Kann Increditbar und 5 Vieren, die Avira findet nicht löschen

FrankJ76 · 30.12.2012, 12:34

Ich habe eine Viruswarnung von Avira zum Anlass genommen, nach längerer Zeit einen Vollscan durchzuführen. 5 der 7 Vieren tauchen jedoch immer wieder auf. In der Quarantäne befinden sich aber nur 2 Funde: PHISH/Amazonfra.A.1 , EXP/CVE-2012-0507.CJ.

Erst jetzt habe ich bemerkt, dass mein Internetexplorer im "Administratorenzugang" mit Increditbar öffnet. Ob das ein zusätzliches Problem oder Symptom ist weiss ich nicht einzuschätzen.

Malwarebytes hat nichts gefunden. Superspyware hat unerwünschte Dateien gefunden wie Blümchen auf der Wiese. Inzwischen findet das Programm nichts mehr. Ccleaner hat nichts gefunden. Combofix habe ich 2 mal "drüberlaufen" lassen, hat aber nichts geändert (Ich habe jetzt gelesen, dass ich das nicht hätte tun sollen

)

Hoffe, die Infos reichen zunächt aus, dass Ihr mir sagen könnt, wie ich am besten weitermache. Bis dahin mach ich mal lieber nichts mehr!

System: Windows Vista SP2

Frank

Ich habe OLT vergessen:
Log 1:OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 30.12.2012 12:41:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Admin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 44,64% Memory free
4,21 Gb Paging File | 2,82 Gb Available in Paging File | 67,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 9,82 Gb Free Space | 14,07% Space Free | Partition Type: NTFS
Drive D: | 69,52 Gb Total Space | 50,60 Gb Free Space | 72,79% Space Free | Partition Type: NTFS
 
Computer Name:*** | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.txt [@ = txtfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [open] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02357FB8-33C3-42FE-9560-6CF08C5BBA85}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{03F732D5-5FAC-4D33-B260-290C564AC0DF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{05721F35-1F98-45D1-8FDF-E548C5C51742}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{1AD01665-965F-4695-A17B-C043EC19A5C1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{1CED5B13-8127-4DAB-B790-BE2B36253C1D}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{1DE5AAF2-3156-4DBE-81DD-CBB7C890544D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{20DA9439-EB2C-487E-B96C-DCB28645DB7C}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{24861A15-AA39-4E80-B49E-D3A8B5D2682F}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{29804081-F626-4EFC-B199-8AB5CAC66991}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{2D5BDA13-1D8F-4454-91C1-0C0823C54930}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{3074629D-F25D-4A45-865E-D8391EE08911}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{39307467-DF18-440F-A6F9-B4E6F3EC6493}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{3BFD94F3-C788-4920-A123-2B8E779DFA60}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{46CB1DF5-E937-4A56-8B1A-2F70AE72420C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{536C96C9-6FB2-42CE-A524-C0675EC5F864}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{55295564-FE17-46C2-82EF-5EC2C0A1DF18}" = rport=137 | protocol=17 | dir=out | app=system | 
"{58C3714B-EEB3-4D7F-9C2A-BAAA4EE4A153}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{5AB50D11-49C5-4D95-B8DE-172F269A9E16}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{5F8428CF-AD49-4CC8-8169-36F6985E3BCA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{62D7F8CE-7706-46A7-AC28-2C29A57D0040}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{6EF03AEE-76A8-4A0C-BA71-505F480EDF1F}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{70E5B07F-A049-44F5-AB06-619AA4F546C6}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{7AA72C2F-C7E8-4D1A-9A19-B18362D9AB48}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8446711F-493D-448D-B69B-53C88B87293E}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{8BC3C697-33EF-488C-9E7B-2BC10F507B4F}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{8DA7900B-97CA-4130-AB71-200B1288C590}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{8DDAB891-70FB-44C2-9F35-EC66166F85DA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{903349C3-3F70-496C-BF41-1D887EC42BBC}" = rport=445 | protocol=6 | dir=out | app=system | 
"{90AC9799-CBCD-47B4-903C-7888CFD54A41}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9428802B-CE32-4108-85DD-5A4D58A4B467}" = lport=138 | protocol=17 | dir=in | app=system | 
"{95828230-F3AB-47C7-8301-D2A02FE6AD44}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{9DA02A49-9162-4900-B686-B06889FA2A07}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{9E475E94-EA9C-4FD9-9C96-B9E6E217EB09}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{AA3B030C-9849-416A-B1C7-6ACBF55396CB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{ADF5EFDE-5A56-4948-A2FE-BE970A9107BC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{B18D75FA-6335-4C1A-B6A4-D02AF7CA6224}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{B254A53C-C592-4B7B-ACD3-3368E994B87D}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{B5F2C522-9438-4627-AA43-4EE3E5FD1A64}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{BEE26978-2653-4981-9D89-A15DB515246D}" = lport=137 | protocol=17 | dir=in | app=system | 
"{C1EAEB28-8C84-43D4-9850-07EC1C3F5947}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{C4AA7966-A2C6-46E5-ACBB-0E4B1CD65615}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C5B67E83-2835-4E29-8E8F-4A2FA7C4B3A4}" = rport=138 | protocol=17 | dir=out | app=system | 
"{C65CCFB0-6F6D-4564-8EE5-4982A1202BCE}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CAA90E5F-9E5F-4195-9BA3-04B01EA255AA}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D6056F6B-EFF3-4AC3-8562-D9F362706176}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DA977794-12FA-4D00-8C98-793FF991E424}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{DC648121-4829-4022-967C-1FFC2C4E9FB5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DE90F0D1-F5E1-4B40-964C-6AF66B74EC89}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{DFDDBA1C-D187-4ED3-ACA5-E3EB8B56E80C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E0C96F35-0D3A-4EFC-AC3C-EF40F3E1C857}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{E74A98B6-45B7-4C3D-94B5-76117A5C844C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E7E71E65-55F0-4B8D-8022-0617BC0A7EC5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E9404B1B-EB18-443E-B310-E9CF9B8078B1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{ECF95817-D2B0-4D44-BB5F-75ABB46A4A54}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{F3C7ADB4-FE2E-4377-8202-21674DB4F439}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FEF27DB0-1396-4E99-B990-EB779C669528}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FFDB9EA0-F7DE-458F-A0B7-92A7D85164B8}" = lport=445 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{011E822A-D877-4D7F-A1B3-2CA805F4420D}" = protocol=17 | dir=in | app=d:\philips\wi-fi mediaconnect.exe | 
"{03883CF2-F7E3-49E9-8ACA-C2F6468D94A0}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{03A84520-2D1B-4413-BB4B-C6176522BCB2}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{04F3EB13-3F7D-4876-BC22-81A99C1CE3A1}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{0C980E4F-0D3F-4F6F-9C35-B8C47D931D64}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{1B0ECDA2-0F60-4D18-90A3-937FDA1479DB}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{3FEE5643-2672-45B5-8961-4ECA80C7B77D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{42AB36D9-63A2-4856-9701-6F888281DB10}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{46655636-15C6-458E-8B90-4662E94722F7}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{47786EE3-5687-4BAF-B3DC-9A29530D68BB}" = protocol=6 | dir=in | app=d:\philips\wi-fi mediaconnect.exe | 
"{4A9E8436-A302-4CC9-899B-96E719FD1632}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{566E73BC-A526-4627-8D03-613204C12B81}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5E310962-847B-4C3E-B9BD-FBD06816ED58}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{5F099D05-F18A-42E4-A4ED-33505818D7A2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{6967EB91-A669-4877-9780-AC7F3BC07B06}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{74AD1779-587A-487E-968D-C332CFBAE241}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7C6C5C8C-38A3-4289-BA97-0A280D35A963}" = protocol=6 | dir=out | app=system | 
"{7FF66A00-7B3D-4243-84A4-74258975D92B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{8096AEBA-F668-4FE9-952D-F2646843A206}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{8A82518A-EAFC-4C85-8825-901B9FDF0B55}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{8B74280F-2E15-44EA-AE14-5BC45AD8C6F4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8C3F58CB-CA49-4682-ADFB-2413BB784BA0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8D966B48-FA9A-434C-9663-59FEB0CDAFA2}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{9205AAD8-2A45-48DB-A0E3-46312172E679}" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe | 
"{946401DE-3001-4B20-85CF-EADF4AD7C19B}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{95B07DD0-82BA-45C6-9FB1-EF8F4523D6E6}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{A3CFAC1E-79ED-403E-8819-F8F9904AA0E6}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{AF66F373-7A51-4B24-82F1-A76B386ED549}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{BA05302F-E76D-4857-A1B3-57DC0E208F58}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{BCB12243-449F-40DB-8227-59ECFF42E864}" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe | 
"{BD9B28B0-AB22-4262-BC75-C870750B031D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{BE176EC5-5C19-4ED2-A9B5-0AD11AF4B008}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C6B1CE0C-B7AF-4D96-A547-F159AFF8D8A7}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{D19F5A57-FC1E-4AAA-88CF-73B56324DFA9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D2428043-ED1C-4F30-99B9-FEB3590AEF27}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{D3970209-B557-4DB0-B5B3-82957BB56379}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{D88927C4-1B9A-4542-9B67-0D710A0919BB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{E1128BBF-373D-45A5-A6F3-4310A7B3B5F9}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{E600B2E4-F3BC-452E-891F-D7109DCC7C23}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{F12C2681-ECAC-4D1A-BAF1-1F91AE444698}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{59ED0130-4F3D-48FD-948B-0BFB3162DE43}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{5A5DDD91-5FFE-417F-BF48-E7C59708CA73}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"TCP Query User{8C5EBE90-7372-41E1-B2A8-CB157124310A}C:\program files\medion\medion nas tool\medion nas tool.exe" = protocol=6 | dir=in | app=c:\program files\medion\medion nas tool\medion nas tool.exe | 
"TCP Query User{8E117C6E-A1F6-41FF-AE77-8189520709F4}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe | 
"TCP Query User{9A5AC5CE-21C7-4EB6-A836-B44B14490300}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{BF4F77E9-DB60-4F27-A690-E73A4820472D}D:\philips\wi-fi mediaconnect.exe" = protocol=6 | dir=in | app=d:\philips\wi-fi mediaconnect.exe | 
"UDP Query User{1C293150-A1DC-4F1E-92F9-30775F6BF049}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe | 
"UDP Query User{2505308D-60B6-4C80-8394-BE7D062A7C2C}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{59F4B1A1-8583-41D9-8166-C6FEBE24A983}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{C5A08CFD-0572-4A16-B716-09AB48DCCD10}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"UDP Query User{CEAB7BC1-0DDC-4266-A5A7-827AE258BB3F}C:\program files\medion\medion nas tool\medion nas tool.exe" = protocol=17 | dir=in | app=c:\program files\medion\medion nas tool\medion nas tool.exe | 
"UDP Query User{FF3D64E5-1D4F-4180-8096-9BC209738708}D:\philips\wi-fi mediaconnect.exe" = protocol=17 | dir=in | app=d:\philips\wi-fi mediaconnect.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3600_series" = Canon iP3600 series Printer Driver
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX420_series" = Canon MX420 series MP Drivers
"{12D8CEE6-8E07-4CFE-B309-C36B87D1AAAC}" = PE-DESIGN Lite
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217010FF}" = Java 7 Update 10
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{412033BC-44CF-48D9-B813-4B835101F4D3}" = Adobe Illustrator 10
"{459699C3-9430-4381-964B-4248D87B49F9}" = Apple Mobile Device Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C2690CF-5B74-4F93-8139-7B5644CD6A3B}" = MobileMe Control Panel
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA58346A-A5D7-4659-91D6-38D07345BDCF}" = Wi-Fi MediaConnect
"{AA721D14-CFE2-410E-B975-79FE5F82F99F}" = MSVCMergeModules
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1031-7B44-A83000000003}" = Adobe Reader 8.3.1 - Deutsch
"{B0261E53-B6F1-474A-864B-E7C3CBF468E0}" = iTunes
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"CANONIJPLM100" = Inkjet Printer/Scanner Extended Survey Program
"CanonMyPrinter" = Canon Utilities My Printer
"CCleaner" = CCleaner
"GridVista" = Acer GridVista
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"MEDION NAS TOOL" = MEDION NAS TOOL
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Ravensburger tiptoi" = Ravensburger tiptoi
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1230436363-1807951384-3042092838-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Opera 12.12.1707" = Opera 12.12
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 30.12.2012 06:39:25 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000a9c9a,  Prozess-ID 0xcfc, 
Anwendungsstartzeit 01cde679e767d6be.
 
Error - 30.12.2012 06:40:07 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000ac3a4,  Prozess-ID 0x4ac, 
Anwendungsstartzeit 01cde67a08672a5e.
 
Error - 30.12.2012 06:40:41 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000ab8e6,  Prozess-ID 0x87c, 
Anwendungsstartzeit 01cde67a1d1700be.
 
Error - 30.12.2012 06:41:24 | Computer Name = Bruno | Source = LoadPerf | ID = 3002
Description = 
 
Error - 30.12.2012 06:46:22 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000a9d31,  Prozess-ID 0x7c8, 
Anwendungsstartzeit 01cde67ae5c6005c.
 
Error - 30.12.2012 06:46:59 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000ae1b1,  Prozess-ID 0x438, 
Anwendungsstartzeit 01cde67afe26f00c.
 
Error - 30.12.2012 06:47:34 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000ac692,  Prozess-ID 0x118, 
Anwendungsstartzeit 01cde67b12ccdb5c.
 
Error - 30.12.2012 06:47:53 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000ab0a8,  Prozess-ID 0x1214,
 Anwendungsstartzeit 01cde67b1abd24fc.
 
Error - 30.12.2012 06:50:18 | Computer Name = Bruno | Source = LoadPerf | ID = 3002
Description = 
 
Error - 30.12.2012 07:18:02 | Computer Name = Bruno | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung wmpnetwk.exe, Version 11.0.6001.7000, Zeitstempel
 0x47919370, fehlerhaftes Modul Indiv01.key, Version 11.0.6000.7000, Zeitstempel
 0x46ddb859, Ausnahmecode 0xc0000005, Fehleroffset 0x000b032f,  Prozess-ID 0xed4, 
Anwendungsstartzeit 01cde67f51cbcabc.
 
[ Media Center Events ]
Error - 04.12.2007 14:42:05 | Computer Name = Bruno | Source = Mcx2Svc | ID = 301
Description = 
 
Error - 04.12.2007 14:42:40 | Computer Name = Bruno | Source = Mcx2Svc | ID = 301
Description = 
 
Error - 06.12.2007 16:10:11 | Computer Name = Bruno | Source = Mcx2Dvcs | ID = 405
Description = 
 
Error - 06.12.2007 16:12:28 | Computer Name = Bruno | Source = Mcx2Dvcs | ID = 405
Description = 
 
Error - 18.12.2007 15:50:48 | Computer Name = Bruno | Source = McrMgr | ID = 100
Description = 
 
[ System Events ]
Error - 01.09.2008 02:37:24 | Computer Name = Bruno | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse
 001DD94CA638 wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat
 eine DHCPNACK-Meldung gesendet).
 
Error - 01.09.2008 03:26:14 | Computer Name = Bruno | Source = DCOM | ID = 10010
Description = 
 
Error - 01.09.2008 07:19:06 | Computer Name = Bruno | Source = HTTP | ID = 15016
Description = 
 
Error - 01.09.2008 08:54:48 | Computer Name = Bruno | Source = HTTP | ID = 15016
Description = 
 
Error - 01.09.2008 12:47:28 | Computer Name = Bruno | Source = HTTP | ID = 15016
Description = 
 
Error - 01.09.2008 14:41:22 | Computer Name = Bruno | Source = HTTP | ID = 15016
Description = 
 
Error - 01.09.2008 15:07:16 | Computer Name = Bruno | Source = HTTP | ID = 15016
Description = 
 
Error - 02.09.2008 13:55:33 | Computer Name = Bruno | Source = HTTP | ID = 15016
Description = 
 
Error - 02.09.2008 13:55:37 | Computer Name = Bruno | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.1.3 für die Netzwerkkarte mit der Netzwerkadresse
 001DD94CA638 wurde durch den DHCP-Server 0.0.0.0 abgelehnt (der DHCP-Server hat
 eine DHCPNACK-Meldung gesendet).
 
Error - 02.09.2008 14:13:31 | Computer Name = Bruno | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 02.09.2008 um 20:10:32 unerwartet heruntergefahren.
 
 
< End of report >

--- --- ---

Log 2:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 30.12.2012 12:41:45 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Admin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 44,64% Memory free
4,21 Gb Paging File | 2,82 Gb Available in Paging File | 67,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 9,82 Gb Free Space | 14,07% Space Free | Partition Type: NTFS
Drive D: | 69,52 Gb Total Space | 50,60 Gb Free Space | 72,79% Space Free | Partition Type: NTFS
 
Computer Name: BRUNO | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Admin\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
PRC - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Acer\ALaunch\ALaunchSvc.exe ()
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (!SASCORE) -- C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (IJPLMSVC) -- C:\Programme\Canon\IJPLM\ijplmsvc.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WMIService) -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
SRV - (eLockService) -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
SRV - (eRecoveryService) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (ALaunchService) -- C:\Acer\ALaunch\ALaunchSvc.exe ()
SRV - (MobilityService) -- C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (cpuz134) -- C:\Program Files\CPUID\PC Wizard 2010\pcwiz_x32.sys File not found
DRV - (catchme) -- C:\Users\Admin\AppData\Local\Temp\catchme.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (WFMC_VAD) -- C:\Windows\System32\drivers\wfmcvad.sys (WiFi Media Connect)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (USBCCID) -- C:\Windows\System32\drivers\usbccid.sys (Microsoft Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (int15) -- C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (DritekPortIO) -- C:\Programme\Launch Manager\DPortIO.sys (Dritek System Inc.)
DRV - (busbcrw) -- C:\Windows\System32\drivers\busbcrw.sys (Brother Industries, Ltd.)
DRV - (WSVD) -- C:\Windows\System32\drivers\WSVD.sys (Wasay)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb192?a=6R8IfUUceP&i=26
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = CE 63 BA 35 8D C7 CC 01  [binary data]
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&babsrc=SP_def
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\SearchScopes\{4CD74122-E893-4925-BFAD-D2C29F811ACC}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\SearchScopes\{885BEC68-4846-463F-B8D6-BDFE13A06DAA}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb192/?search={searchTerms}&loc=IB_DS&a=6R8IfUUceP&i=26
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.10.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.10.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\IB Updater\Firefox
 
[2012.10.15 19:36:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
 
O1 HOSTS File: ([2012.12.28 21:45:39 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\Toolbar\ShellBrowser: (no name) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - No CLSID value found.
O3 - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1230436363-1807951384-3042092838-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C9DDC0C0-6696-4D20-AB9F-DF5915F59BD7}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FAFC034B-F80B-4223-BBAA-1A2A7B772195}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\Windows\System32\eNetHook.dll) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.12.30 12:40:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012.12.30 10:52:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
[2012.12.30 10:45:14 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.12.30 10:38:36 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apps
[2012.12.30 06:34:24 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.12.30 06:34:24 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\temp
[2012.12.30 06:32:48 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.12.30 06:17:24 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.12.30 06:14:08 | 005,015,826 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012.12.29 13:41:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.12.29 13:41:40 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.12.29 13:41:40 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.12.28 20:17:11 | 012,774,200 | ---- | C] (Opera Software ASA) -- C:\Users\Admin\Documents\Opera_1212_int_Setup.exe
[2012.12.28 20:16:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask
[2012.12.28 20:16:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.12.28 20:16:05 | 000,859,072 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.12.28 20:16:05 | 000,260,528 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.12.28 20:15:55 | 000,093,640 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.12.28 20:15:54 | 000,174,000 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.12.28 20:15:54 | 000,173,992 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.12.28 20:15:34 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.12.27 20:59:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDION
[2012.12.27 20:59:08 | 000,000,000 | ---D | C] -- C:\Program Files\MEDION
[2012.12.22 09:15:43 | 000,293,376 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2012.12.22 09:15:43 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2012.12.15 12:00:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.12.15 11:59:57 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.12.15 11:59:54 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.12.15 11:59:54 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012.12.13 08:10:28 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.12.13 08:10:27 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.12.13 08:10:26 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.12.13 08:10:26 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.12.13 08:10:26 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.12.13 08:10:25 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.12.13 08:10:25 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.12.13 08:10:23 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.12.13 08:07:05 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2012.12.13 08:07:00 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2012.12.13 08:07:00 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2012.12.13 08:07:00 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winusb.dll
[2012.12.13 08:06:56 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2012.12.13 08:06:56 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2012.12.12 19:57:57 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll
[2012.12.12 19:57:57 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnsvr.exe
[2012.12.12 19:57:56 | 002,048,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.12.12 19:57:40 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.12.30 12:40:35 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012.12.30 12:36:14 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.12.30 12:36:14 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.12.30 12:18:01 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.12.30 12:05:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.12.30 11:51:11 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.12.30 11:48:39 | 000,000,510 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 0790b4bf-96b0-43f3-b6c6-c4feddd8f992.job
[2012.12.30 11:44:16 | 000,000,374 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012.12.30 11:43:33 | 000,067,584 | ---- | M] () -- C:\Windows\bootstat.dat
[2012.12.30 11:43:25 | 147,218,753 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.12.30 10:45:14 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.12.30 06:14:12 | 005,015,826 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012.12.29 13:42:00 | 000,000,510 | ---- | M] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 9ba680cf-9ffe-49da-8e96-9b98cf8fbe38.job
[2012.12.29 13:41:44 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.12.28 21:48:49 | 000,000,104 | ---- | M] () -- C:\Users\Admin\Desktop\Computer - Verknüpfung.lnk
[2012.12.28 21:45:39 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.12.28 20:17:19 | 012,774,200 | ---- | M] (Opera Software ASA) -- C:\Users\Admin\Documents\Opera_1212_int_Setup.exe
[2012.12.28 20:15:42 | 000,093,640 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.12.28 20:15:41 | 000,260,528 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.12.28 20:15:41 | 000,174,000 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.12.28 20:15:41 | 000,173,992 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.12.28 20:15:40 | 000,859,072 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.12.28 20:15:40 | 000,779,704 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.12.27 20:59:19 | 000,001,925 | ---- | M] () -- C:\Users\Public\Desktop\MEDION NAS TOOL.lnk
[2012.12.25 14:52:31 | 000,000,873 | ---- | M] () -- C:\Users\Admin\Desktop\tiptoi.lnk
[2012.12.22 13:02:27 | 000,320,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.12.16 14:12:54 | 000,034,304 | ---- | M] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2012.12.16 11:50:29 | 000,293,376 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2012.12.15 12:00:45 | 000,001,668 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.12.12 20:06:00 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.12.12 20:06:00 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.12.30 11:48:39 | 000,000,510 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 0790b4bf-96b0-43f3-b6c6-c4feddd8f992.job
[2012.12.30 11:35:48 | 147,218,753 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.12.30 10:45:14 | 000,000,808 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.12.29 13:42:00 | 000,000,510 | ---- | C] () -- C:\Windows\tasks\SUPERAntiSpyware Scheduled Task 9ba680cf-9ffe-49da-8e96-9b98cf8fbe38.job
[2012.12.29 13:41:44 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.12.28 21:48:49 | 000,000,104 | ---- | C] () -- C:\Users\Admin\Desktop\Computer - Verknüpfung.lnk
[2012.12.27 20:59:19 | 000,001,925 | ---- | C] () -- C:\Users\Public\Desktop\MEDION NAS TOOL.lnk
[2012.12.15 12:00:45 | 000,001,668 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.12.13 08:07:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.12.13 08:07:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.02.22 11:46:55 | 000,002,067 | ---- | C] () -- C:\ProgramData\repository.xml
[2011.09.09 08:45:38 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2011.08.31 09:15:34 | 000,000,000 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\wklnhst.dat
[2011.08.08 19:49:10 | 000,098,344 | ---- | C] () -- C:\Windows\unTMV.exe
 
========== ZeroAccess Check ==========
 
[2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 07:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 07:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2011.12.29 21:09:09 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Dropbox
[2010.12.12 15:34:56 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Opera
[2011.12.27 07:22:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\RavensburgerTipToi
[2010.08.24 18:33:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Softland
[2011.08.31 09:15:36 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Template
[2011.11.22 11:25:16 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TuneUp Software
[2009.10.18 15:25:25 | 000,000,000 | ---D | M] -- C:\Users\Frank\AppData\Roaming\becker
[2010.12.12 18:28:21 | 000,000,000 | ---D | M] -- C:\Users\Frank\AppData\Roaming\BitTorrent
[2010.07.05 08:14:10 | 000,000,000 | ---D | M] -- C:\Users\Frank\AppData\Roaming\Bubble
[2011.12.29 20:52:42 | 000,000,000 | ---D | M] -- C:\Users\Frank\AppData\Roaming\Dropbox
[2010.09.16 15:37:01 | 000,000,000 | ---D | M] -- C:\Users\Frank\AppData\Roaming\Opera
[2011.11.22 11:32:02 | 000,000,000 | ---D | M] -- C:\Users\Frank\AppData\Roaming\TuneUp Software
[2010.12.12 14:39:58 | 000,000,000 | ---D | M] -- C:\Users\Frank\AppData\Roaming\TwonkyMedia
[2012.02.22 12:24:43 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\Babylon
[2010.07.05 20:49:34 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\Bubble
[2008.03.18 10:39:50 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\gtk-2.0
[2010.05.25 18:55:03 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\Opera
[2011.12.16 19:50:52 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\RavensburgerTipToi
[2011.07.03 19:18:27 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\SoftMaker
[2011.08.31 09:16:50 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\Template
[2012.01.23 13:32:35 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\Thunderbird
[2008.11.12 20:21:40 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\Tobit
[2011.11.23 08:47:48 | 000,000,000 | ---D | M] -- C:\Users\Martina\AppData\Roaming\TuneUp Software
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

Kann Increditbar und 5 Vieren, die Avira findet nicht löschen

Plagegeister aller Art und deren Bekämpfung: Kann Increditbar und 5 Vieren, die Avira findet nicht löschen

Kann Increditbar und 5 Vieren, die Avira findet nicht löschen

Ähnliche Themen: Kann Increditbar und 5 Vieren, die Avira findet nicht löschen