374 | ---- | C] () -- C:\Users\Lukas\Desktop\kirk-and-spock.jpg
[2012.09.01 20:25:10 | 000,034,912 | ---- | C] () -- C:\Users\Lukas\Desktop\Kirk_Spock_McCoy_bridge_2267.jpg
[2012.09.01 19:55:41 | 000,080,276 | ---- | C] () -- C:\Users\Lukas\Desktop\star_trek_csg_031.jpg
[2012.08.29 19:59:20 | 000,014,799 | ---- | C] () -- C:\Users\Public\Documents\Unbenannt 1.ods
[2012.08.28 15:51:03 | 002,755,832 | ---- | C] () -- C:\Users\Lukas\Desktop\trial.png
[2012.08.28 12:48:25 | 000,023,056 | ---- | C] () -- C:\Users\Lukas\Desktop\554572_10151055993617620_1395222658_n.jpg
[2012.08.25 21:59:58 | 000,069,300 | ---- | C] () -- C:\Users\Lukas\Desktop\tab_25_08_96432_rinoa_fires_in_the_distant_north_gpx.gp5
[2012.08.22 20:25:29 | 000,001,502 | ---- | C] () -- C:\Users\Lukas\Desktop\csgo - Verknüpfung.lnk
[2012.08.22 20:25:06 | 000,000,117 | ---- | C] () -- C:\Users\Lukas\Desktop\tick128.cfg
[2012.08.22 20:24:50 | 000,000,115 | ---- | C] () -- C:\Users\Lukas\Desktop\tick64.cfg
[2012.08.21 21:20:09 | 000,011,551 | ---- | C] () -- C:\Users\Lukas\Desktop\valve (2).rc
[2012.08.20 15:38:26 | 000,001,805 | ---- | C] () -- C:\Users\Lukas\Desktop\Spotify.lnk
[2012.08.19 18:39:25 | 000,948,940 | ---- | C] () -- C:\Users\Lukas\Desktop\The+xx+GIF.gif
[2012.08.19 16:48:59 | 000,144,265 | ---- | C] () -- C:\Users\Lukas\Desktop\explosions_in_the_sky_catastrophe_and_the_cure.gp5
[2012.07.25 14:40:52 | 007,416,576 | ---- | C] () -- C:\Users\Lukas\Song 3 Retardierendes Moment.mp3
[2012.06.20 16:12:17 | 000,000,132 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011.09.27 11:17:26 | 000,198,144 | ---- | C] () -- C:\Windows\SysWow64\LXPrnUtil10.dll
[2011.09.27 11:16:20 | 000,304,128 | ---- | C] () -- C:\Windows\SysWow64\LxDNT100.dll
[2011.09.27 11:14:14 | 000,133,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvmc100.dll
[2011.09.27 11:13:58 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvm100.dll
[2011.08.21 11:51:02 | 000,770,883 | ---- | C] () -- C:\Windows\SysWow64\sig.bin
[2011.06.06 18:30:24 | 000,200,704 | R--- | C] () -- C:\Windows\SysWow64\HsMgr.exe
[2011.06.06 18:30:16 | 000,139,264 | R--- | C] () -- C:\Windows\SysWow64\VmixP8.dll
[2011.06.06 18:29:53 | 000,039,288 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.cfl
[2011.06.06 18:28:37 | 000,007,214 | R--- | C] () -- C:\Windows\Cmicnfgp.ini.cfg
[2011.06.06 18:28:37 | 000,000,862 | ---- | C] () -- C:\Windows\Cmicnfgp.ini.imi
[2011.05.29 10:35:26 | 000,006,656 | ---- | C] () -- C:\Users\Lukas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.05.14 16:41:44 | 000,000,132 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.04.27 20:21:07 | 000,000,471 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Poladroid prefs.plist
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.02 17:32:06 | 000,311,296 | ---- | C] () -- C:\Windows\SysWow64\EMRegSys.dll
[2010.07.29 22:41:04 | 000,000,132 | ---- | C] () -- C:\Users\Lukas\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.06.19 20:43:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== LOP Check ==========
 
[2012.08.03 18:38:32 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\.minecraft
[2012.05.20 22:45:18 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\.spoutcraft
[2011.02.19 23:10:32 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Alien Skin
[2010.03.21 16:55:48 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Amazon
[2011.06.06 18:36:07 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\ASUS
[2012.07.09 19:39:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Babylon
[2011.12.28 16:34:14 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\bsnes
[2010.12.22 00:21:13 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Canneverbe Limited
[2011.06.10 16:47:55 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Canon
[2012.03.19 22:27:00 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\CasaPortale.de
[2010.10.10 20:37:01 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.07.06 18:43:07 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\com.destroytoday.destroytwitter
[2010.02.27 11:09:20 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\DAEMON Tools Lite
[2010.10.10 19:27:02 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\dBpoweramp
[2010.04.26 12:06:25 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Digital Distribution Networks Ltd
[2012.09.17 01:15:19 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Dropbox
[2012.04.05 19:14:36 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\DVDVideoSoft
[2011.09.01 16:48:26 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\elsterformular
[2011.05.29 09:22:37 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Engelmann Media
[2010.05.27 12:55:56 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Feedreader
[2012.07.09 19:59:54 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\FVD Suite
[2012.08.03 11:53:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\FXpansion
[2012.06.02 19:40:43 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Guitar Pro 6
[2012.05.19 14:31:03 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Haufe Mediengruppe
[2010.04.01 03:27:15 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HDRsoft
[2012.09.17 01:15:01 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\hellomoto
[2010.03.22 21:31:17 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HLSW
[2012.07.22 20:09:54 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HTC
[2012.07.22 22:33:29 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012.08.10 13:49:36 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\ICQ
[2012.05.08 08:47:13 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Lexware
[2011.04.27 21:06:29 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Nik Software
[2011.05.26 21:28:56 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\OCS
[2010.03.07 21:39:54 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\OpenOffice.org
[2011.05.26 21:29:01 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Opera
[2011.09.21 15:56:56 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\PandoraRecovery
[2012.07.31 23:02:21 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\PreSonus
[2012.08.07 21:57:07 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Propellerhead Software
[2010.04.02 09:18:25 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Red Kawa
[2012.09.03 12:59:34 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\SoftGrid Client
[2012.09.16 20:10:14 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Spotify
[2011.05.13 23:18:18 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.09.08 15:40:58 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\TP
[2010.02.27 20:34:57 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.05.15 19:46:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Ubisoft
[2010.05.19 06:25:27 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Uvbe
[2010.03.06 17:59:28 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\VSO
[2011.02.19 18:41:00 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Wingnut
[2010.05.19 01:54:35 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Yqdut
[2012.06.17 11:08:13 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:63238B95

< End of report >
         
Extras

Code:
ATTFilter
OTL Extras logfile created on: 17.09.2012 20:22:31 - Run 1
OTL by OldTimer - Version 3.2.61.5     Folder = C:\Users\Lukas\Desktop
64bit- Professional  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,85 Gb Available Physical Memory | 71,21% Memory free
8,00 Gb Paging File | 6,86 Gb Available in Paging File | 85,81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,73 Gb Total Space | 10,67 Gb Free Space | 21,89% Space Free | Partition Type: NTFS
Drive D: | 4,31 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 416,93 Gb Total Space | 19,18 Gb Free Space | 4,60% Space Free | Partition Type: NTFS
Drive F: | 14,90 Gb Total Space | 14,21 Gb Free Space | 95,35% Space Free | Partition Type: FAT32
 
Computer Name: LUKAS-PC | User Name: Lukas | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- E:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "e:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03F2D47A-D716-430A-8443-503120D30206}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{086951C2-BA05-4518-8A3B-9285F766AA73}" = lport=28962 | protocol=17 | dir=in | name=cod4 | 
"{12552145-E516-4F5F-9CA5-511A306CB67F}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{16F80983-BABA-45D1-910A-EB9DC75D5CA4}" = lport=137 | protocol=17 | dir=in | app=system | 
"{1DC88FBA-2948-47CB-BD6E-7946C55A76A1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{1F1B8E2E-2B30-4F6F-902E-59A88AC37244}" = rport=138 | protocol=17 | dir=out | app=system | 
"{3093CF20-A537-4043-AD31-EEF971648EE0}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{3B060073-105E-4740-90BE-84D97D3439CD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{44301E8D-F609-4C29-9A02-C8353F96E722}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{4C419D30-5971-4597-9B8B-928A17CAFFD1}" = rport=445 | protocol=6 | dir=out | app=system | 
"{5E4AEB9C-5779-49DD-B8CE-DC09CAF19EA6}" = lport=5900 | protocol=6 | dir=in | name=vnc5900 | 
"{612A5231-22EF-4A5C-90DF-B63D8F34FF6A}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{7A3D84C9-28B7-407B-9D4F-0D51F1AAA01D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{7FA0E550-2494-4BA9-A9E3-8DDB30C9CB4C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{81A8270F-B761-43EB-84B5-4BC09DA0BD66}" = rport=137 | protocol=17 | dir=out | app=system | 
"{87CD18EA-D025-41D0-B51A-F5F7E16E82CA}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{89BE9C59-DADA-48C5-B481-19F297CE9099}" = lport=138 | protocol=17 | dir=in | app=system | 
"{9B73F55E-2214-4FFD-8FB7-4E953C820F8C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A1242B21-DE3C-40C2-A622-ED35125B6586}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{B1F31A8D-9270-41F1-AF29-75C44606BC79}" = lport=5800 | protocol=6 | dir=in | name=vnc5800 | 
"{B7E08CC6-615B-41C0-8E40-011193352F56}" = lport=445 | protocol=6 | dir=in | app=system | 
"{BAB5FA7D-7091-4DD2-B72A-8C6B4ED3DCB0}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{CD907766-B4E0-48E3-8849-41A70BA02444}" = lport=139 | protocol=6 | dir=in | app=system | 
"{DEA2FAD5-7CA9-4D6A-B5AD-05EB21B24C5E}" = rport=139 | protocol=6 | dir=out | app=system | 
"{DEFFF42B-8F8D-4202-A784-4E03F01C134A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E19C028D-2645-438A-9593-025F7F901549}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{E2B6410B-74E9-49C0-8C4F-87075982CD37}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F4267CFC-2C4C-4B6D-8261-FF3E5A6DC87D}" = lport=49185 | protocol=6 | dir=in | name=akamai netsession interface | 
"{F9F7C2C5-7F40-492A-A2A2-A46D0A0F5E8C}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{FFE966F4-2243-4CA9-A5E0-7CC0CD96389E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D046988-64D5-4D92-8DB7-8A38C1B9983A}" = protocol=6 | dir=in | app=c:\program files (x86)\ultravnc\vncviewer.exe | 
"{0D3EFD73-9BDF-4227-90DA-9684575186A2}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\counter-strike source\hl2.exe | 
"{1B505F5C-7834-42DF-8C30-5DABE4AA88D5}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3sp.exe | 
"{233BA9C3-2718-417F-8041-23DC27B34680}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2550E7EE-AEE2-4AA0-8C65-F11F46F53398}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3mp.exe | 
"{25565A69-1AAF-40BA-A6D0-14E48AC372AC}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steam.exe | 
"{2F335760-8DDC-4B14-A5C7-ACA2F4BB19D2}" = protocol=6 | dir=in | app=c:\users\lukas\appdata\local\akamai\netsession_win.exe | 
"{33C90D89-E87D-4762-B4D2-61FFB661EBED}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\amd driver updater, vista and 7, 64 bit\setup.exe | 
"{344C4683-D6FE-4364-AD08-9EEA7FF97A18}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{34537401-24CE-4975-BB81-AF90643C0FF3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{35168F63-0A72-403B-A9EB-C9855EEA8681}" = protocol=17 | dir=in | app=c:\program files (x86)\ultravnc\winvnc.exe | 
"{35AF5413-C3C8-431D-804E-97C737BE89FE}" = protocol=6 | dir=in | app=c:\users\lukas\appdata\roaming\dropbox\bin\dropbox.exe | 
"{3848F042-D06E-472A-B30F-7BB9B480E1CB}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{3AECB477-B529-4A23-BB0F-07C56AC0E325}" = protocol=6 | dir=in | app=e:\program files (x86)\sierra\fearcombat\fearmp.exe | 
"{3D57D5C6-85EC-4B54-9DA0-BC6185526F91}" = protocol=6 | dir=out | app=system | 
"{3E6EF1C0-34D0-4129-84D2-2C28CA21D1AC}" = protocol=17 | dir=in | app=c:\users\lukas\appdata\roaming\dropbox\bin\dropbox.exe | 
"{427F5EB0-78DA-4612-9F5E-9404481D9C7D}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\day of defeat source\hl2.exe | 
"{453F5C81-3B6A-4085-8196-A00B60E6B2A0}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3sp.exe | 
"{491AABDC-7158-40D9-8907-14E6441D5FDB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4BB866D1-3566-4E21-88F9-ED7565786F00}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{4D17876D-C9EB-40AC-9F2E-F606CAB880FB}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\call of duty 4\iw3mp.exe | 
"{50766362-13C9-45D3-876C-6C65ABE253AF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{51254B0A-0E13-46F9-A2FF-86E5A8A03A82}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{5BD2052A-94E2-4CCA-8265-6B5406478118}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{5C34740E-7141-463F-9548-00C98E30EDDA}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\amd driver updater, vista and 7, 64 bit\setup.exe | 
"{5EBDBAF3-1412-459A-AA91-24FABE34FB20}" = protocol=6 | dir=in | app=c:\program files (x86)\ultravnc\winvnc.exe | 
"{6836F41F-68CC-4889-850B-DFA963922B7A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{69AAA40B-B0F4-4A20-9FB7-EDC4DF46BA48}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{6FAD433F-D066-434F-A913-2CCD516A48CE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{70333767-3577-4B2F-91DA-961551C1FF16}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\counter-strike source\hl2.exe | 
"{70C7A060-0E8C-4007-9045-34BACF170F44}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{7408203B-E74A-4C8B-BB4E-43DAD6B83AF2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{776A4067-60F2-437D-B7A3-FE7EE103844F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{799C980F-C39C-40CE-B017-60BC23E2D219}" = protocol=17 | dir=in | app=c:\users\lukas\appdata\local\akamai\netsession_win.exe | 
"{79A769AD-FCA8-4291-B4AD-650606017B13}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{837AAECB-F96C-4AF2-B3C0-914996580810}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{83D78DDB-411F-4D03-92DC-3BFA75510CE8}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{AA18B86D-852E-4B9B-8938-77E10752BB74}" = protocol=6 | dir=in | app=e:\program files (x86)\rockstar games\eflc\launcheflc.exe | 
"{AF0A4004-7801-4AED-9201-3D417188DD90}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{B61413A3-36B6-409C-BA37-FF5217B442EE}" = protocol=17 | dir=in | app=c:\program files (x86)\ultravnc\vncviewer.exe | 
"{B7A35CE4-5B43-4FC5-834F-BEE147A0DF1D}" = protocol=6 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 
"{BE461CD2-8DC9-4083-8E42-CD3C411C8BD2}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\day of defeat source\hl2.exe | 
"{C1523AA7-70A5-416E-9B47-AB353C55C8FA}" = protocol=17 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 
"{C17FA47F-D0A3-495A-9C2A-D6049E54ECC2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{C3FAC08B-478B-4DB4-8E1D-C3543C7D9FA1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C87CBF1F-4405-40F1-8938-03AA5B4144B2}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{C8EB60FF-6885-452A-A7DB-25F3E13E75E4}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.5\icq.exe | 
"{CF13866C-D01D-4028-930B-0DD06C8FFDD3}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{D0D4C853-B0FF-4467-B385-E2803D853164}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{D2745AE4-6E12-4D4D-B5D4-88CB07F7F7D8}" = protocol=17 | dir=in | app=e:\program files (x86)\sierra\fearcombat\fearmp.exe | 
"{D3D385F0-7844-42FE-83BE-BBA55E081B94}" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{E351BEDA-C975-46AB-B161-1BB812D460E6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E3EE07C7-CCD1-478F-899B-AD5CC464F8A3}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E87CFD64-C8B1-4B20-86B1-CE42221E9CB0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{EBE4D7D5-C5C5-4188-9381-9BE75DF50395}" = protocol=17 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\xr_3da.exe | 
"{ED11CAB6-C4BA-4D71-87D0-AEF5032139F3}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{F1C40E5E-A510-41D7-A124-F45FA57592E4}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{F4BC20CD-1FF1-4583-9588-90B10AF04E47}" = protocol=17 | dir=in | app=e:\program files (x86)\rockstar games\eflc\launcheflc.exe | 
"{F727242D-6C85-42C8-BECE-2DB466916219}" = protocol=6 | dir=in | app=e:\program files (x86)\thq\s.t.a.l.k.e.r. - shadow of chernobyl\bin\dedicated\xr_3da.exe | 
"{FE8698D5-3D93-430C-814F-8041C3E00777}" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steam.exe | 
"{FEC84996-CA99-4F92-8684-7D42279C551B}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"TCP Query User{1DE46F76-8130-4700-90A0-C1318380AB5E}E:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe | 
"TCP Query User{3DA85CEF-4447-415A-BBFB-DC16093853C2}E:\program files (x86)\tvants\tvants.exe" = protocol=6 | dir=in | app=e:\program files (x86)\tvants\tvants.exe | 
"TCP Query User{4EE5B384-9D83-469D-A0A8-BF9C86FFFC25}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"TCP Query User{641587D0-EF95-4160-9B5F-2E4B8C606C76}E:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe" = protocol=6 | dir=in | app=e:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe | 
"TCP Query User{73B2A950-7D88-4A7F-9880-EA28DEEFD5EB}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{76E2DFB1-6197-490A-88A5-3A49CEC7C428}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=6 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe | 
"TCP Query User{8312C046-B9EA-46C2-9F40-ABFFB3E4341F}E:\program files (x86)\game\fifa.exe" = protocol=6 | dir=in | app=e:\program files (x86)\game\fifa.exe | 
"TCP Query User{916222A0-9A51-47E0-8094-57E8A9E50A4E}E:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe" = protocol=6 | dir=in | app=e:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe | 
"TCP Query User{9310BEC2-C15A-4E42-9EB8-401CAD670223}E:\program files (x86)\xfire\xfire.exe" = protocol=6 | dir=in | app=e:\program files (x86)\xfire\xfire.exe | 
"TCP Query User{986F6CE8-DC5C-4D70-AD00-E4E55A79CB94}C:\program files (x86)\quicktime\quicktimeplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\quicktime\quicktimeplayer.exe | 
"TCP Query User{C72DA3D8-360E-4D13-82DC-D59B68D14A78}E:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe | 
"TCP Query User{DB836777-C13F-47A2-B28B-BB57B9926899}E:\program files (x86)\hlsw\hlsw.exe" = protocol=6 | dir=in | app=e:\program files (x86)\hlsw\hlsw.exe | 
"TCP Query User{DFBB08FF-0A7C-4D71-AAF1-DFF48A3EDC53}E:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe" = protocol=6 | dir=in | app=e:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe | 
"TCP Query User{E43C6925-AFE5-45E4-92D1-F141F79AA8DE}E:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe" = protocol=6 | dir=in | app=e:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe | 
"TCP Query User{EBF74D12-7F29-4C43-9A8F-39DDAEA60115}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=6 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe | 
"UDP Query User{149D8088-F1FD-4B74-9B58-33F108F97A94}E:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe" = protocol=17 | dir=in | app=e:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis64.exe | 
"UDP Query User{267B901A-31F5-45EF-86C3-AEA7E980EA68}E:\program files (x86)\xfire\xfire.exe" = protocol=17 | dir=in | app=e:\program files (x86)\xfire\xfire.exe | 
"UDP Query User{2CBCF193-C41C-49B4-B4CC-8EAEAAAB7678}E:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe" = protocol=17 | dir=in | app=e:\program files (x86)\black_box\assassin's creed 2\assassinscreediigame.exe | 
"UDP Query User{40A988F9-7E19-4C3F-929F-F48119ADB7DB}E:\program files (x86)\hlsw\hlsw.exe" = protocol=17 | dir=in | app=e:\program files (x86)\hlsw\hlsw.exe | 
"UDP Query User{5107539C-4503-4271-A55B-668AFEA47FEF}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=17 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe | 
"UDP Query User{57D9A238-5FCD-4995-B707-5108AD9FA2AC}E:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe" = protocol=17 | dir=in | app=e:\program files (x86)\tom clancy's rainbow six vegas 2\binaries\r6vegas2_game.exe | 
"UDP Query User{61A25EC7-0A39-4880-80FA-0739A7FB9619}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"UDP Query User{70E22CBC-BE8D-448F-8337-7FB2AC0670AD}E:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\team fortress 2\hl2.exe | 
"UDP Query User{C0A9BEDB-B2BB-41FE-AFEB-28CA880C39E0}E:\program files (x86)\tvants\tvants.exe" = protocol=17 | dir=in | app=e:\program files (x86)\tvants\tvants.exe | 
"UDP Query User{C16804AF-69E7-4A99-8E25-D829602281F7}C:\users\lukas\appdata\roaming\uvbe\oqod.exe" = protocol=17 | dir=in | app=c:\users\lukas\appdata\roaming\uvbe\oqod.exe | 
"UDP Query User{C2BC7265-6034-45E9-87D3-2EDCF0A2C7E9}E:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe" = protocol=17 | dir=in | app=e:\program files (x86)\ubisoft\splinter cell pandora tomorrow\pandora.exe | 
"UDP Query User{C49C6711-B0B1-491B-8FD0-BA4FF2EC6079}E:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe" = protocol=17 | dir=in | app=e:\program files (x86)\steam\steamapps\wachkoma\insurgency\hl2.exe | 
"UDP Query User{C9D3ECF4-2B02-4957-A975-2C2AC29C288F}E:\program files (x86)\game\fifa.exe" = protocol=17 | dir=in | app=e:\program files (x86)\game\fifa.exe | 
"UDP Query User{D8B65AC6-6829-4B3A-9257-70ABD59BE558}C:\program files (x86)\quicktime\quicktimeplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\quicktime\quicktimeplayer.exe | 
"UDP Query User{F1C3B84E-EBEE-463D-AF77-29908A2BA703}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01D57CF6-B5BC-4D03-AFF5-7960CFBD05A9}" = Native Instruments Guitar Rig 5
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0886900B-B2F3-452C-B580-60F1253F7F80}" = Native Instruments Controller Editor
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4700_series" = Canon iP4700 series Printer Driver
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{23170F69-40C1-2702-0465-000001000000}" = 7-Zip 4.65 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java(TM) 7 Update 3 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5552453B-BB76-45E3-973D-F95E458ED780}" = Native Instruments Kontakt 5
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{A792E67C-FDA4-A301-0C3C-53BA86EFBB5A}" = ccc-utility64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCF07271-A853-4D3A-B668-4B752174CAA8}" = iTunes
"{C6116410-5EC8-50DE-3F01-A0EC616E2468}" = ATI Catalyst Install Manager
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CFFF260C-F510-45BB-8F8E-1D4AC1232786}" = Adobe Photoshop Lightroom 3.3 64-bit
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"0B8B34F4BB96072BB79F86A0EDC21145F80BC191" = Windows-Treiberpaket - Focusrite USB 2.0 Audio Driver (01/05/2012 2.3.128.0)
"Alien Skin Exposure 3" = Alien Skin Exposure 3
"C-Media Oxygen HD Audio Driver" = ASUS Xonar D1 Audio Driver
"Focusrite USB 2.0 Audio Driver_is1" = Focusrite USB 2.0 Audio Driver 2.3
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"ONAIR_is1" = ONAIR 4.0.0.835
"PhotomatixPro3x64_is1" = Photomatix Pro version 3.2.5
"Recuva" = Recuva
"Sandboxie" = Sandboxie 3.44 (64-bit)
"SearchAnonymizer" = SearchAnonymizer
"VueScan" = VueScan
"Wingnut Lo-Fi" = Wingnut Lo-Fi
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{009AC76E-1A66-4682-82B7-417E77F3C648}" = Superior Drummer Installer
"{00B2E284-0B9A-33B4-7E91-BAFD1E35CAFE}" = TweetDeck
"{0197D136-598D-4968-BEEA-91C1B764F05D}" = Lexware buchhalter 2012
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{03534DA5-2F88-4B8E-A978-849B979E1B8F}" = TuxGuitar
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{063E409E-3D7C-4A4A-95AB-2F124B9224B3}" = ArcSoft PhotoImpression 6
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{14A487F2-1259-4E6C-AE3C-3C888DDBCB60}_is1" = Guitar Pro 6
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{1923679F-C14B-4790-BC54-EFA3FCDE147B}" = Lexware Elster
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D081AB0-B1CC-11E0-80C0-005056B12123}" = Haufe iDesk-Service
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{212D202D-487D-49C4-8A76-4D3BB91B8471}" = BOINC
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 30
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.009.00
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{47CAFF95-C3D8-ABF2-70BC-89DE00D8FB19}" = Catalyst Control Center Graphics Light
"{4962EBAC-AE7C-1B22-1EA0-0916A7E40954}" = Catalyst Control Center Graphics Full Existing
"{49A62E2B-B35C-941D-DF48-601207CF14C0}" = Catalyst Control Center Graphics Previews Common
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{5454083B-1308-4485-BF17-111000028701}" = Grand Theft Auto: Episodes from Liberty City
"{5454083B-1308-4485-BF17-111000028702}" = Grand Theft Auto: Episodes from Liberty City
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5866520C-8857-4986-833A-039F4584C3F7}" = Toontrack solo
"{61B8B2F9-D8DA-4B24-89A9-DB09F38A4899}" = Grand Theft Auto: Episodes From Liberty City
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A490E11-6C8A-777C-4E00-43F3CC16A1EC}" = CCC Help English
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{72736F5F-520D-472A-88CC-7B02872FD34E}" = ATI Catalyst Registration
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{75E607CF-7BAE-4B88-84B3-97F3DF44BA28}" = FEARCombat
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{77919701-C3E7-09AA-D2F7-DBF42CD7C13D}" = Catalyst Control Center HydraVision Full
"{78B2F09F-BDC7-7865-CF4C-233B64A3BE51}" = Catalyst Control Center Graphics Full New
"{79FE9434-81F4-4690-83D0-E0E1722EB7EA}" = Songwriters Pack 3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{8967ABFB-CBCA-4EC0-8DE8-A01135267C16}" = EZplayer pro
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0061-0407-0000-0000000FF1CE}" = Microsoft Office Home and Student 2010 - Deutsch
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{AE09704D-9051-4C25-B940-77F889F0C93F}" = OVTScanner_Vista64
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BF460607-4598-40DF-BEF9-62EB9083E887}" = Odd Monster MIDI Fills Pack
"{C0E8FE43-C35B-451D-B35F-D4BD056D70E7}" = Camtasia Studio 7
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C339CB05-05DE-37A1-52C3-5373BF3B662D}" = DestroyTwitter 2
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C670480D-10CE-4E2E-929E-EE453EDE6BE2}" = G Data InternetSecurity 2011
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = CanoScan Toolbox Ver4.9
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D241BBEC-B1C7-7953-EDDE-D90A654A8D2C}" = ccc-core-static
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D5B18B60-4FC3-42AD-A629-9CA10ACC06CD}" = HTC Sync
"{D5C24E77-099E-9B84-5BE2-708E70B938A9}" = Catalyst Control Center Core Implementation
"{D7F912D4-C237-4079-966A-5044A5025CBF}}_is1" = Focusrite Scarlett Plug-in Suite 1.1
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB1299AF-9EE0-422B-959E-F4171B2AE0F7}" = EZXDfh
"{DBAC777E-23A6-4862-B1F8-414119EA46DF}" = Rock Songs
"{DC4757E2-BAE3-0BFE-C6E5-576CB911FF52}" = Catalyst Control Center Graphics Previews Vista
"{DF344785-0900-471E-B9F5-6F28C89AF638}" = TAXMAN Bibliothek 2012
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E8FF78D0-4D1C-4B2D-AC80-670F135F5461}" = Poladroid
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F30787F6-EA4F-4BC8-0001-398BDCC33E1E}" = MovieSaver*3.0
"{F3C2ECAA-1B4D-4B75-9105-106B0D03EF02}" = Lexware Info Service
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA3FDB06-3368-4579-B2F2-5AE8AD6E7871}" = TAXMAN 2012
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"ABC Amber Audio Converter" = ABC Amber Audio Converter
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Akamai" = Akamai NetSession Interface Service
"Audacity_is1" = Audacity 1.2.6
"AviSynth" = AviSynth 2.5
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"Beneton Movie GIF_is1" = Beneton Movie GIF 1.1.2
"Bome's Mouse Keyboard_is1" = Bome's Mouse Keyboard 2.00
"Canon iP4700 series Benutzerregistrierung" = Canon iP4700 series Benutzerregistrierung
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.destroytoday.destroytwitter" = DestroyTwitter 2
"dBpoweramp [Calculate Audio CRC] Codec" = dBpoweramp [Calculate Audio CRC] Codec
"dBpoweramp Dalet Codec" = dBpoweramp Dalet Codec
"dBpoweramp FLAC Codec" = dBpoweramp FLAC Codec
"dBpoweramp m4a Codec" = dBpoweramp m4a Codec
"dBpoweramp Monkeys Audio Codec" = dBpoweramp Monkeys Audio Codec
"dBpoweramp Mp2 and BwfMp2 codec" = dBpoweramp Mp2 and BwfMp2 codec
"dBpoweramp mp3 (Fraunhofer IIS) Codec" = dBpoweramp mp3 (Fraunhofer IIS) Codec
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"dBpoweramp Ogg Vorbis Codec" = dBpoweramp Ogg Vorbis Codec
"dBpoweramp Real Audio (Helix) Encoder" = dBpoweramp Real Audio (Helix) Encoder
"dBPoweramp tooLame MP2 codec" = dBPoweramp tooLame MP2 codec
"dBpoweramp Wave64 Codec" = dBpoweramp Wave64 Codec
"dBpoweramp WavPack Codec" = dBpoweramp WavPack Codec
"ElsterFormular für Privatanwender 12.3.2.6814p" = ElsterFormular für Privatanwender
"FeedReader_is1" = FeedReader
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 5.0.6.221
"FXpansion BFD2" = FXpansion BFD2
"GIF Animator" = Microsoft GIF Animator
"Groove Monkee Power Rock" = Groove Monkee Power Rock
"Groove Monkee Progressive" = Groove Monkee Progressive
"Groove Monkee Rock" = Groove Monkee Rock
"Groove Monkee Rock 3" = Groove Monkee Rock 3
"Guitar Explorer 1.0" = Guitar Explorer 1.0
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"JDownloader" = JDownloader
"LastFM Motorokr Screensaver" = LastFM Motorokr Screensaver
"LoopBe1" = LoopBe1 - Internal MIDI Port
"Magic DVD Ripper_is1" = Magic DVD Ripper V5.5.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Movies" = Movies
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Native Instruments Controller Editor" = Native Instruments Controller Editor
"Native Instruments Guitar Rig 5" = Native Instruments Guitar Rig 5
"Native Instruments Kontakt 5" = Native Instruments Kontakt 5
"Native Instruments Service Center" = Native Instruments Service Center
"NAVIGON Fresh" = NAVIGON Fresh 3.4.1
"NirSoft VideoCacheView" = NirSoft VideoCacheView
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OpenAL" = OpenAL
"PandoraRecovery" = PandoraRecovery (Remove Only)
"pepakura_viewer3en" = Pepakura Viewer 3
"PreSonus Studio One 2" = PreSonus Studio One 2
"Recover My Files_is1" = Recover My Files
"R-Studio 5.2NSIS" = R-Studio 5.2
"SpeedFan" = SpeedFan (remove only)
"Steam App 300" = Day of Defeat: Source
"Steam App 440" = Team Fortress 2
"Steam App 730" = Counter-Strike: Global Offensive Beta
"SUPER ©" = SUPER © Version 2010.bld.38 (May 2, 2010)
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"Ultravnc2_is1" = UltraVnc
"Vidomi" = Vidomi (remove only)
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"Virtual MIDI Piano Keyboard" = Virtual MIDI Piano Keyboard
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"Spotify" = Spotify
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 07.10.2011 09:06:27 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
 (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
 "e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der
 Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 07.10.2011 18:44:41 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
 (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
 "e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der
 Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 08.10.2011 09:22:28 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
 DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.  
 
Error - 08.10.2011 11:37:15 | Computer Name = Lukas-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AmazonMP3Downloader.exe, Version:
 1.0.0.0, Zeitstempel: 0x4b5a479c  Name des fehlerhaften Moduls: ntdll.dll, Version:
 6.1.7600.16695, Zeitstempel: 0x4cc7ab86  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00038db9
ID
 des fehlerhaften Prozesses: 0x1280  Startzeit der fehlerhaften Anwendung: 0x01cc85cff6bf7666
Pfad
 der fehlerhaften Anwendung: e:\Program Files (x86)\Amazon\MP3 Downloader\AmazonMP3Downloader.exe
Pfad
 des fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung: 65cb5c41-f1c3-11e0-aeb3-e0cb4ec3aad7
 
Error - 08.10.2011 18:35:55 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
 (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
 "e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der
 Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 09.10.2011 04:37:18 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
 DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.  
 
Error - 10.10.2011 05:37:54 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
 DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.  
 
Error - 10.10.2011 10:00:56 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
 (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
 "e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der
 Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
 
Error - 11.10.2011 08:50:04 | Computer Name = Lukas-PC | Source = CVHSVC | ID = 100
Description = Nur zur Information.  (Patch task for {90140011-0061-0407-0000-0000000FF1CE}):
 DownloadLatest Failed: Die Serververbindung konnte nicht hergestellt werden.  
 
Error - 11.10.2011 15:00:16 | Computer Name = Lukas-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\program files
 (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
 "e:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der
 Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.
 
[ System Events ]
Error - 17.09.2012 14:20:33 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 17.09.2012 14:20:35 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 17.09.2012 14:20:54 | Computer Name = Lukas-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 17.09.2012 14:20:54 | Computer Name = Lukas-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 17.09.2012 14:20:54 | Computer Name = Lukas-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
 
< End of report >
         

Alt 18.09.2012, 03:49   #2
t'john
/// Helfer-Team
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit





Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
ATTFilter
:OTL
SRV - [2012.09.10 21:54:05 | 004,537,664 | ---- | M] () [Auto | Stopped] -- c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll -- (Akamai) 
SRV - [2011.05.26 21:28:56 | 000,040,960 | ---- | M] () [Auto | Stopped] -- C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe -- (SearchAnonymizer) 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - No CLSID value found 
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKCU\..\SearchScopes\{0259B413-E84B-4C02-9409-6D3D00205873}: "URL" = http://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F464F524D3D4945464D3126713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0 
IE - HKCU\..\SearchScopes\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}: "URL" = http://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 
IE - HKCU\..\SearchScopes\{12F10CC7-00CE-420D-911F-96F182B8225B}: "URL" = http://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 
IE - HKCU\..\SearchScopes\{2B0E84CC-90FE-4913-B7AF-096971E474A7}: "URL" = http://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 
IE - HKCU\..\SearchScopes\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}: "URL" = http://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E636F6E647569742E636F6D2F526573756C74734578742E617370783F713D7B7365617263685465726D737D26536561726368536F757263653D3426637469643D435432333034313537&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&k=0 
IE - HKCU\..\SearchScopes\{C0058E40-BD96-4946-A978-D98908C6C9F0}: "URL" = http://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=9275a0c1-4ad7-4562-9c08-98095c7fb6b3&pid=freewarede&mode=bounce&k=0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421; 
FF - prefs.js..browser.search.defaultenginename: "Bing" 
FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search" 
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=IEFM1&q=" 
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://de.gopro.com/|http://www.guardian.co.uk/|http://uk.yahoo.com/" 
FF - prefs.js..extensions.enabledAddons: artur.dubovoy@gmail.com:3.6.2 
FF - prefs.js..extensions.enabledAddons: ffextension@weheartit.com:2.3.1 
FF - prefs.js..extensions.enabledAddons: foxmarks@kei.com:4.0.5 
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.2 
FF - prefs.js..extensions.enabledAddons: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.5 
FF - prefs.js..extensions.enabledAddons: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17 
FF - prefs.js..extensions.enabledAddons: {906305f7-aafc-45e9-8bbd-941950a84dad}:1.1.11215.1124 
FF - prefs.js..extensions.enabledAddons: {9051303c-7e41-4311-a783-d6fe5ef2832d}:14.0.4 
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.10 
FF - prefs.js..extensions.enabledItems: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.3 
FF - prefs.js..extensions.enabledItems: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997 
FF - prefs.js..extensions.enabledItems: X-pireprototype@x-pire.net:1.0 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 
FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=IEFM1&q=" 
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\Users\\Lukas\\AppData\\Local\\Temp\\proxtube.pac" 
FF - prefs.js..network.proxy.type: 0 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
O2 - BHO: (no name) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - No CLSID value found. 
O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) 
O4 - HKCU..\Run: [AdobeBridge] File not found 
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Lukas\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) 
O4 - HKCU..\Run: [SpybotSD TeaTimer] e:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe File not found 
O4 - HKCU..\Run: [UIRibbon] C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0) 
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) 
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) 
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2012.04.23 16:38:12 | 000,000,135 | ---- | M] () - F:\autorun.inf -- [ FAT32 ] 
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] 

@Alternate Data Stream - 143 bytes -> C:\ProgramData\Temp:63238B95 
[2011.05.26 21:29:01 | 000,001,123 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\conduit.xml 
[2011.05.26 22:27:22 | 000,001,030 | ---- | M] () -- C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\wikipedia-de.xml 
[2012.05.04 10:14:47 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012.05.04 10:14:47 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml 
[2012.05.04 10:14:47 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012.05.04 10:14:47 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012.05.04 10:14:47 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml 
[2012.08.29 11:52:58 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml 
[2012.09.17 01:15:01 | 000,000,000 | ---D | C] -- C:\Users\Lukas\AppData\Roaming\hellomoto 
[2010.06.19 20:43:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat 
[2012.07.09 19:39:42 | 000,000,000 | ---D | M] -- C:\Users\Lukas\AppData\Roaming\Babylon 

:Files
C:\Users\Lukas\AppData\Roaming\Uvbe\
C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Lukas\*.tmp
C:\Users\Lukas\AppData\Local\{*}
C:\Users\Lukas\AppData\Local\Temp\*.exe
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

3. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.



4. Schritt
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.
__________________

__________________

Alt 18.09.2012, 16:14   #3
jar31
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Hallo,
schonmal vielen Dank.
Hier die logs:


OTL-Fix:

Code:
ATTFilter
All processes killed
========== OTL ==========
Service Akamai stopped successfully!
Service Akamai deleted successfully!
c:\program files (x86)\common files\akamai/netsession_win_5891ae0.dll moved successfully.
Service SearchAnonymizer stopped successfully!
Service SearchAnonymizer deleted successfully!
C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0259B413-E84B-4C02-9409-6D3D00205873}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0259B413-E84B-4C02-9409-6D3D00205873}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BD5909D-F694-4D73-A6F2-E230CF17EA97}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{12F10CC7-00CE-420D-911F-96F182B8225B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12F10CC7-00CE-420D-911F-96F182B8225B}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2B0E84CC-90FE-4913-B7AF-096971E474A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B0E84CC-90FE-4913-B7AF-096971E474A7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4AFDB8AA-7B4C-41B0-8371-ACBD138A77A2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C0058E40-BD96-4946-A978-D98908C6C9F0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C0058E40-BD96-4946-A978-D98908C6C9F0}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Bing" removed from browser.search.defaultenginename
Prefs.js: "XfireXO Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://www.bing.com/search?FORM=IEFM1&q=" removed from browser.search.defaulturl
Prefs.js: "Wikipedia (de)" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://de.gopro.com/|hxxp://www.guardian.co.uk/|hxxp://uk.yahoo.com/" removed from browser.startup.homepage
Prefs.js: artur.dubovoy@gmail.com:3.6.2 removed from extensions.enabledAddons
Prefs.js: ffextension@weheartit.com:2.3.1 removed from extensions.enabledAddons
Prefs.js: foxmarks@kei.com:4.0.5 removed from extensions.enabledAddons
Prefs.js: ich@maltegoetz.de:1.4.2 removed from extensions.enabledAddons
Prefs.js: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.5 removed from extensions.enabledAddons
Prefs.js: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.17 removed from extensions.enabledAddons
Prefs.js: {906305f7-aafc-45e9-8bbd-941950a84dad}:1.1.11215.1124 removed from extensions.enabledAddons
Prefs.js: {9051303c-7e41-4311-a783-d6fe5ef2832d}:14.0.4 removed from extensions.enabledAddons
Prefs.js: foxmarks@kei.com:3.9.10 removed from extensions.enabledItems
Prefs.js: {11483926-db67-4190-91b1-ef20fcec5f33}:0.4.3 removed from extensions.enabledItems
Prefs.js: {8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}:0.16 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 removed from extensions.enabledItems
Prefs.js: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:21.1.10084.997 removed from extensions.enabledItems
Prefs.js: X-pireprototype@x-pire.net:1.0 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 removed from extensions.enabledItems
Prefs.js: "hxxp://www.bing.com/search?FORM=IEFM1&q=" removed from keyword.URL
Prefs.js: "file:///C:\\Users\\Lukas\\AppData\\Local\\Temp\\proxtube.pac" removed from network.proxy.autoconfig_url
Prefs.js: 0 removed from network.proxy.type
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Ocs_SM deleted successfully.
C:\Users\Lukas\AppData\Roaming\OCS\SM\SearchAnonymizer.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Akamai NetSession Interface deleted successfully.
C:\Users\Lukas\AppData\Local\Akamai\netsession_win.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\UIRibbon deleted successfully.
C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
F:\autorun.inf moved successfully.
C:\Windows\SysWow64\tmpF8B0.tmp deleted successfully.
C:\Windows\SysWow64\tmpF8E0.tmp deleted successfully.
ADS C:\ProgramData\Temp:63238B95 deleted successfully.
C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\conduit.xml moved successfully.
C:\Users\Lukas\AppData\Roaming\mozilla\firefox\profiles\wp4l5jes.default\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully.
C:\Users\Lukas\AppData\Roaming\hellomoto folder moved successfully.
C:\ProgramData\ezsidmv.dat moved successfully.
C:\Users\Lukas\AppData\Roaming\Babylon folder moved successfully.
========== FILES ==========
C:\Users\Lukas\AppData\Roaming\Uvbe folder moved successfully.
C:\Users\Lukas\AppData\Local\Microsoft\Windows\1646 folder moved successfully.
File\Folder C:\ProgramData\*.exe not found.
C:\ProgramData\TEMP folder moved successfully.
File\Folder C:\Users\Lukas\*.tmp not found.
C:\Users\Lukas\AppData\Local\{0B8AB97F-8378-4041-B663-A58D10B77C51} folder moved successfully.
C:\Users\Lukas\AppData\Local\{1E60FB72-9257-40C6-AFB6-CC65D239E74F} folder moved successfully.
C:\Users\Lukas\AppData\Local\Temp\SkypeSetup.exe moved successfully.
C:\Users\Lukas\AppData\Local\Temp\vcredist_x64.exe moved successfully.
C:\Users\Lukas\AppData\Local\Temp\vcredist_x86.exe moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Lukas\Desktop\cmd.bat deleted successfully.
C:\Users\Lukas\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56468 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Lukas
->Temp folder emptied: 15243623 bytes
->Temporary Internet Files folder emptied: 23909379 bytes
->FireFox cache emptied: 95468682 bytes
->Flash cache emptied: 323192 bytes
 
User: Lukas2
->Temp folder emptied: 114985 bytes
->Temporary Internet Files folder emptied: 33223 bytes
->Flash cache emptied: 56468 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11211843 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 102360 bytes
RecycleBin emptied: 4805317246 bytes
 
Total Files Cleaned = 4.722,00 mb
 
 
OTL by OldTimer - Version 3.2.61.5 log created on 09182012_141045

Files\Folders moved on Reboot...
C:\Users\Lukas\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
         

Malwarebytes-Log:

Code:
ATTFilter
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.18.02

Windows 7 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7600.16385
Lukas :: LUKAS-PC [Administrator]

18.09.2012 14:19:20
mbam-log-2012-09-18 (14-19-20).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 682926
Laufzeit: 1 Stunde(n), 1 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\09182012_141045\C_Users\Lukas\AppData\Local\Microsoft\Windows\1646\UIRibbon.exe (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

AdwCleaner[R1]

Code:
ATTFilter
# AdwCleaner v2.002 - Datei am 09/18/2012 um 16:00:12 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows 7 Professional  (64 bits)
# Benutzer : Lukas - LUKAS-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Lukas\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\user.js
Ordner Gefunden : C:\Program Files (x86)\Yontoo
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\ProgramData\boost_interprocess
Ordner Gefunden : C:\ProgramData\Tarma Installer
Ordner Gefunden : C:\Users\Lukas\AppData\LocalLow\BabylonToolbar
Ordner Gefunden : C:\Users\Lukas\AppData\LocalLow\Conduit
Ordner Gefunden : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\Conduit

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\b
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Products\3192AA38321C641458DBDAF83979D193
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gefunden : HKLM\SOFTWARE\Tarma Installer

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v15.0 (de)

Profilname : default 
Datei : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\prefs.js

Gefunden : user_pref("CT2304157.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gefunden : user_pref("CT2304157.CTID", "CT2304157");
Gefunden : user_pref("CT2304157.CurrentServerDate", "4-3-2010");
Gefunden : user_pref("CT2304157.DialogsAlignMode", "LTR");
Gefunden : user_pref("CT2304157.FeedLastCount129078895246717929", 20);
Gefunden : user_pref("CT2304157.FeedLastCount129095439763593837", 20);
Gefunden : user_pref("CT2304157.FeedPollDate129078895250311712", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gefunden : user_pref("CT2304157.FeedPollDate129095439763593837", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gefunden : user_pref("CT2304157.FeedTTL129078895250311712", 40);
Gefunden : user_pref("CT2304157.FirstServerDate", "4-3-2010");
Gefunden : user_pref("CT2304157.FirstTime", true);
Gefunden : user_pref("CT2304157.FirstTimeFF3", true);
Gefunden : user_pref("CT2304157.GroupingServerCheckInterval", 1440);
Gefunden : user_pref("CT2304157.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gefunden : user_pref("CT2304157.Initialize", true);
Gefunden : user_pref("CT2304157.InitializeCommonPrefs", true);
Gefunden : user_pref("CT2304157.InstalledDate", "Thu Mar 04 2010 15:06:13 GMT+0100");
Gefunden : user_pref("CT2304157.IsGrouping", false);
Gefunden : user_pref("CT2304157.IsMulticommunity", false);
Gefunden : user_pref("CT2304157.IsOpenThankYouPage", true);
Gefunden : user_pref("CT2304157.IsOpenUninstallPage", true);
Gefunden : user_pref("CT2304157.LanguagePackLastCheckTime", "Thu Mar 04 2010 15:06:12 GMT+0100");
Gefunden : user_pref("CT2304157.LanguagePackReloadIntervalMM", 1440);
Gefunden : user_pref("CT2304157.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gefunden : user_pref("CT2304157.LastLogin_2.5.6.0", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gefunden : user_pref("CT2304157.LatestVersion", "2.1.0.18");
Gefunden : user_pref("CT2304157.Locale", "en");
Gefunden : user_pref("CT2304157.LoginCache", 4);
Gefunden : user_pref("CT2304157.MCDetectTooltipHeight", "83");
Gefunden : user_pref("CT2304157.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gefunden : user_pref("CT2304157.MCDetectTooltipWidth", "295");
Gefunden : user_pref("CT2304157.SHRINK_TOOLBAR", 1);
Gefunden : user_pref("CT2304157.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Gefunden : user_pref("CT2304157.SearchFromAddressBarIsInit", true);
Gefunden : user_pref("CT2304157.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT230[...]
Gefunden : user_pref("CT2304157.SearchInNewTabEnabled", true);
Gefunden : user_pref("CT2304157.SearchInNewTabIntervalMM", 1440);
Gefunden : user_pref("CT2304157.SearchInNewTabLastCheckTime", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gefunden : user_pref("CT2304157.SearchInNewTabServiceUrl", "hxxp://hosting.conduit-services.com/newtab/?ctid=EB[...]
Gefunden : user_pref("CT2304157.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gefunden : user_pref("CT2304157.SettingsCheckIntervalMin", 120);
Gefunden : user_pref("CT2304157.SettingsLastCheckTime", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gefunden : user_pref("CT2304157.SettingsLastUpdate", "1267047404");
Gefunden : user_pref("CT2304157.ThirdPartyComponentsInterval", 504);
Gefunden : user_pref("CT2304157.ThirdPartyComponentsLastCheck", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gefunden : user_pref("CT2304157.ThirdPartyComponentsLastUpdate", "1267047404");
Gefunden : user_pref("CT2304157.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gefunden : user_pref("CT2304157.Uninstall", true);
Gefunden : user_pref("CT2304157.UserID", "UN98113723905454135");
Gefunden : user_pref("CT2304157.alertChannelId", "700614");
Gefunden : user_pref("CT2304157.clientLogIsEnabled", false);
Gefunden : user_pref("CT2304157.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gefunden : user_pref("CT2304157.myStuffEnabled", true);
Gefunden : user_pref("CT2304157.myStuffPublihserMinWidth", 400);
Gefunden : user_pref("CT2304157.myStuffSearchUrl", "hxxp://search.conduit.com/Results.aspx?q=SEARCH_TERM&ctid=E[...]
Gefunden : user_pref("CT2304157.myStuffServiceIntervalMM", 1440);
Gefunden : user_pref("CT2304157.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gefunden : user_pref("CT2304157.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gefunden : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Gefunden : user_pref("CommunityToolbar.ToolbarsList", "CT2304157");
Gefunden : user_pref("CommunityToolbar.ToolbarsList2", "CT2304157");
Gefunden : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2304157");
Gefunden : user_pref("CommunityToolbar.twitter.user_21817319.LastCheckTime", "Thu Mar 04 2010 15:06:07 GMT+0100[...]
Gefunden : user_pref("FlashVD.cache.video", "hxxp://vids.myspace.com\nhxxp://www.yourfilehost.com\nhxxp://www.m[...]
Gefunden : user_pref("extensions.BabylonToolbar.admin", false);
Gefunden : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gefunden : user_pref("extensions.BabylonToolbar.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar.babTrack", "affID=109683&tt=010712_7");
Gefunden : user_pref("extensions.BabylonToolbar.bbDpng", 9);
Gefunden : user_pref("extensions.BabylonToolbar.dfltSrch", false);
Gefunden : user_pref("extensions.BabylonToolbar.hmpg", false);
Gefunden : user_pref("extensions.BabylonToolbar.id", "74f0d57a000000000000e0cb4ec3aad7");
Gefunden : user_pref("extensions.BabylonToolbar.instlDay", "15530");
Gefunden : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gefunden : user_pref("extensions.BabylonToolbar.lastDP", 9);
Gefunden : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1719:40:13");
Gefunden : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "13.0");
Gefunden : user_pref("extensions.BabylonToolbar.newTab", true);
Gefunden : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Gefunden : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Gefunden : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gefunden : user_pref("extensions.BabylonToolbar.propectorlck", 80415650);
Gefunden : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gefunden : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Gefunden : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gefunden : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");
Gefunden : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1719:40:13");
Gefunden : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");
Gefunden : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Gefunden : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gefunden : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109683&tt=010712_7");
Gefunden : user_pref("extensions.BabylonToolbar_i.hardId", "74f0d57a000000000000e0cb4ec3aad7");
Gefunden : user_pref("extensions.BabylonToolbar_i.id", "74f0d57a000000000000e0cb4ec3aad7");
Gefunden : user_pref("extensions.BabylonToolbar_i.instlDay", "15530");
Gefunden : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Gefunden : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Gefunden : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Gefunden : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gefunden : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1719:40:13");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

*************************

AdwCleaner[R1].txt - [14415 octets] - [18/09/2012 16:00:12]

########## EOF - C:\AdwCleaner[R1].txt - [14476 octets] ##########
         

AdwCleaner[S1]

Code:
ATTFilter
# AdwCleaner v2.002 - Datei am 09/18/2012 um 16:00:56 erstellt
# Aktualisiert am 16/09/2012 von Xplode
# Betriebssystem : Windows 7 Professional  (64 bits)
# Benutzer : Lukas - LUKAS-PC
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\Lukas\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\user.js
Ordner Gelöscht : C:\Program Files (x86)\Yontoo
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\Lukas\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Lukas\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\Conduit

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\b
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\3192AA38321C641458DBDAF83979D193
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7600.16385

Wiederhergestellt : [HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0 (de)

Profilname : default 
Datei : C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\prefs.js

C:\Users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wp4l5jes.default\user.js ... Gelöscht !

Gelöscht : user_pref("CT2304157.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT2304157.CTID", "CT2304157");
Gelöscht : user_pref("CT2304157.CurrentServerDate", "4-3-2010");
Gelöscht : user_pref("CT2304157.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT2304157.FeedLastCount129078895246717929", 20);
Gelöscht : user_pref("CT2304157.FeedLastCount129095439763593837", 20);
Gelöscht : user_pref("CT2304157.FeedPollDate129078895250311712", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gelöscht : user_pref("CT2304157.FeedPollDate129095439763593837", "Thu Mar 04 2010 15:06:07 GMT+0100");
Gelöscht : user_pref("CT2304157.FeedTTL129078895250311712", 40);
Gelöscht : user_pref("CT2304157.FirstServerDate", "4-3-2010");
Gelöscht : user_pref("CT2304157.FirstTime", true);
Gelöscht : user_pref("CT2304157.FirstTimeFF3", true);
Gelöscht : user_pref("CT2304157.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT2304157.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT2304157.Initialize", true);
Gelöscht : user_pref("CT2304157.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT2304157.InstalledDate", "Thu Mar 04 2010 15:06:13 GMT+0100");
Gelöscht : user_pref("CT2304157.IsGrouping", false);
Gelöscht : user_pref("CT2304157.IsMulticommunity", false);
Gelöscht : user_pref("CT2304157.IsOpenThankYouPage", true);
Gelöscht : user_pref("CT2304157.IsOpenUninstallPage", true);
Gelöscht : user_pref("CT2304157.LanguagePackLastCheckTime", "Thu Mar 04 2010 15:06:12 GMT+0100");
Gelöscht : user_pref("CT2304157.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT2304157.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT2304157.LastLogin_2.5.6.0", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gelöscht : user_pref("CT2304157.LatestVersion", "2.1.0.18");
Gelöscht : user_pref("CT2304157.Locale", "en");
Gelöscht : user_pref("CT2304157.LoginCache", 4);
Gelöscht : user_pref("CT2304157.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT2304157.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT2304157.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT2304157.SHRINK_TOOLBAR", 1);
Gelöscht : user_pref("CT2304157.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Gelöscht : user_pref("CT2304157.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT2304157.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT230[...]
Gelöscht : user_pref("CT2304157.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT2304157.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT2304157.SearchInNewTabLastCheckTime", "Thu Mar 04 2010 15:06:15 GMT+0100");
Gelöscht : user_pref("CT2304157.SearchInNewTabServiceUrl", "hxxp://hosting.conduit-services.com/newtab/?ctid=EB[...]
Gelöscht : user_pref("CT2304157.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Gelöscht : user_pref("CT2304157.SettingsCheckIntervalMin", 120);
Gelöscht : user_pref("CT2304157.SettingsLastCheckTime", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gelöscht : user_pref("CT2304157.SettingsLastUpdate", "1267047404");
Gelöscht : user_pref("CT2304157.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT2304157.ThirdPartyComponentsLastCheck", "Thu Mar 04 2010 15:06:06 GMT+0100");
Gelöscht : user_pref("CT2304157.ThirdPartyComponentsLastUpdate", "1267047404");
Gelöscht : user_pref("CT2304157.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]
Gelöscht : user_pref("CT2304157.Uninstall", true);
Gelöscht : user_pref("CT2304157.UserID", "UN98113723905454135");
Gelöscht : user_pref("CT2304157.alertChannelId", "700614");
Gelöscht : user_pref("CT2304157.clientLogIsEnabled", false);
Gelöscht : user_pref("CT2304157.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Gelöscht : user_pref("CT2304157.myStuffEnabled", true);
Gelöscht : user_pref("CT2304157.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT2304157.myStuffSearchUrl", "hxxp://search.conduit.com/Results.aspx?q=SEARCH_TERM&ctid=E[...]
Gelöscht : user_pref("CT2304157.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT2304157.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT2304157.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]
Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2304157");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2304157");
Gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2304157");
Gelöscht : user_pref("CommunityToolbar.twitter.user_21817319.LastCheckTime", "Thu Mar 04 2010 15:06:07 GMT+0100[...]
Gelöscht : user_pref("FlashVD.cache.video", "hxxp://vids.myspace.com\nhxxp://www.yourfilehost.com\nhxxp://www.m[...]
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=109683&tt=010712_7");
Gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", 9);
Gelöscht : user_pref("extensions.BabylonToolbar.dfltSrch", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", false);
Gelöscht : user_pref("extensions.BabylonToolbar.id", "74f0d57a000000000000e0cb4ec3aad7");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15530");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.lastDP", 9);
Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1719:40:13");
Gelöscht : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "13.0");
Gelöscht : user_pref("extensions.BabylonToolbar.newTab", true);
Gelöscht : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");
Gelöscht : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.propectorlck", 80415650);
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.ptch_0717", true);
Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1719:40:13");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109683&tt=010712_7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.hardId", "74f0d57a000000000000e0cb4ec3aad7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.id", "74f0d57a000000000000e0cb4ec3aad7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlDay", "15530");
Gelöscht : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1719:40:13");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

*************************

AdwCleaner[R1].txt - [14530 octets] - [18/09/2012 16:00:12]
AdwCleaner[S1].txt - [15234 octets] - [18/09/2012 16:00:56]

########## EOF - C:\AdwCleaner[S1].txt - [15295 octets] ##########
         

Lg
jar31
__________________

Alt 19.09.2012, 18:37   #4
t'john
/// Helfer-Team
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Sehr gut!

Wie laeuft der Rechner?


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
Mfg, t'john
Das TB unterstützen

Alt 20.09.2012, 16:41   #5
jar31
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Pc läuft soweit gut und ohne Probleme im normalen Windows Modus.

Hier der Log:

Code:
ATTFilter
Emsisoft Anti-Malware - Version 7.0
Letztes Update: 20.09.2012 14:08:53

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, E:\, Q:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn:	20.09.2012 14:09:22


Gescannt	776315
Gefunden	0

Scan Ende:	20.09.2012 16:25:04
Scan Zeit:	2:15:42
         


Alt 21.09.2012, 20:40   #6
t'john
/// Helfer-Team
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
--> BKA-Trojaner V. 1.15 - Windows 7 64bit

Alt 22.09.2012, 18:06   #7
jar31
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



ESET Log:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=02a5596acd97d741b2de70536559432d
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-09-22 04:01:55
# local_time=2012-09-22 06:01:55 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=4096 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 176648 99948853 0 0
# compatibility_mode=8192 67108863 100 0 350 350 0 0
# scanned=606613
# found=1
# cleaned=1
# scan_time=10712
C:\_OTL\MovedFiles\09182012_141045\C_Users\Lukas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\1620ca11-4f0ac0a9	multiple threats (deleted - quarantined)	00000000000000000000000000000000	C
         

lg,
jar31

Alt 22.09.2012, 21:05   #8
t'john
/// Helfer-Team
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 7 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck



Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck
__________________
Mfg, t'john
Das TB unterstützen

Alt 22.09.2012, 23:22   #9
jar31
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Hallo,

Code:
ATTFilter
PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 15.0.1 ist aktuell

    Flash 11,0,1,152 ist veraltet!
    Aktualisieren Sie bitte auf die neueste Version!

    Java (1,7,0,7) ist aktuell.

    Adobe Reader 9,4,3,231 ist veraltet!
    Aktualisieren Sie bitte auf die neueste Version: 10,1,3
         
Und nachdem ich das Java Plug-in deaktiviert habe:

Code:
ATTFilter
PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 15.0.1 ist aktuell

    Flash 11,0,1,152 ist veraltet!
    Aktualisieren Sie bitte auf die neueste Version!

    Java ist Installiert aber nicht aktiviert.

    Adobe Reader 9,4,3,231 ist veraltet!
    Aktualisieren Sie bitte auf die neueste Version: 10,1,3
         

Ich nehme mal an, ich soll meine Flash & Adobe Reader Version aktualisieren?



// Edit:


Habe jetzt mal alles aktualisiert:

Code:
ATTFilter
PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 15.0.1 ist aktuell

    Flash (11,4,402,278) ist aktuell.

    Java ist Installiert aber nicht aktiviert.

    Adobe Reader 10,1,4,38 ist aktuell.
         

Geändert von jar31 (22.09.2012 um 23:35 Uhr)

Alt 25.09.2012, 12:20   #10
t'john
/// Helfer-Team
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Uninstall.
  • Bestätige mit Ja.




Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

  • Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
  • temporäre Dateien löschen.




Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?
__________________
Mfg, t'john
Das TB unterstützen

Alt 25.09.2012, 13:05   #11
jar31
 
BKA-Trojaner V. 1.15 - Windows 7 64bit - Standard

BKA-Trojaner V. 1.15 - Windows 7 64bit



Super! - vielen Dank :-)

Antwort

Themen zu BKA-Trojaner V. 1.15 - Windows 7 64bit
7-zip, antivirus, audacity, bankguard, bho, bildschirm, black, bonjour, converter, error, failed, fehler, festplatte, firefox, flash player, grand theft auto, install.exe, jdownloader, logfile, mozilla, ntdll.dll, object, progressive, realtek, recuva, registry, richtlinie, safer networking, scan, security, sierra, software, spotify web helper, starten, svchost.exe, system, taskmanager, trojaner, usb 2.0, vdeck.exe, windows, yontoo



Ähnliche Themen: BKA-Trojaner V. 1.15 - Windows 7 64bit


  1. Windows 8.1 64bit Trojaner wohlmöglich
    Log-Analyse und Auswertung - 07.08.2015 (3)
  2. Windows 7 64bit BKA Browser Trojaner
    Log-Analyse und Auswertung - 18.01.2014 (5)
  3. Windows 8.1 Prof 64Bit und GVU-Trojaner
    Plagegeister aller Art und deren Bekämpfung - 02.01.2014 (3)
  4. GVU-Trojaner Windows 8 / FRST 64bit
    Log-Analyse und Auswertung - 31.10.2013 (11)
  5. GVU/Interpol Trojaner auf Windows 7 64Bit
    Plagegeister aller Art und deren Bekämpfung - 22.09.2013 (13)
  6. Windows 8 64bit GVU-Trojaner
    Log-Analyse und Auswertung - 27.08.2013 (9)
  7. GVU Trojaner Windows 7 64bit
    Log-Analyse und Auswertung - 03.06.2013 (13)
  8. GVU Trojaner auf Windows 7 64bit
    Log-Analyse und Auswertung - 24.09.2012 (1)
  9. GVU 2.07 Trojaner, Windows 7, 64bit
    Log-Analyse und Auswertung - 17.09.2012 (4)
  10. GVU-Trojaner 2.07 / Windows 7 64bit
    Log-Analyse und Auswertung - 06.09.2012 (13)
  11. GVU-Trojaner 2.07 auf Windows 7 (64bit)
    Log-Analyse und Auswertung - 30.08.2012 (12)
  12. Windows 7 (64bit): BKA-Trojaner v. 2.07
    Plagegeister aller Art und deren Bekämpfung - 07.08.2012 (16)
  13. gvu trojaner 2.07 auf windows 7 64bit
    Log-Analyse und Auswertung - 30.07.2012 (3)
  14. BKA- Trojaner auf Windows 7 Ultimate N 64Bit
    Plagegeister aller Art und deren Bekämpfung - 13.07.2012 (3)
  15. Verschlüsselungs Trojaner Windows 7 64bit
    Log-Analyse und Auswertung - 25.05.2012 (7)
  16. Windows 7 (64bit) Virus/Trojaner (evtl. Windows Verschlüsselungs Trojaner)
    Plagegeister aller Art und deren Bekämpfung - 07.05.2012 (19)
  17. Ukash Trojaner Windows 7 64bit
    Plagegeister aller Art und deren Bekämpfung - 02.04.2012 (3)

Zum Thema BKA-Trojaner V. 1.15 - Windows 7 64bit - Hallo! Gestern tauchte bei mir auch der BKA Trojaner (V. 1.15, laut bka-trojaner.de) auf. Als Anti-Viren Software benutze ich G Data Internet Security 2011 (immer auf dem neusten Signatur-Stand) Nachdem - BKA-Trojaner V. 1.15 - Windows 7 64bit...
Archiv
Du betrachtest: BKA-Trojaner V. 1.15 - Windows 7 64bit auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.