Incredibar lässt isch nicht deaktivieren

mnzmrk12 · 30.10.2012, 12:39

Hallo,

trotz Deinstallation kommt mein Firefox beim Suchen immer wieder auf die Incredibar Suche - in den Einstellungen ist google.de als Standard eingestellt. Könnte jemand bitte einen Blick auf meine Logfiles werfen und helfen?
Vielen Dank für die Mühe.

Gruß

Markus

P.S.: Ich hatte gelsen, die Logs sollten als Anhang gezippt werden, ich hoffe das stimmt...sonst einfach Bescheid geben, dann poste ich sie

M-K-D-B · 01.11.2012, 17:54

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
Bei Anzeichen von illegaler Software wird der Support ohne Diskussion eingestellt.
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
Bitte kein Crossposting (posten in mehreren Foren).
Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Schritt 1

Folge folgendem Pfad: Start -> Systemsteuerung -> Software / Programme deinstallieren
Suche in der Liste Software mit dem folgenden Namen
- Web Assistant
- Ask Toolbar
- Incredibar Toolbar on IE
und deinstalliere das Programm.
Solltest du am Ende der Deinstallation zu einem Neustart aufgefordert werden, so führe diesen durch.
Sollte es Probleme mit der Deinstallation geben, so lass es mich bitte wissen.

Schritt 2
Downloade Dir bitte AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Löschen.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Schritt 3

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Bitte poste mit deiner nächsten Antwort

eventuell auftretende Probleme bei den Deinstallationen,
die Logdatei von AdwCleaner,
die Logdatei von ComboFix.

mnzmrk12 · 01.11.2012, 19:48

Hallo Matthias,

herzlichen Dank für deine Hilfe. Also einmal die combofix.txt:

Code:

ATTFilter

ComboFix 12-10-31.03 - kamera 01.11.2012  18:17:30.1.2 - x86
MicrosoftÆ Windows Vistaô Business   6.0.6002.2.1252.49.1031.18.2045.915 [GMT 1:00]
ausgef¸hrt von:: c:\users\Kamera\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
 ADS - system32: deleted 40 bytes in 1 streams. 
 ADS - Windows: deleted 24 bytes in 1 streams. 
.
((((((((((((((((((((((((((((((((((((   Weitere Lˆschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\program files\INSTALL.LOG
C:\test.txt
c:\users\Kamera\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll
c:\windows\~GLC0000.TMP
c:\windows\system32\CoolXPProgress.ocx
c:\windows\system32\muzapp.exe
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-10-01 bis 2012-11-01  ))))))))))))))))))))))))))))))
.
.
2012-11-01 17:28 . 2012-11-01 17:28	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-11-01 17:28 . 2012-11-01 17:28	--------	d-----w-	c:\users\BO0CBD~1~MUE\AppData\Local\temp
2012-11-01 17:28 . 2012-11-01 17:28	--------	d-----w-	c:\users\Bo.MUENZER\AppData\Local\temp
2012-11-01 17:28 . 2012-11-01 17:28	--------	d-----w-	c:\users\Bo\AppData\Local\temp
2012-11-01 17:28 . 2012-11-01 17:28	--------	d-----w-	c:\users\Administrator\AppData\Local\temp
2012-11-01 10:31 . 2012-10-12 05:56	6918632	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{52E1B0BD-DE14-44C9-A41D-A53422D1630B}\mpengine.dll
2012-11-01 07:50 . 2012-10-12 05:56	6918632	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-30 08:00 . 2012-10-30 08:00	--------	d-----w-	c:\programdata\Microsoft Corporation
2012-10-26 13:37 . 2012-10-26 13:37	--------	d-----w-	c:\users\Bo.MUENZER\AppData\Roaming\Malwarebytes
2012-10-26 13:37 . 2012-10-26 13:37	--------	d-----w-	c:\users\Bo.MUENZER\AppData\Local\LogitechÆ Webcam-Software
2012-10-20 08:03 . 2012-10-02 08:15	740784	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DFED2D9F-72EC-4025-8642-F1F01F17FBA4}\gapaengine.dll
2012-10-10 07:35 . 2012-06-02 00:02	985088	----a-w-	c:\windows\system32\crypt32.dll
2012-10-10 07:35 . 2012-06-02 00:02	133120	----a-w-	c:\windows\system32\cryptsvc.dll
2012-10-10 07:35 . 2012-06-02 00:02	98304	----a-w-	c:\windows\system32\cryptnet.dll
2012-10-10 07:35 . 2012-08-29 11:27	3602816	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-10-10 07:35 . 2012-08-29 11:27	3550080	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-10-09 11:00 . 2012-10-09 11:00	--------	d-----w-	c:\users\Administrator\temp
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-09 09:08 . 2012-04-26 07:37	696760	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-10-09 09:08 . 2011-06-10 08:25	73656	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-02 08:15 . 2012-02-10 08:29	740784	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-09-13 13:28 . 2012-10-10 07:35	2048	----a-w-	c:\windows\system32\tzres.dll
2012-09-07 15:04 . 2012-09-21 17:04	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-08-30 20:03 . 2012-08-30 20:03	193552	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2012-08-30 20:03 . 2011-04-27 14:25	99272	----a-w-	c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-28 18:24 . 2012-08-20 11:48	477168	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-08-28 18:24 . 2010-05-06 07:52	473072	----a-w-	c:\windows\system32\deployJava1.dll
2012-08-28 08:05 . 2012-09-17 11:23	4659712	----a-w-	c:\windows\system32\Redemption.dll
2012-08-28 08:04 . 2012-08-28 08:04	90112	----a-w-	c:\windows\MAMCityDownload.ocx
2012-08-28 08:04 . 2012-08-28 08:04	81920	----a-w-	c:\windows\system32\issacapi_bs-2.3.dll
2012-08-28 08:04 . 2012-08-28 08:04	65536	----a-w-	c:\windows\system32\issacapi_pe-2.3.dll
2012-08-28 08:04 . 2012-08-28 08:04	57344	----a-w-	c:\windows\system32\issacapi_se-2.3.dll
2012-08-28 08:04 . 2012-08-28 08:04	49152	----a-w-	c:\windows\system32\MaJGUILib.dll
2012-08-28 08:04 . 2012-08-28 08:04	45056	----a-w-	c:\windows\system32\MaXMLProto.dll
2012-08-28 08:04 . 2012-08-28 08:04	40960	----a-w-	c:\windows\system32\MTTELECHIP.dll
2012-08-28 08:04 . 2012-08-28 08:04	330240	----a-w-	c:\windows\MASetupCaller.dll
2012-08-28 08:04 . 2012-08-28 08:04	30568	----a-w-	c:\windows\MusiccityDownload.exe
2012-08-28 08:04 . 2012-08-28 08:04	200704	----a-w-	c:\windows\system32\muzwmts.dll
2012-08-28 08:04 . 2012-08-28 08:04	143360	----a-w-	c:\windows\system32\3DAudio.ax
2012-08-28 08:04 . 2012-08-28 08:04	135168	----a-w-	c:\windows\system32\muzaf1.dll
2012-08-28 08:04 . 2012-08-28 08:04	122880	----a-w-	c:\windows\system32\muzeffect.ax
2012-08-28 08:04 . 2012-08-28 08:04	118784	----a-w-	c:\windows\system32\MaDRM.dll
2012-08-28 08:04 . 2012-08-28 08:04	110592	----a-w-	c:\windows\system32\muzmp4sp.ax
2012-08-28 08:04 . 2012-09-17 11:23	821824	----a-w-	c:\windows\system32\dgderapi.dll
2012-08-28 08:04 . 2012-09-17 11:23	319456	----a-w-	c:\windows\system32\DIFxAPI.dll
2012-08-28 08:04 . 2012-09-17 11:23	20032	----a-w-	c:\windows\system32\drivers\dgderdrv.sys
2012-08-28 08:04 . 2012-08-28 08:04	974848	----a-w-	c:\windows\system32\cis-2.4.dll
2012-08-28 08:04 . 2012-08-28 08:04	57344	----a-w-	c:\windows\system32\MTXSYNCICON.dll
2012-08-28 08:04 . 2012-08-28 08:04	57344	----a-w-	c:\windows\system32\MK_Lyric.dll
2012-08-28 08:04 . 2012-08-28 08:04	569344	----a-w-	c:\windows\system32\muzdecode.ax
2012-08-28 08:04 . 2012-08-28 08:04	491520	----a-w-	c:\windows\system32\muzapp.dll
2012-08-28 08:04 . 2012-08-28 08:04	45320	----a-w-	c:\windows\system32\MAMACExtract.dll
2012-08-28 08:04 . 2012-08-28 08:04	45056	----a-w-	c:\windows\system32\MACXMLProto.dll
2012-08-28 08:04 . 2012-08-28 08:04	352256	----a-w-	c:\windows\system32\MSLUR71.dll
2012-08-28 08:04 . 2012-08-28 08:04	258048	----a-w-	c:\windows\system32\muzoggsp.ax
2012-08-28 08:04 . 2012-08-28 08:04	245760	----a-w-	c:\windows\system32\MSCLib.dll
2012-08-28 08:04 . 2012-08-28 08:04	24576	----a-w-	c:\windows\system32\MASetupCleaner.exe
2012-08-28 08:04 . 2012-08-28 08:04	155648	----a-w-	c:\windows\system32\MSFLib.dll
2012-08-28 08:04 . 2012-08-28 08:04	131072	----a-w-	c:\windows\system32\muzmpgsp.ax
2012-08-24 15:53 . 2012-10-10 07:35	172544	----a-w-	c:\windows\system32\wintrust.dll
2012-08-24 06:59 . 2012-09-22 08:04	1800704	----a-w-	c:\windows\system32\jscript9.dll
2012-08-24 06:51 . 2012-09-22 08:04	1129472	----a-w-	c:\windows\system32\wininet.dll
2012-08-24 06:51 . 2012-09-22 08:04	1427968	----a-w-	c:\windows\system32\inetcpl.cpl
2012-08-24 06:47 . 2012-09-22 08:04	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2012-08-24 06:47 . 2012-09-22 08:04	420864	----a-w-	c:\windows\system32\vbscript.dll
2012-08-24 06:43 . 2012-09-22 08:04	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-08-21 11:01 . 2012-09-17 10:06	26840	----a-w-	c:\windows\system32\drivers\GEARAspiWDM.sys
2012-08-21 11:01 . 2009-09-18 14:14	106928	----a-w-	c:\windows\system32\GEARAspi.dll
2001-11-05 08:30 . 2008-09-08 10:07	165376	----a-w-	c:\program files\UNWISE.EXE
2012-10-27 10:47 . 2012-10-27 10:46	261600	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintr‰ge & legitime Standardeintr‰ge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	94208	----a-w-	c:\users\Kamera\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	94208	----a-w-	c:\users\Kamera\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	94208	----a-w-	c:\users\Kamera\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	94208	----a-w-	c:\users\Kamera\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]
"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2012-08-31 964024]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-08-31 21432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2006-12-18 622592]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"EpsonAPD4SV"="c:\program files\EPSON\EPSON Advanced Printer Driver 4\Tools\EAPSV\EAPSV.EXE" [2008-03-24 206208]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 648072]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"SerExt"="SerExt.exe" [2005-03-01 61440]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"SfWinStartInfo"="c:\program files\SFirm32\sfWinStartupInfo.exe" [2010-02-05 161152]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 947176]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
"BrStsWnd"="c:\program files\Brownie\BrstsWnd.exe" [2009-06-11 3618104]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-20 86016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-08-31 3524536]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
.
c:\users\Bo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MobSync.lnk - c:\program files\MobSync\MobSync.exe [N/A]
.
c:\users\Kamera\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Kamera\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-8-27 26924984]
Goldankaufsbeleg Maximalpreis DoppelM UG 09-10-2012.xls - Verkn¸pfung.lnk - c:\users\Kamera\Desktop\Goldankaufsbeleg Maximalpreis DoppelM UG 09-10-2012.xls [2012-10-25 19456]
Windows Mail.lnk - c:\program files\Windows Mail\WinMail.exe [2008-6-6 397312]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Main Console.lnk - c:\program files\LevelOne\IPCamSecure\MainConsole.exe [2010-8-21 9912320]
Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2012-10-27 917984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-20 23:57	86016	------w-	c:\program files\Brother\ControlCenter3\BrCtrCen.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2009-05-21 09:55	206064	----a-w-	c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-10-03 10:37	81920	----a-w-	c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-18 18:56	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-05-02 16:15	4452352	----a-w-	c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SfWinStartInfo]
2010-02-05 16:34	161152	----a-w-	c:\program files\SFirm32\sfWinStartupInfo.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2006-11-10 11:35	90112	----a-w-	c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38	1008184	----a-w-	c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork	REG_MULTI_SZ   	PLA DPS BFE mpssvc
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
bthsvcs	REG_MULTI_SZ   	BthServ
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-26 09:08]
.
.
------- Zus‰tzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.0.200 195.50.140.246
TCP: Interfaces\{15217E49-19A2-4670-A85E-7832F48166E4}: NameServer = 192.168.0.200
DPF: {361E6B79-4A69-4376-B0F2-3D1EBEE9D7E2} - hxxp://192.168.0.107/RtspVaPgDec.cab
FF - ProfilePath - c:\users\Kamera\AppData\Roaming\Mozilla\Firefox\Profiles\1v691z2t.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - ExtSQL: 2012-09-08 11:20; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF - ExtSQL: !HIDDEN! 2009-06-29 10:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - Entfernte verwaiste Registrierungseintr‰ge - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
HKLM_ActiveSetup-ccc-core-static - msiexec
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-11-01 18:34
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteintr‰ge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5688)
c:\users\Kamera\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
c:\windows\System32\LEXBCES.EXE
c:\windows\System32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\EPSON\EPSON Advanced Printer Driver 4\EpsonPHLog.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\TeamViewer\Version7\TeamViewer_Service.exe
c:\program files\EPSON\EPSON Advanced Printer Driver 4\EpsonPH.exe
c:\program files\TeamViewer\Version7\TeamViewer.exe
c:\windows\system32\conime.exe
c:\program files\TeamViewer\Version7\tv_w32.exe
c:\windows\System32\SerExt.exe
c:\program files\Brother\ControlCenter3\brccMCtl.exe
c:\program files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
c:\windows\system32\wbem\WmiApSrv.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-11-01  18:42:47 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-11-01 17:42
.
Vor Suchlauf: 32 Verzeichnis(se), 76.940.754.944 Bytes frei
Nach Suchlauf: 36 Verzeichnis(se), 79.387.918.336 Bytes frei
.
- - End Of File - - 5F901B2544190918A81C6638817883A8

und die AdwCleaner.txt:

Code:

ATTFilter

# AdwCleaner v2.006 - Datei am 01/11/2012 um 18:00:04 erstellt
# Aktualisiert am 30/10/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Business Service Pack 2 (32 bits)
# Benutzer : kamera - BUEROBO
# Bootmodus : Normal
# Ausgef¸hrt unter : C:\Users\Kamera\Desktop\adwcleaner.exe
# Option [Lˆschen]


**** [Dienste] ****

Gestoppt & Gelˆscht : Web Assistant Updater

***** [Dateien / Ordner] *****

Datei Gelˆscht : C:\user.js
Ordner Gelˆscht : C:\Program Files\Ask.com
Ordner Gelˆscht : C:\ProgramData\Ask
Ordner Gelˆscht : C:\Users\Administrator\AppData\LocalLow\AskToolbar
Ordner Gelˆscht : C:\Users\Bo.MUE*\AppData\LocalLow\AskToolbar
Ordner Gelˆscht : C:\Users\Kamera\AppData\LocalLow\AskToolbar
Ordner Gelˆscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schl¸ssel Gelˆscht : HKCU\Software\APN
Schl¸ssel Gelˆscht : HKCU\Software\AppDataLow\Software
Schl¸ssel Gelˆscht : HKCU\Software\Ask.com
Schl¸ssel Gelˆscht : HKCU\Software\IM
Schl¸ssel Gelˆscht : HKCU\Software\ImInstaller
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schl¸ssel Gelˆscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schl¸ssel Gelˆscht : HKLM\Software\APN
Schl¸ssel Gelˆscht : HKLM\Software\AskToolbar
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schl¸ssel Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schl¸ssel Gelˆscht : HKLM\Software\Web Assistant
Wert Gelˆscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gelˆscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelˆscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Wert Gelˆscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://mystart.incredibar.com/mb174?a=6OyOo8hrFB&i=26 --> hxxp://www.google.com

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default 
Datei : C:\Users\Bo\AppData\Roaming\Mozilla\Firefox\Profiles\swx3qjux.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default 
Datei : C:\Users\Bo.*\AppData\Roaming\Mozilla\Firefox\Profiles\2547waqv.default\prefs.js

C:\Users\Bo.*\AppData\Roaming\Mozilla\Firefox\Profiles\2547waqv.default\user.js ... Gelˆscht !

[OK] Die Datei ist sauber.

Profilname : default 
Datei : C:\Users\Kamera\AppData\Roaming\Mozilla\Firefox\Profiles\1v691z2t.default\prefs.js

C:\Users\Kamera\AppData\Roaming\Mozilla\Firefox\Profiles\1v691z2t.default\user.js ... Gelˆscht !

Gelˆscht : user_pref("browser.search.defaultengine", "Ask.com");
Gelˆscht : user_pref("browser.search.defaultenginename", "MyStart Search");
Gelˆscht : user_pref("browser.search.order.1", "Ask.com");
Gelˆscht : user_pref("extensions.asktb.ff-original-keyword-url", "");
Gelˆscht : user_pref("extensions.incredibar.admin", false);
Gelˆscht : user_pref("extensions.incredibar.aflt", "orgnl");
Gelˆscht : user_pref("extensions.incredibar.cntry", "DE");
Gelˆscht : user_pref("extensions.incredibar.dfltLng", "");
Gelˆscht : user_pref("extensions.incredibar.dfltSrch", false);
Gelˆscht : user_pref("extensions.incredibar.did", "10671");
Gelˆscht : user_pref("extensions.incredibar.envrmnt", "production");
Gelˆscht : user_pref("extensions.incredibar.excTlbr", false);
Gelˆscht : user_pref("extensions.incredibar.hdrMd5", "7AA781268D6178B73C7EDB1F1092DC73");
Gelˆscht : user_pref("extensions.incredibar.hmpg", false);
Gelˆscht : user_pref("extensions.incredibar.id", "e4cd81dd00000000000000116b995180");
Gelˆscht : user_pref("extensions.incredibar.installerproductid", "26");
Gelˆscht : user_pref("extensions.incredibar.instlDay", "15600");
Gelˆscht : user_pref("extensions.incredibar.instlRef", "");
Gelˆscht : user_pref("extensions.incredibar.isDcmntCmplt", true);
Gelˆscht : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1413:12:32");
Gelˆscht : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Gelˆscht : user_pref("extensions.incredibar.newTab", false);
Gelˆscht : user_pref("extensions.incredibar.noFFXTlbr", false);
Gelˆscht : user_pref("extensions.incredibar.ppd", "7777720");
Gelˆscht : user_pref("extensions.incredibar.prdct", "incredibar");
Gelˆscht : user_pref("extensions.incredibar.productid", "26");
Gelˆscht : user_pref("extensions.incredibar.prtnrId", "Incredibar");
Gelˆscht : user_pref("extensions.incredibar.sg", "none");
Gelˆscht : user_pref("extensions.incredibar.smplGrp", "none");
Gelˆscht : user_pref("extensions.incredibar.tlbrId", "base");
Gelˆscht : user_pref("extensions.incredibar.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyOo8hrFB&loc=IB_T[...]
Gelˆscht : user_pref("extensions.incredibar.upn2", "6OyOo8hrFB");
Gelˆscht : user_pref("extensions.incredibar.upn2n", "92262121574772983");
Gelˆscht : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Gelˆscht : user_pref("extensions.incredibar.vrsnTs", "1.5.11.1413:12:32");
Gelˆscht : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Gelˆscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Gelˆscht : user_pref("extensions.incredibar_i.dfltLng", "");
Gelˆscht : user_pref("extensions.incredibar_i.did", "10671");
Gelˆscht : user_pref("extensions.incredibar_i.excTlbr", false);
Gelˆscht : user_pref("extensions.incredibar_i.id", "e4cd81dd00000000000000116b995180");
Gelˆscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Gelˆscht : user_pref("extensions.incredibar_i.instlDay", "15600");
Gelˆscht : user_pref("extensions.incredibar_i.instlRef", "");
Gelˆscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Gelˆscht : user_pref("extensions.incredibar_i.newTab", false);
Gelˆscht : user_pref("extensions.incredibar_i.ppd", "7777720");
Gelˆscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Gelˆscht : user_pref("extensions.incredibar_i.productid", "26");
Gelˆscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Gelˆscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Gelˆscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Gelˆscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6OyOo8hrFB&loc=IB[...]
Gelˆscht : user_pref("extensions.incredibar_i.upn2", "6OyOo8hrFB");
Gelˆscht : user_pref("extensions.incredibar_i.upn2n", "92262121574772983");
Gelˆscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Gelˆscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1413:12:32");
Gelˆscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Gelˆscht : user_pref("keyword.URL", "hxxp://mystart.incredibar.com/mb174/?loc=IB_DS&a=6OyOo8hrFB&&i=26&search="[...]
Gelˆscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

Profilname : default 
Datei : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\l07gz0ae.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [10686 octets] - [01/11/2012 18:00:04]

########## EOF - C:\AdwCleaner[S1].txt - [10747 octets] ##########

Beim Hochfahren dauert es nun ewig, bis die Programme gestartet sind, aber bei der Deinstallation gab es keine Probleme. Allerdings fand ich zur Deinstallation nur die Tollbar für IE, die anderen beiden Programme waren nicht in der Liste.
Gruß
Markus

M-K-D-B · 02.11.2012, 14:51

Servus,

Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.

Wie läuft dein Rechner derzeit?
Gibt es noch Probleme mit Incredibar? Wenn ja, in welchem Browser?

mnzmrk12 · 02.11.2012, 16:03

Hi,

der Rechner läuft gut, keine Probleme mit Incredibar. Super, danke!

Code:

ATTFilter

OTL logfile created on: 02.11.2012 14:53:27 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kamera\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 47,96% Memory free
4,24 Gb Paging File | 3,01 Gb Available in Paging File | 71,11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,03 Gb Total Space | 71,19 Gb Free Space | 24,72% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 6,73 Gb Free Space | 67,34% Space Free | Partition Type: NTFS
Drive X: | 127,99 Gb Total Space | 79,02 Gb Free Space | 61,74% Space Free | Partition Type: NTFS
Drive Y: | 127,99 Gb Total Space | 79,02 Gb Free Space | 61,74% Space Free | Partition Type: NTFS
 
Computer Name: BUEROBO | User Name: kamera | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.30 09:15:29 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kamera\Desktop\OTL.exe
PRC - [2012.10.27 11:47:14 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.10.09 10:08:12 | 001,807,800 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe
PRC - [2012.09.12 16:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\NisSrv.exe
PRC - [2012.09.12 16:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.09.12 16:19:44 | 000,947,176 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe
PRC - [2012.08.31 08:52:22 | 000,021,432 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2012.08.31 08:52:14 | 003,524,536 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe
PRC - [2012.08.31 08:52:12 | 000,964,024 | ---- | M] (Samsung) -- C:\Programme\Samsung\Kies\Kies.exe
PRC - [2012.08.27 05:21:12 | 026,924,984 | ---- | M] (Dropbox, Inc.) -- C:\Users\Kamera\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.16 15:31:32 | 007,445,416 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version7\TeamViewer.exe
PRC - [2012.07.16 15:31:32 | 002,673,064 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.07.16 15:22:42 | 000,106,408 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version7\tv_w32.exe
PRC - [2012.01.18 14:02:04 | 000,508,136 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Common Files\Java\Java Update\jucheck.exe
PRC - [2011.08.19 10:26:50 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\Logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2011.08.12 11:19:40 | 000,680,984 | ---- | M] () -- C:\Programme\Common Files\Logishrd\LQCVFX\COCIManager.exe
PRC - [2011.08.12 11:18:42 | 000,205,336 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\LWS\Webcam Software\LWS.exe
PRC - [2011.08.12 11:18:30 | 000,265,240 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\CameraHelperShell.exe
PRC - [2011.02.23 21:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
PRC - [2009.06.11 09:17:38 | 003,618,104 | ---- | M] (brother) -- C:\Programme\Brownie\BrStsWnd.exe
PRC - [2009.05.21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Programme\Dell Support Center\bin\sprtcmd.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.20 13:01:28 | 000,222,512 | ---- | M] (Brother Industries, Ltd.) -- C:\Programme\Brownie\BRNIPMON.exe
PRC - [2008.08.13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Programme\Dell Support Center\bin\sprtsvc.exe
PRC - [2008.03.27 08:37:52 | 000,368,640 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Programme\EPSON\EPSON Advanced Printer Driver 4\EpsonPH.exe
PRC - [2008.03.24 19:31:22 | 000,206,208 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Programme\EPSON\EPSON Advanced Printer Driver 4\Tools\EAPSV\EAPSV.exe
PRC - [2008.03.15 03:36:48 | 000,290,816 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Programme\EPSON\EPSON Advanced Printer Driver 4\EpsonPHLog.exe
PRC - [2007.05.31 09:21:28 | 000,648,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\WindowsMobile\wmdcBase.exe
PRC - [2007.03.15 12:09:36 | 000,460,784 | ---- | M] (Gteko Ltd.) -- C:\Programme\DellSupport\DSAgnt.exe
PRC - [2005.03.01 10:40:26 | 000,061,440 | ---- | M] (Siemens AG) -- C:\Windows\System32\SerExt.exe
PRC - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.11.01 18:36:39 | 000,115,137 | ---- | M] () -- C:\Users\Kamera\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll
MOD - [2012.10.27 11:46:44 | 002,295,264 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.10.09 10:08:11 | 009,814,968 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_287.dll
MOD - [2012.09.17 13:00:04 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll
MOD - [2012.09.17 12:28:35 | 015,399,936 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\002b4b1af5f8145bf6b6afe21d4f1db2\Kies.Theme.ni.dll
MOD - [2012.09.17 12:28:32 | 000,608,256 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\DevicePodcast\de1a504d1535e5005fbae8f6a4d97ce5\DevicePodcast.ni.dll
MOD - [2012.09.17 12:28:31 | 000,367,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\DevicePhoto\e5e58a020638d28d3740195f1d0738da\DevicePhoto.ni.dll
MOD - [2012.09.17 12:28:31 | 000,290,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\DeviceVideo\ee12ab3bf308cbe22f373afbddf0be6b\DeviceVideo.ni.dll
MOD - [2012.09.17 12:28:30 | 000,461,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\VideoManager\23e80240003377b6412081a4523943fe\VideoManager.ni.dll
MOD - [2012.09.17 12:28:30 | 000,299,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\DeviceMusic\0377dd6ed6a5e92a0b8d6eb7d0b64f79\DeviceMusic.ni.dll
MOD - [2012.09.17 12:28:28 | 002,778,112 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PodcastService\23fd65cd04b03d19931758d7472e38a4\PodcastService.ni.dll
MOD - [2012.09.17 12:28:28 | 001,143,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Podcaster\ad50dc81bd795c41a13249e612b0d97f\Podcaster.ni.dll
MOD - [2012.09.17 12:28:26 | 000,607,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PhotoManager\e96a4bd6a51ec7762f15f9bc64c6c33a\PhotoManager.ni.dll
MOD - [2012.09.17 12:28:18 | 005,677,568 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\DeviceHost\64d3040868aba797c48f608f5361e5bc\DeviceHost.ni.dll
MOD - [2012.09.17 12:28:14 | 000,033,792 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\8465ae2b954384776b5cd98d69c0108d\Kies.Common.DeviceServiceLib.FirmwareUpdate.FirmwareUpdateAgentHelper.ni.dll
MOD - [2012.09.17 12:28:11 | 001,843,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Phonebook\1bedf64dbdd091ac8dceee7cbfd84a88\Phonebook.ni.dll
MOD - [2012.09.17 12:28:06 | 001,007,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\CPKTMusicPlugin\cb37f0e0b86cc3b3586f7c7d27d07cbe\CPKTMusicPlugin.ni.dll
MOD - [2012.09.17 12:28:06 | 000,964,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\MusicManager\d1e0445d4ad25819f70d150acd2d61af\MusicManager.ni.dll
MOD - [2012.09.17 12:28:03 | 000,391,168 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\BATPlugin\ed8a6670f7dbe1ae78aa091a0935fb87\BATPlugin.ni.dll
MOD - [2012.09.17 12:28:03 | 000,320,512 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\EBookManager\e5c8f9e08db50fb625c029361147f47e\EBookManager.ni.dll
MOD - [2012.09.17 12:28:02 | 000,031,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\AllShareController\c209d4b3c25507564757710f6d4a4570\AllShareController.ni.dll
MOD - [2012.09.17 12:28:01 | 000,507,392 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.MediaDB\25823a7264f74e67158031f485c0bb23\Kies.Common.MediaDB.ni.dll
MOD - [2012.09.17 12:28:00 | 000,029,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.StoreMa#\d9eca4746981ac218c1dbe0c131ce108\Kies.Common.StoreManager.ni.dll
MOD - [2012.09.17 12:27:59 | 000,232,960 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\81bb58061bcd2a4c3bf4136abe041d20\ASF_cSharpAPI.ni.dll
MOD - [2012.09.17 12:27:58 | 000,064,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.AllShare\065aa3ca107d7b3d679a5f408e535239\Kies.Common.AllShare.ni.dll
MOD - [2012.09.17 12:27:57 | 000,565,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\4b033da616a5e8e2b9ebe95342e9cf0d\Kies.Common.DeviceServiceLib.FileService.ni.dll
MOD - [2012.09.17 12:27:57 | 000,278,016 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\1f13cee7982e84f07cff152618950b20\Kies.Common.DeviceServiceLib.FirmwareUpdate.Common.ni.dll
MOD - [2012.09.17 12:27:57 | 000,189,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\57b7389241c36caa1d2132d68eddedda\Kies.Common.DeviceServiceLib.FirmwareUpdate.Downloader.ni.dll
MOD - [2012.09.17 12:27:57 | 000,174,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Interop.DevFileServ#\170b754ba9dcd78ee0b06a32af4a7c1f\Interop.DevFileServiceLib.ni.dll
MOD - [2012.09.17 12:27:56 | 000,566,784 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\61df63e5646fd99c9912c90ba2984b8b\Kies.Common.DeviceServiceLib.DeviceDataService.ni.dll
MOD - [2012.09.17 12:27:55 | 001,025,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\60c16bc46e86b9a852e71968dc63d9c7\Kies.Common.DeviceService.ni.dll
MOD - [2012.09.17 12:27:55 | 000,902,656 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\4f549b26003474662ef7e2f3be9e3dd3\Kies.Common.DeviceServiceLib.DeviceManagement.ni.dll
MOD - [2012.09.17 12:27:55 | 000,184,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DeviceS#\e1837e9c63789850168d0bb76826128d\Kies.Common.DeviceServiceLib.Interface.ni.dll
MOD - [2012.09.17 12:27:53 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll
MOD - [2012.09.17 12:27:52 | 002,188,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.Multime#\c7a76efab3d60db9618197e000600e2f\Kies.Common.Multimedia.ni.dll
MOD - [2012.09.17 12:27:52 | 000,032,256 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Interop.OGGFileInfo#\cbeefee33636e0d0be226cf11e180ba3\Interop.OGGFileInfoCOMLib.ni.dll
MOD - [2012.09.17 12:27:51 | 000,171,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Interop.P3MPINTERFA#\b0b31095249cec5ef5c0407fa6b7fc22\Interop.P3MPINTERFACECTRLLib.ni.dll
MOD - [2012.09.17 12:27:51 | 000,052,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Interop.MP3FileInfo#\c99811c6a988ca6c2104a5b45acbddbb\Interop.MP3FileInfoCOMLib.ni.dll
MOD - [2012.09.17 12:27:51 | 000,030,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Interop.PRPLAYERCOR#\25dc31b1903a3689788caf51d3d93f97\Interop.PRPLAYERCORELib.ni.dll
MOD - [2012.09.17 12:27:49 | 000,183,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.MainUI\4603ed01ff960f6d861f798e826c9442\Kies.Common.MainUI.ni.dll
MOD - [2012.09.17 12:27:48 | 000,530,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\ICSharpCode.SharpZi#\2d7161baa59dd2c1c39f4a192d760e7d\ICSharpCode.SharpZipLib.ni.dll
MOD - [2012.09.17 12:27:48 | 000,067,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.DBManag#\1600f24d91e6f9634b0ca377b89ef6b0\Kies.Common.DBManager.ni.dll
MOD - [2012.09.17 12:27:47 | 001,728,512 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\7a0eb5bc5decef8dc1ef9dd3bca3b4d4\Kies.UI.ni.dll
MOD - [2012.09.17 12:27:47 | 000,395,776 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\CabLib\6265ffca46eab52d5f798847b5ea908c\CabLib.ni.dll
MOD - [2012.09.17 12:27:47 | 000,201,728 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Common.Util\a19411b7a3e982e3a2e001e1aeb4e689\Kies.Common.Util.ni.dll
MOD - [2012.09.17 12:27:46 | 001,437,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Locale\c4f56538bb1d5921690a486bf052e30b\Kies.Locale.ni.dll
MOD - [2012.09.17 12:27:46 | 000,078,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\afa8de1e7aabde98f9a5fec1abdb9a05\Kies.MVVM.ni.dll
MOD - [2012.09.17 12:27:46 | 000,052,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Interop.DeviceSearc#\9a6bad5be6518d4a975893676a49a82c\Interop.DeviceSearchLib.ni.dll
MOD - [2012.09.17 12:27:45 | 000,119,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\GongSolutions.Wpf.D#\3f6f79987f17c00edce423932abd1cf2\GongSolutions.Wpf.DragDrop.ni.dll
MOD - [2012.09.17 12:27:44 | 001,185,280 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Interface\0a26df964bb433ab607743b20c7704f7\Kies.Interface.ni.dll
MOD - [2012.09.17 12:27:35 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\26e0457a9776a0e9f23e3986686d90a5\System.ServiceProcess.ni.dll
MOD - [2012.09.17 12:27:31 | 000,771,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\ef221aa0472b0870b6689ab044fad227\System.Runtime.Remoting.ni.dll
MOD - [2012.09.17 12:27:25 | 001,674,240 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies\41f4faf4ff2ba56c26252d6069ceff76\Kies.ni.exe
MOD - [2012.09.17 12:27:23 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll
MOD - [2012.09.17 12:17:40 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll
MOD - [2012.09.17 12:17:26 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll
MOD - [2012.09.17 12:17:15 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll
MOD - [2012.09.17 12:17:12 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll
MOD - [2012.09.17 12:17:11 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll
MOD - [2012.09.17 12:17:05 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\a84262e1224189f93e10cd3c403a9527\System.Configuration.ni.dll
MOD - [2012.09.17 12:17:01 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll
MOD - [2012.09.17 12:16:59 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll
MOD - [2012.09.17 12:16:51 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll
MOD - [2012.09.17 12:16:47 | 009,092,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll
MOD - [2012.09.17 12:16:41 | 014,414,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll
MOD - [2012.08.31 08:52:22 | 000,021,432 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2012.05.09 09:23:32 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.09 09:22:17 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.09 09:22:04 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.08.22 14:47:44 | 000,336,408 | ---- | M] () -- C:\Programme\Common Files\Logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
MOD - [2011.08.12 11:19:40 | 000,680,984 | ---- | M] () -- C:\Programme\Common Files\Logishrd\LQCVFX\COCIManager.exe
MOD - [2011.08.12 11:18:30 | 000,265,240 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\CameraHelperShell.exe
MOD - [2011.03.01 22:15:28 | 000,126,808 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QJpeg4.dll
MOD - [2011.03.01 22:15:28 | 000,027,480 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\ImageFormats\QGif4.dll
MOD - [2011.03.01 22:15:04 | 000,340,824 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTXml4.dll
MOD - [2011.03.01 22:14:42 | 007,954,776 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTGui4.dll
MOD - [2011.03.01 22:14:30 | 002,143,576 | ---- | M] () -- C:\Programme\Logitech\LWS\Webcam Software\QTCore4.dll
MOD - [2007.05.28 10:51:48 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2012.10.27 11:47:13 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.09 10:08:12 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.12 16:25:24 | 000,287,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012.09.12 16:25:22 | 000,020,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.16 15:31:32 | 002,673,064 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011.08.19 10:26:50 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\Logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2010.01.25 07:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Stopped] -- C:\Programme\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2008.08.13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter)
SRV - [2008.05.02 01:42:06 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2008.03.27 08:37:52 | 000,368,640 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Programme\EPSON\EPSON Advanced Printer Driver 4\EpsonPH.exe -- (EpsonPOSPort)
SRV - [2008.03.15 03:36:48 | 000,290,816 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Programme\EPSON\EPSON Advanced Printer Driver 4\EpsonPHLog.exe -- (EpsonPOSLog)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007.03.19 12:44:44 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2006.09.14 06:56:06 | 000,102,400 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0)
SRV - [2005.03.01 10:45:30 | 000,327,680 | ---- | M] (Siemens) [On_Demand | Stopped] -- C:\Programme\Gigaset DECT\talk&surf_6_0\xcontrolcom.exe -- (xControlCOM)
SRV - [2003.06.19 22:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\VS7Debug\mdm.exe -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VBoxNetFlt.sys -- (VBoxNetFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.08.30 21:03:50 | 000,099,272 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2012.07.31 11:42:48 | 000,181,344 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2012.07.31 11:42:48 | 000,083,168 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2011.08.19 10:26:50 | 004,334,624 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)
DRV - [2011.08.19 10:26:46 | 000,315,808 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2009.12.17 15:02:34 | 000,099,152 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2009.04.11 05:42:52 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb)
DRV - [2008.02.29 02:13:46 | 000,028,944 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2008.02.29 02:13:24 | 000,036,880 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008.02.29 02:13:16 | 000,035,344 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008.01.19 07:14:59 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2007.07.17 09:15:18 | 000,066,560 | ---- | M] (CREST CO.,LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ESDPDX04.SYS -- (Esdpdx04)
DRV - [2007.05.31 07:38:18 | 000,023,040 | ---- | M] (REINER SCT) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\cjusb.sys -- (cjusb)
DRV - [2007.05.28 10:51:48 | 002,313,216 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2007.05.21 12:35:14 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express)
DRV - [2007.02.25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006.12.09 00:26:03 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2006.12.09 00:26:03 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2006.11.02 08:30:56 | 000,044,544 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006.10.05 17:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Programme\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2005.11.04 10:06:52 | 000,048,640 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2005.03.01 10:46:56 | 000,053,632 | ---- | M] (Siemens AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Gigusb.sys -- (Gigusb)
DRV - [2005.03.01 10:36:02 | 000,008,448 | ---- | M] (Siemens AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\DectEnum.sys -- (DectEnum)
DRV - [2005.03.01 10:33:18 | 000,113,408 | ---- | M] (Siemens AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\siellif.sys -- (siellif)
DRV - [2004.09.08 15:22:04 | 000,050,759 | ---- | M] (SIEMENS AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\IUAPIWDM.sys -- (IUAPIWDM)
DRV - [2004.09.08 15:22:02 | 000,263,751 | ---- | M] (SIEMENS AG) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\hrcmpa.sys -- (HRCMPA)
DRV - [2004.09.08 15:21:58 | 000,041,037 | ---- | M] (SIEMENS AG) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ndiscapi.sys -- (NDISCAPI)
DRV - [2004.09.08 15:21:54 | 000,028,740 | ---- | M] (SIEMENS AG) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\capi.sys -- (CAPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7DADE
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://support.euro.dell.com/suppo [Binary data over 200 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6F8665A2-8B28-4574-8CEB-627E2E764ACC}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=69545D87-C53C-42BC-BA85-8AFA34C0679A&apn_sauid=506888CC-5259-4309-A922-2A6BD6E5F8FF
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: DeviceDetection@logitech.com:1.23.0.5
FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}:6.0.34
FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}:6.0.35
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.10.27 11:47:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.27 11:46:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.05.21 08:55:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2012.08.21 08:14:17 | 000,000,000 | ---D | M]
 
[2011.06.09 15:50:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kamera\AppData\Roaming\mozilla\Extensions
[2011.06.09 15:50:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kamera\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.10.23 08:29:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kamera\AppData\Roaming\mozilla\Firefox\Profiles\1v691z2t.default\extensions
[2010.08.25 08:23:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Kamera\AppData\Roaming\mozilla\Firefox\Profiles\1v691z2t.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.08.10 08:37:34 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Users\Kamera\AppData\Roaming\mozilla\Firefox\Profiles\1v691z2t.default\extensions\DeviceDetection@logitech.com
[2012.10.27 11:46:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.10.27 11:46:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2012.10.27 11:46:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012.10.27 11:46:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA}
[2012.10.27 11:46:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2012.10.27 11:47:14 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.06.07 08:18:13 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2007.03.05 12:59:06 | 000,645,504 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npOGAPlugin.dll
[2012.10.15 10:18:02 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.15 10:18:02 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.10.15 10:18:02 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.10.15 10:18:02 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.10.15 10:18:02 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.10.15 10:18:02 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.11.01 18:32:01 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Programme\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [BrStsWnd] C:\Program Files\Brownie\BrstsWnd.exe (brother)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [EpsonAPD4SV] C:\Programme\EPSON\EPSON Advanced Printer Driver 4\Tools\EAPSV\EAPSV.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Seagull Drivers] C:\Windows\ssdal_nc.exe ()
O4 - HKLM..\Run: [SerExt] C:\Windows\System32\SerExt.exe (Siemens AG)
O4 - HKLM..\Run: [SfWinStartInfo] C:\Program Files\SFirm32\sfWinStartupInfo.exe (BIVG Hannover)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe (Samsung)
O4 - HKCU..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - Startup: C:\Users\Kamera\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Kamera\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Kamera\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Goldankaufsbeleg Maximalpreis DoppelM UG 09-10-2012.xls - Verknüpfung.lnk = C:\Users\Kamera\Desktop\Goldankaufsbeleg Maximalpreis DoppelM UG 09-10-2012.xls ()
O4 - Startup: C:\Users\Kamera\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Mail.lnk = C:\Programme\Windows Mail\WinMail.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {361E6B79-4A69-4376-B0F2-3D1EBEE9D7E2} hxxp://192.168.0.107/RtspVaPgDec.cab (RtspVaPgCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {A3256902-51FA-45A0-8A97-FC1143C169D9} hxxp://support.microsoft.com/mats/DiagWebControl.cab (Diagnostics ActiveX WebControl)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.200 195.50.140.246
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = juwelier-muenzer.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01F8DDF1-030E-4128-AFAA-974560B6A655}: DhcpNameServer = 192.168.0.200 195.50.140.246
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{15217E49-19A2-4670-A85E-7832F48166E4}: DhcpNameServer = 192.168.0.200 195.50.140.246
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{15217E49-19A2-4670-A85E-7832F48166E4}: NameServer = 192.168.0.200
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.01 18:42:53 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.11.01 18:32:40 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.11.01 18:13:21 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.11.01 18:13:21 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.11.01 18:13:21 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.11.01 18:11:16 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.11.01 18:10:35 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.11.01 18:08:00 | 004,991,994 | R--- | C] (Swearware) -- C:\Users\Kamera\Desktop\ComboFix.exe
[2012.10.30 09:15:27 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Kamera\Desktop\OTL.exe
[2012.10.30 09:00:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Corporation
[2012.10.27 11:46:23 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.10.27 09:03:38 | 000,000,000 | ---D | C] -- C:\Users\Kamera\Documents\samsung
[2012.10.22 16:39:35 | 000,000,000 | ---D | C] -- C:\Users\Kamera\Desktop\Bildbearbeitung
[2012.10.10 08:35:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2012.10.10 08:35:02 | 003,602,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012.10.10 08:35:01 | 003,550,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.02 14:08:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.02 12:56:56 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.02 12:56:56 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.01 19:12:56 | 000,000,312 | ---- | M] () -- C:\Windows\Brownie.ini
[2012.11.01 18:56:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.01 18:56:45 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2012.11.01 18:32:01 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.11.01 18:10:14 | 000,633,584 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.01 18:10:14 | 000,600,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.01 18:10:14 | 000,127,532 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.01 18:10:14 | 000,105,184 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.01 18:09:49 | 004,991,994 | R--- | M] (Swearware) -- C:\Users\Kamera\Desktop\ComboFix.exe
[2012.11.01 17:58:09 | 000,540,977 | ---- | M] () -- C:\Users\Kamera\Desktop\adwcleaner.exe
[2012.10.30 11:54:00 | 000,014,697 | ---- | M] () -- C:\Users\Kamera\Desktop\OTL.7z
[2012.10.30 11:53:51 | 000,009,633 | ---- | M] () -- C:\Users\Kamera\Desktop\Extras.7z
[2012.10.30 11:53:30 | 000,002,869 | ---- | M] () -- C:\Users\Kamera\Desktop\Gmer.7z
[2012.10.30 09:33:21 | 000,302,592 | ---- | M] () -- C:\Users\Kamera\Desktop\5j76ns9w.exe
[2012.10.30 09:15:29 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Kamera\Desktop\OTL.exe
[2012.10.30 09:14:56 | 000,000,000 | ---- | M] () -- C:\Users\Kamera\defogger_reenable
[2012.10.26 15:15:46 | 000,008,192 | ---- | M] () -- C:\Users\Kamera\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.10.26 15:15:29 | 000,001,430 | ---- | M] () -- C:\Users\Kamera\Desktop\CLARITY & SUCCESS.lnk
[2012.10.22 17:17:08 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2012.10.22 17:17:08 | 000,000,034 | ---- | M] () -- C:\Windows\System32\BD2030.DAT
[2012.10.15 18:13:16 | 175,106,572 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.10.11 17:23:03 | 000,023,794 | ---- | M] () -- C:\Users\Kamera\Desktop\Tresor Zettel.odt
[2012.10.09 10:08:12 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.10.09 10:08:11 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
 
========== Files Created - No Company Name ==========
 
[2012.11.01 18:13:21 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.11.01 18:13:21 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.11.01 18:13:21 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.11.01 18:13:21 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.11.01 18:13:21 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.11.01 17:58:05 | 000,540,977 | ---- | C] () -- C:\Users\Kamera\Desktop\adwcleaner.exe
[2012.10.30 11:54:00 | 000,014,697 | ---- | C] () -- C:\Users\Kamera\Desktop\OTL.7z
[2012.10.30 11:53:51 | 000,009,633 | ---- | C] () -- C:\Users\Kamera\Desktop\Extras.7z
[2012.10.30 11:53:30 | 000,002,869 | ---- | C] () -- C:\Users\Kamera\Desktop\Gmer.7z
[2012.10.30 09:33:19 | 000,302,592 | ---- | C] () -- C:\Users\Kamera\Desktop\5j76ns9w.exe
[2012.10.30 09:14:56 | 000,000,000 | ---- | C] () -- C:\Users\Kamera\defogger_reenable
[2012.10.26 15:15:29 | 000,001,430 | ---- | C] () -- C:\Users\Kamera\Desktop\CLARITY & SUCCESS.lnk
[2012.10.10 18:04:21 | 000,023,794 | ---- | C] () -- C:\Users\Kamera\Desktop\Tresor Zettel.odt
[2012.09.28 17:11:07 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2012.09.28 17:11:07 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2012.08.28 09:04:34 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2012.08.28 09:04:34 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2012.08.28 09:04:34 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2012.08.28 09:04:34 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.08.28 09:04:32 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2012.05.21 07:57:43 | 000,000,034 | ---- | C] () -- C:\Windows\System32\BD2150N.DAT
[2012.05.21 07:56:41 | 000,000,146 | ---- | C] () -- C:\Windows\BRVIDEO.INI
[2012.05.21 07:56:41 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
[2012.05.21 07:56:40 | 000,009,868 | ---- | C] () -- C:\Windows\HL-2150N.INI
[2012.05.21 07:56:08 | 000,000,312 | ---- | C] () -- C:\Windows\Brownie.ini
[2012.05.19 12:38:12 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL
[2012.05.19 12:38:11 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini
[2012.05.19 12:38:10 | 000,000,050 | ---- | C] () -- C:\Windows\System32\BRADM10A.DAT
[2012.02.28 13:42:30 | 000,006,148 | -H-- | C] () -- C:\Users\Kamera\.DS_Store
[2011.08.19 10:26:20 | 010,898,456 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2011.08.19 10:26:20 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2011.08.19 10:26:20 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011.08.12 11:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2011.07.26 07:48:54 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011.07.13 08:40:29 | 000,000,662 | ---- | C] () -- C:\Windows\System32\syslevel1Lite.dll
[2010.11.04 13:56:28 | 000,008,192 | ---- | C] () -- C:\Users\Kamera\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.08.04 16:54:59 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2008.09.08 11:07:20 | 000,165,376 | ---- | C] () -- C:\Program Files\UNWISE.EXE
[2008.01.16 17:30:21 | 000,002,870 | RHS- | C] () -- C:\ProgramData\ntuser.pol
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:18 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 76 bytes -> C:\Install:Roxio EMC Stream
@Alternate Data Stream - 60 bytes -> C:\Users\Kamera\Desktop\Serviceanleitungen Uhren:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Users\Kamera\Desktop\.DS_Store:AFP_AfpInfo
@Alternate Data Stream - 60 bytes -> C:\Users\Kamera\.DS_Store:AFP_AfpInfo

< End of report >

Code:

ATTFilter

OTL Extras logfile created on: 02.11.2012 14:53:27 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Kamera\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,96 Gb Available Physical Memory | 47,96% Memory free
4,24 Gb Paging File | 3,01 Gb Available in Paging File | 71,11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288,03 Gb Total Space | 71,19 Gb Free Space | 24,72% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 6,73 Gb Free Space | 67,34% Space Free | Partition Type: NTFS
Drive X: | 127,99 Gb Total Space | 79,02 Gb Free Space | 61,74% Space Free | Partition Type: NTFS
Drive Y: | 127,99 Gb Total Space | 79,02 Gb Free Space | 61,74% Space Free | Partition Type: NTFS
 
Computer Name: BUEROBO | User Name: kamera | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0577C380-58CF-4CB9-B3C4-93E4E756F9C4}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{18600AD2-422F-4854-9833-756F95CE30E3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{19EC3ADB-F3A8-4B59-82F6-9F62DC19DC6A}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{2D04E22D-1497-4407-A3AB-DA014CFA3986}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{334EA90E-EDE5-43A3-81EF-C632EBC13783}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
"{55037374-6FAA-4FC9-A941-81FCFD39F5A0}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 | 
"{6092E26D-1A4A-46E2-9067-7059E0F21606}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{6632B8E5-DA38-45D6-A1A0-5FC7697EAB7F}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{90694518-1991-4445-9EC1-AA103AB72D01}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{98F6DD22-9841-4E00-BFE1-843C17ABD592}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{BC5D9894-33D0-4902-AA18-93226C40C274}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{C4DE044D-601A-4370-913C-52CC1A0DFDCA}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{087A779F-B963-4E26-8BC7-85D29A618BAF}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe | 
"{0BC709C9-28CA-4290-84C3-BE204418B8FE}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{157FA43B-4373-4C09-BAB6-0AEDC09CF5DB}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 
"{17405B96-139E-40FE-BB26-B0C940DAD77B}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"{1B01B377-C758-4B8A-B1B2-8B7A27F35FC0}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{1ED00F99-1174-4883-9FC7-4AC790C3B2D2}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{20C4EEFA-0ADB-4398-BC90-16F651DEA92C}" = protocol=6 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{2BCABC75-F322-4FB1-9D0F-97CF190CAC82}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe | 
"{2F759EA6-01EA-4721-A02D-F02472011100}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{32D88405-9D62-49BF-A86E-15AF98445FB1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{3A62C785-CC47-4EC2-9172-2B1287EA513A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{42D0D710-FD45-4439-B4D0-83447ABFFC50}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 
"{4327B444-477F-4BE2-894E-C5705032CC68}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbcpswx.exe | 
"{44EED9E4-7B94-47FF-B4C0-A8380586AC2C}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4617DC6A-16A3-495F-8927-7DABA5B8D091}" = protocol=17 | dir=in | app=c:\users\kamera\appdata\roaming\dropbox\bin\dropbox.exe | 
"{481D4B83-0428-4335-99AD-BD6FC3D40428}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | 
"{4CAC5D66-FB54-4F6A-8E87-FDE792D926E1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{53F56AC0-6640-41EA-9CE9-E3E8469808E6}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxbcpswx.exe | 
"{5B4D8C72-B210-4336-8612-0F06BF659CC5}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{6CEC5EAB-DF6C-40A6-91E1-0C0C60B01547}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{71C1368B-E47B-464A-A4B7-B189CDC11A78}" = protocol=17 | dir=in | app=c:\windows\system32\lxbccoms.exe | 
"{72904443-396D-400E-8BB8-752D3D19FF1A}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbtray.exe | 
"{7F6E47DD-8E88-4234-B656-CB4D5D963C5E}" = protocol=6 | dir=in | app=c:\windows\system32\lxbccoms.exe | 
"{8D942B44-4544-405B-99AC-CF14DAE6EC69}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{982897D8-E893-4243-B6E9-6F1C5FE965DE}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{9B0ADE46-59EF-4AB2-B36C-5907688FFB0A}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe | 
"{A257D704-AB76-4435-823A-2F8899BEE64E}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{ACD9CF85-9F65-4366-AD24-2BED9E21CB85}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe | 
"{AF475F88-2EE2-4927-9226-AA99233DB39C}" = protocol=6 | dir=in | app=c:\users\kamera\appdata\roaming\dropbox\bin\dropbox.exe | 
"{AF8A4925-5CAD-4042-8437-EF24DB7617B2}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{C26D6146-7072-4CC1-A332-57D6CAFE9ED0}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{C6A6FC31-E1FB-4EC4-8FB3-D5A9F23F49FB}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{D850D1A7-7ECB-4AC5-A9D0-E1E3BF7B0715}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{DBB2C7F0-2A32-42D7-802B-4440B63B4204}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{DE95B82B-3627-4C62-81FD-BB299CC549B7}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | 
"{E0BAA5DE-BC95-4E14-B95A-D3F50923D195}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orbstreamerclient.exe | 
"{E0C64C69-FC60-4ED5-827F-11149CD40301}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{E6BE8998-E0B2-410D-A27A-99C5A47C19BF}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{E9EF16B8-882E-46E5-B090-7D1EEC1ED74A}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe | 
"{EA244033-8113-4F3C-AAE3-CE9B6CAE963F}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe | 
"{F1935666-92D9-4D24-B0AF-0F404333D6BF}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{F266C955-B598-43B1-8891-7D4F75DFEDEF}" = protocol=17 | dir=in | app=c:\program files\winamp remote\bin\orb.exe | 
"{F897C334-5965-4177-9937-D20973D7DCC1}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{FB778A68-A04A-4224-99F9-45225BC861C5}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{22D209C1-30E7-40CC-9376-AC08E21CDB90}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe | 
"TCP Query User{332FA482-0359-4AED-82C6-0E3CA8301567}C:\program files\levelone\ipcamsecure\mainconsole.exe" = protocol=6 | dir=in | app=c:\program files\levelone\ipcamsecure\mainconsole.exe | 
"TCP Query User{54A70230-25D3-4CF6-AF83-B0A10C572C9A}C:\program files\levelone\installation wizard\installationwizard.exe" = protocol=6 | dir=in | app=c:\program files\levelone\installation wizard\installationwizard.exe | 
"TCP Query User{55AABE23-C97C-4C68-9B74-2D637C35B4E1}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{7F8233B5-1791-4633-8948-C83A486D2DE1}C:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-dede-downloader.exe | 
"TCP Query User{8CF5A31B-51E4-4100-9576-B1CB55B1F1B5}C:\program files\world of warcraft\wow-2.3.0.7561-to-2.3.2.7741-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.3.0.7561-to-2.3.2.7741-dede-downloader.exe | 
"TCP Query User{910DE410-AB9D-4321-82E0-79ED169FF95C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{9F1827DD-13DF-4B5D-B5ED-CA6A75C6D704}C:\program files\world of warcraft\wow-2.3.2.7741-to-2.3.3.7799-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-2.3.2.7741-to-2.3.3.7799-dede-downloader.exe | 
"TCP Query User{B64F2817-8FFA-4CDD-9879-116DD3DFA699}C:\program files\klebezettel ng\klebez.exe" = protocol=6 | dir=in | app=c:\program files\klebezettel ng\klebez.exe | 
"TCP Query User{BD9D56F1-0D37-4DE1-AB75-15F043BED731}C:\jewel\transnet.exe" = protocol=6 | dir=in | app=c:\jewel\transnet.exe | 
"TCP Query User{C4F6649B-96A9-4A48-96D6-4BE8FEF4B77C}C:\program files\levelone\ipcamsecure\mainconsole.exe" = protocol=6 | dir=in | app=c:\program files\levelone\ipcamsecure\mainconsole.exe | 
"TCP Query User{D3A282C1-4255-4514-854A-0BCC57956838}C:\program files\levelone\ipcamsecure\mainconsole.exe" = protocol=6 | dir=in | app=c:\program files\levelone\ipcamsecure\mainconsole.exe | 
"TCP Query User{D8AFCD00-4A6D-4C41-A079-4AB68240C33B}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"UDP Query User{07003BA0-1387-46F3-BBF5-BA9280C97BFF}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{07B6212B-A7E2-4643-B863-A21A2CBE5CD4}C:\program files\klebezettel ng\klebez.exe" = protocol=17 | dir=in | app=c:\program files\klebezettel ng\klebez.exe | 
"UDP Query User{11A9D7F7-1C40-4461-BB6C-7483A323B75D}C:\program files\world of warcraft\wow-2.3.0.7561-to-2.3.2.7741-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.3.0.7561-to-2.3.2.7741-dede-downloader.exe | 
"UDP Query User{4495D6E7-06B3-4B87-AABE-1830F00C5D62}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe | 
"UDP Query User{54045EED-0EBB-4F6A-B7C0-C611FD54EE38}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"UDP Query User{5FFB2A8A-7189-4F36-A6E1-9326B63B27FD}C:\program files\levelone\ipcamsecure\mainconsole.exe" = protocol=17 | dir=in | app=c:\program files\levelone\ipcamsecure\mainconsole.exe | 
"UDP Query User{86140CDF-95A8-4695-AB43-5779CC878D8B}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{A4EEFFCC-4C44-4EB3-A8F3-7016BE26C282}C:\program files\levelone\ipcamsecure\mainconsole.exe" = protocol=17 | dir=in | app=c:\program files\levelone\ipcamsecure\mainconsole.exe | 
"UDP Query User{A8EA05A3-C66C-4A7A-8056-E995482316CB}C:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.3.3.7799-to-2.4.0.8089-dede-downloader.exe | 
"UDP Query User{BDA9D591-F881-4E35-9E7F-18C3AB0D7CFE}C:\program files\world of warcraft\wow-2.3.2.7741-to-2.3.3.7799-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-2.3.2.7741-to-2.3.3.7799-dede-downloader.exe | 
"UDP Query User{DCE30D30-CEF4-4EC3-8859-28E192AD15DB}C:\program files\levelone\ipcamsecure\mainconsole.exe" = protocol=17 | dir=in | app=c:\program files\levelone\ipcamsecure\mainconsole.exe | 
"UDP Query User{DED5F9A0-5867-49FD-A277-530950A47CE7}C:\jewel\transnet.exe" = protocol=17 | dir=in | app=c:\jewel\transnet.exe | 
"UDP Query User{FA93D73D-F9EB-4885-A53A-FAA8DB74B87F}C:\program files\levelone\installation wizard\installationwizard.exe" = protocol=17 | dir=in | app=c:\program files\levelone\installation wizard\installationwizard.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{0DE20748-45A5-6CD9-610E-F881A34E7342}" = Catalyst Control Center Localization Arabic
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{11FF6AF6-0141-4EF8-829A-989459A1E5D8}" = EPSON Advanced Printer Driver 4
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{15CC10AB-4266-210D-E2D2-03089C25A028}" = CCC Help English
"{1603C7DC-358B-97AF-B451-B2DDAC734117}" = Catalyst Control Center Localization French
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{214030BC-490D-57D4-2547-D0D4ECC851A5}" = Catalyst Control Center Localization Japanese
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{25569723-DC5A-4467-A639-79535BF01B71}" = Adobe Help Center 2.1
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216034FF}" = Java(TM) 6 Update 35
"{2B98E4C3-AABC-9594-3219-A6EB60006C2C}" = Catalyst Control Center Graphics Full Existing
"{2C698DB8-0D99-5A27-DA3D-A3414FC5DBA7}" = Catalyst Control Center Graphics Light
"{30F509E9-B1DE-4CA9-B1D6-2E61C4552E38}" = IP CamSecure
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{31DBBB49-CAC2-984A-64CA-A88102056E10}" = CCC Help German
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{36A1E3D6-288A-4EEE-A081-30D9808B2BE3}" = Joe
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{412FECA2-836F-3DF6-A302-924CEC5B4DE2}" = CCC Help Spanish
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4448ABF6-786D-4C3D-A49D-7BB237E6DD17}" = Foxit PDF IFilter
"{46ACAEB5-365A-74BB-D405-980EA4FE3545}" = CCC Help Japanese
"{47645EB8-A5CE-4845-B2D7-E58E14E33F67}" = DDBAC
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AAB7E8F-1C71-E364-458F-5A6797670157}" = Catalyst Control Center Graphics Full New
"{4BB82AD9-0CF6-4E14-BD75-C1AB657C2914}" = EPSON APD4 Point and Print Support
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{55071B58-2D03-434C-828C-846842B307B4}" = Brother HL-2150N
"{55436A44-8385-4542-B38D-164713E1472A}" = SFirm32
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = Benutzerhandbuch
"{5F44C374-4786-4ad8-B1C0-67C1FBF335E6}" = Device Pack
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65E6362A-B878-4A7B-86DA-D16F8DBD75C7}" = ccc-core-static
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AA4C81A-D3BA-4B88-94D7-D2797A00C9B6}" = SX2x5 Firmware
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{6DD45BD7-DB28-E59F-8239-CF6816AE1FA4}" = Skins
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{76C73966-AED3-5ACB-B438-B47E9B1FB2E3}" = CCC Help Chinese Standard
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel(R) PRO Network Connections 12.1.11.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{794F49F0-2A44-EE74-62FE-22FD68953A25}" = ccc-utility
"{7CD5F286-FF0A-E638-8143-0E258E3C17E2}" = CCC Help Thai
"{7E7C9FB7-711A-4FF0-B22F-42BD08652096}" = talk&surf 6.0
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{98698CC8-F4C4-A0A7-F521-8547DDD1BB6B}" = Catalyst Control Center Localization Chinese Standard
"{98EABC7F-B1A1-43A5-B505-5B4EC3908DCD}" = Microsoft Security Client
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A224A7C3-4171-8822-2685-33C6AFD22F04}" = Catalyst Control Center Graphics Previews Vista
"{A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}" = Adobe Photoshop Elements 5.0
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B388231D-672A-4169-A3DF-BD80266252AB}" = StarMoney
"{B651AD20-D522-2D6F-3AC7-A5F625FCB283}" = Catalyst Control Center Core Implementation
"{BAA76F17-A59C-4C01-9FA1-2282F631D731}" = Installation Wizard
"{BBB3F622-D848-4CDA-B282-CC53627432F0}" = Microsoft Application Compatibility Toolkit 5.0
"{BF251EAF-8697-4E89-BF09-C998F97BBC40}" = Microsoft SQL Server Native Client
"{C3E2D64C-1B8E-D142-A76F-DEAC02AFF4FA}" = CCC Help Polish
"{C5145CD4-4F74-C986-F86B-F57F3995C59B}" = Catalyst Control Center Localization Arabic
"{C8D524C0-FBD2-C4F0-2446-912EABA681E0}" = CCC Help Portuguese
"{CCF7F09E-A1C5-7D81-437D-B2DC347CC52E}" = Catalyst Control Center Localization Spanish
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEEE47BB-4AB7-9AEB-2212-ECC6D05DDC74}" = Catalyst Control Center Localization Italian
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{D71B45B0-70B5-12BA-4ACF-2CEC94FE8A06}" = CCC Help Korean
"{D83BD5E2-5AF4-49F6-B5C1-484A9760E73D}" = Brother MFL-Pro Suite
"{DE6DE775-094F-43C1-8AAF-F67C6A753292}" = Gigaset SX2x5isdn / 417x / 307x
"{DF5F21A4-32FD-4A40-BEC0-7A147B7ED38C}" = talk&surf CAPI
"{E2A97415-BD97-4867-B906-05E39E9EE51F}" = HL-2250DN
"{E3723A04-A894-4036-A78E-282E18F43C0A}_is1" = Tinypic 3.18
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E7744050-4D6F-1280-5331-2EA048B51E94}" = Catalyst Control Center Localization Arabic
"{ECA80341-4BFB-172D-EC5D-64FD8DD41F5A}" = Catalyst Control Center Localization German
"{ECBEB9C6-CC47-70F7-E939-1E20E3BEEC8F}" = Catalyst Control Center Localization Korean
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F4FA8AC4-6B6A-CAA6-8E44-FC64227CC4F7}" = CCC Help Italian
"{F6412237-45F7-B34B-0803-4D77E2D39D0C}" = Catalyst Control Center Localization Chinese Traditional
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA9695CC-BFC6-4E17-8DFC-150EB43DD7E6}" = MySQL Connector/ODBC 3.51
"{FD01FEBF-376F-F125-09F8-E94B04D21E77}" = CCC Help French
"{FD023F61-65E9-465C-B558-7C64EB2B97E6}" = Assistant zum Anpassen des Dell-Systems
"{FF001690-A829-9DFD-9EF6-DA285783C49C}" = CCC Help Chinese Traditional
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop Elements 5" = Adobe Photoshop Elements 5.0
"Clarity & Success FTS-Uploader" = Clarity & Success FTS-Uploader
"CLARITY && SUCCESS" = CLARITY && SUCCESS
"DBView Element 2005_is1" = DBView Element 2005
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 9.04" = GPL Ghostscript
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{BAA76F17-A59C-4C01-9FA1-2282F631D731}" = Installation Wizard
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"Mozilla Thunderbird 12.0.1 (x86 de)" = Mozilla Thunderbird 12.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PROSetDX" = Intel(R) PRO Network Connections 12.1.11.0
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"TagScanner_is1" = TagScanner 5.1 build 571
"TeamViewer 7" = TeamViewer 7
"VLC media player" = VLC media player 1.0.5
"WinRAR archiver" = WinRAR Archivierer
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 01.11.2012 13:26:29 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:26:29 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:26:29 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:26:30 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:26:30 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:26:30 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:26:30 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:34:46 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:34:46 | Computer Name = BueroBo.*.local | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.11.2012 13:39:04 | Computer Name = BueroBo.*.local | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung firefox.exe, Version 16.0.2.4680, Zeitstempel
 0x50882871, fehlerhaftes Modul xul.dll, Version 16.0.2.4680, Zeitstempel 0x508827d6,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00130ef7,  Prozess-ID 0x928, Anwendungsstartzeit
 01cdb8570723770d.
 
[ System Events ]
Error - 22.09.2008 03:35:41 | Computer Name = BueroBo.*.local | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 22.09.2008 03:36:12 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 22.09.2008 03:36:32 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 22.09.2008 03:37:10 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 22.09.2008 04:21:02 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 22.09.2008 05:01:38 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 22.09.2008 09:53:13 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 22.09.2008 09:53:26 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 22.09.2008 11:28:21 | Computer Name = BueroBo.*.local | Source = DCOM | ID = 10016
Description = 
 
Error - 23.09.2008 03:04:54 | Computer Name = BueroBo.*.local | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 22.09.2008 um 19:57:56 unerwartet heruntergefahren.

Gruß

markus

< End of report >
[/doce]

M-K-D-B · 02.11.2012, 17:10

Servus,

na, das hört sich doch schon mal gut an.

So gehts weiter:

Schritt 1

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

:OTL
IE - HKCU\..\SearchScopes\{6F8665A2-8B28-4574-8CEB-627E2E764ACC}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=69545D87-C53C-

:commands
[Emptytemp]

Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Schritt 2

Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 3

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4
Downloade Dir bitte SecurityCheck

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Wenn der Scan beendet wurde sollte sich ein Textdokument ( checkup.txt ) öffnen.

Poste den Inhalt bitte hier.

Bitte poste mit deiner nächsten Antwort

die Logdatei von OTL,
die Logdatei von MBAM,
die Logdatei von ESET,
die Logdatei von SecurityCheck.

mnzmrk12 · 05.11.2012, 12:59

So, also:

OTL:

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6F8665A2-8B28-4574-8CEB-627E2E764ACC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F8665A2-8B28-4574-8CEB-627E2E764ACC}\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 50689 bytes
->Temporary Internet Files folder emptied: 66340 bytes
->Java cache emptied: 10478196 bytes
->FireFox cache emptied: 65048836 bytes
->Flash cache emptied: 670 bytes
 
User: All Users
 
User: Bo
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 9650250 bytes
->Java cache emptied: 301973 bytes
->FireFox cache emptied: 3967623 bytes
->Flash cache emptied: 4182 bytes
 
User: Bo.MUENZER
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 14680027 bytes
->Java cache emptied: 68141343 bytes
->FireFox cache emptied: 33757897 bytes
->Flash cache emptied: 30909 bytes
 
User: BO0CBD~1~MUE
->Temp folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Kamera
->Temp folder emptied: 980567 bytes
->Temporary Internet Files folder emptied: 370285 bytes
->Java cache emptied: 85524 bytes
->FireFox cache emptied: 96766992 bytes
->Flash cache emptied: 26220 bytes
 
User: Public
->Temp folder emptied: 0 bytes

Malwerebytes:
keine Funde, kein Log

ESET:
keine Funde, kein Log

Securitycheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.54  
 Windows Vista Service Pack 2 x86 (UAC is disabled!)  
 Internet Explorer 9  
``````````````Antivirus/Firewall Check:`````````````` 
Microsoft Security Essentials   
 Antivirus up to date!  
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.65.1.1000  
 Java(TM) 6 Update 22  
 Java(TM) 6 Update 35  
 Java(TM) SE Runtime Environment 6 
 Java(TM) 6 Update 4  
 Java(TM) 6 Update 5  
 Java(TM) 6 Update 7  
 Java version out of Date! 
 Adobe Flash Player 	11.4.402.287  
 Adobe Reader X (10.1.4) 
 Mozilla Firefox (16.0.2) 
 Mozilla Thunderbird 12.0.1 Thunderbird out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

Gruß

Markus

M-K-D-B · 05.11.2012, 18:19

Servus,

Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.

Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

Schritt 1
Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 9 ) herunter laden.
Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Software / Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
Klicke erneut OK.

Schritt 2
Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software / Programme deinstallieren--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome.

Schritt 3
Starte bitte Thunderbird --> Extras --> Einstellungen ---> Erweitert.
Wechsle in den Reiter Update und gehe sicher das Thunderbird nach Updates sucht und installiere diese auch.

Schritt 4
Bitte aktiviere die Benutzerkontensteuerung, wie es hier beschrieben ist.

Schritt 5
Ich würde dir empfehlen, 1 mal pro Woche auch mit diesem Scanner dein System zu prüfen.
Möchtest Du ESET denoch deinstallieren,
Drücke bitte die

+ R Taste und kopiere folgenden Text in das Ausführen Fenster.

Code:

ATTFilter

"%PROGRAMFILES%\Eset\Eset Online Scanner\OnlineScannerUninstaller.exe"

und drücke OK.

Schritt 6
Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.

Code:

ATTFilter

Combofix /Uninstall

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.

Schritt 7

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Uninstall.
Bestätige mit Ja.

Schritt 8
Starte bitte OTL und klicke auf Bereinigung.
Du wirst zu einem Neustart aufgefordert.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben.
Sollte ein verwendetes Programm nach dem Neustart noch verhanden sein, bitte mit Rechtsklick --> Löschen manuell entfernen.

Schritt 9
Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles, nur weil es Dich dazu auffordert und schön bunt ist.
Verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe.

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

mnzmrk12 · 05.11.2012, 21:41

Morsche,

das war genial! Herzlichen Dank für die Hilfe.

Die Tipps werde ich beachten.

Ganz herzliche Grüße

Markus

P.S.: Das bedeutet: Alles ist gut und du kannst das Thema aus dem Abo nehmen...

M-K-D-B · 06.11.2012, 15:46

Ich bin froh, dass wir helfen konnten

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.

02.11.2012, 14:51	#4
M-K-D-B /// TB-Ausbilder	Incredibar lässt isch nicht deaktivieren Servus, Starte bitte OTL.exe. Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button. Poste die OTL.txt und die Extras.txt hier in deinen Thread. Wie läuft dein Rechner derzeit? Gibt es noch Probleme mit Incredibar? Wenn ja, in welchem Browser?

06.11.2012, 15:46	#10
M-K-D-B /// TB-Ausbilder	Incredibar lässt isch nicht deaktivieren Ich bin froh, dass wir helfen konnten Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen.

Incredibar lässt isch nicht deaktivieren

Plagegeister aller Art und deren Bekämpfung: Incredibar lässt isch nicht deaktivieren