Problem W32/blaster.worm / Internet Security /

paulifun · 17.06.2013, 19:45

Hallo zusammen,

heute Nachmittag habe ich mir etwas eingefangen.
Nachdem ich beim automatischen Scan von "Internet Security Pro" nervös geworden bin, bis dato kannte ich die Anwendung nicht, und ich seitdem keine Office-Programme mehr öffnen kann, bin ich auf dieses Forum gestoßen.
Da wohl mehrere User mit ähnlichen Problem kämpfen, es aber keine einheitliche Lösung gibt, eröffne ich nun dieses Thema und hoffe auf eure Hilfe.

Ich würde gern, hier schon die otl.txt und extras.txt anhängen, das funktioniert augenblicklich im IE-Browser wohl auch nicht.

Grüße aus Oberbayern

schrauber · 17.06.2013, 19:46

Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Scan.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

paulifun · 17.06.2013, 19:56

Hallo,
kann die aktuelle Version nicht downloaden, weil angeblich JavaScript nicht aktiviert wäre, was aber lt. Internetoptionen/Sicherheit nicht stimmt.
Gruß
paulifun

schrauber · 17.06.2013, 20:15

Kannst du die tools von einem anderen Rechner laden und per USB Stick transferieren?

paulifun · 17.06.2013, 21:06

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-06-2013 01
Ran by Paul (administrator) on 17-06-2013 21:52:29
Running from C:\Users\Sandra\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(CyberLink) C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel® Corporation) C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
(Bandoo Media, inc) C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Intel(R) Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-11-29] ()
HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4  [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKLM\...\Run: [OOTag] C:\Program Files (x86)\Acer\OOBEOffer\ootag.exe [13856 2010-02-23] (Microsoft)
HKLM\...\Run: [Logitech Download Assistant] C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [1832760 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [112512 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [CDAServer] C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [456704 2012-02-20] ()
HKCU\...\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [OfficeSyncProcess] "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE" [911160 2012-01-18] (Microsoft Corporation)
HKCU\...\Run: [Internet Security] C:\Users\Paul\AppData\Roaming\ildefender.exe [847872 2013-06-17] (FileZilla Project)
HKLM-x32\...\Run: [SuiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k [297280 2011-04-24] (NTI Corporation)
HKLM-x32\...\Run: [OOTag] C:\Program Files (x86)\Acer\OOBEOffer\OOTag.exe [13856 2010-02-23] (Microsoft)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] "C:\Dolby PCEE4\pcee4.exe" -autostart [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ArcadeMovieService] "C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [177448 2011-08-26] (CyberLink Corp.)
HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE [1890744 2012-09-02] (Bandoo Media, inc)
HKLM-x32\...\Run: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-04-04] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll C:\Windows\system32\nvinitx.dll [241984 2011-11-27] (NVIDIA Corporation)
Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk
ShortcutTarget: Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
URLSearchHook: (No Name) - {78e516ef-11de-47a1-8364-a99b917ec5ee} -  No File
HKLM SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=484&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=484&systemid=406&sr=0&q={searchTerms}
HKLM-x32 SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=484&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=484&systemid=406&sr=0&q={searchTerms}
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=484&systemid=406&sr=0&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=484&systemid=406&sr=0&q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121008221328.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: FileConverter 1.3 Toolbar - {78e516ef-11de-47a1-8364-a99b917ec5ee} - C:\Program Files (x86)\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121008221328.dll No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
BHO-x32: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - FileConverter 1.3 Toolbar - {78e516ef-11de-47a1-8364-a99b917ec5ee} - C:\Program Files (x86)\FileConverter_1.3\prxtbFile.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll ()
Toolbar: HKCU - No Name - {78E516EF-11DE-47A1-8364-A99B917EC5EE} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86752 2013-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110816 2013-02-25] (Avira Operations GmbH & Co. KG)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-02-26] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-02-26] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-06] (Avira Operations GmbH & Co. KG)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-17 21:51 - 2013-06-17 21:53 - 01926844 ____A (Farbar) C:\Users\Sandra\Desktop\FRST64.exe
2013-06-17 21:51 - 2013-06-17 21:51 - 00000000 ____D C:\FRST
2013-06-17 20:20 - 2013-06-17 20:20 - 00123738 ____A C:\Users\Sandra\Downloads\Extras.Txt
2013-06-17 20:19 - 2013-06-17 20:19 - 00095260 ____A C:\Users\Sandra\Downloads\OTL.Txt
2013-06-17 20:12 - 2013-06-17 20:12 - 00602112 ____A (OldTimer Tools) C:\Users\Sandra\Downloads\OTL.exe
2013-06-17 17:37 - 2013-06-17 17:37 - 00000000 ____D C:\Users\Sandra\AppData\Roaming\Avira
2013-06-17 15:14 - 2013-06-17 15:14 - 00000000 ____D C:\Users\Paul\AppData\Roaming\Avira
2013-06-17 15:11 - 2013-06-17 15:11 - 00083160 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-17 15:10 - 2013-06-17 15:10 - 00002070 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-17 15:10 - 2013-06-17 15:10 - 00000000 ____D C:\ProgramData\Avira
2013-06-17 15:10 - 2013-06-17 15:10 - 00000000 ____D C:\Program Files (x86)\Avira
2013-06-17 15:10 - 2013-03-06 16:13 - 00028600 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-06-17 15:10 - 2013-02-26 16:56 - 00130016 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-06-17 15:10 - 2013-02-26 16:56 - 00100712 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-06-17 14:59 - 2013-06-17 15:01 - 102323272 ____A C:\Users\Paul\Downloads\avira_free3640_antivirus_de.exe
2013-06-17 14:59 - 2013-06-17 14:59 - 00000000 ____D C:\Users\Sandra\AppData\Local\Deployment
2013-06-17 14:59 - 2013-06-17 14:59 - 00000000 ____D C:\Users\Sandra\AppData\Local\Apps\2.0
2013-06-17 13:45 - 2013-06-17 13:45 - 00847872 ____A (FileZilla Project) C:\Users\Paul\AppData\Roaming\ildefender.exe
2013-06-17 13:45 - 2013-06-17 13:45 - 00000800 ____A C:\Users\Paul\Desktop\Internet Security Pro.lnk
2013-06-16 17:49 - 2013-06-16 17:50 - 00000000 ____D C:\Users\Paul\AppData\Local\{1FB9E386-07F9-4BB9-B4B4-ED5EF767A493}
2013-06-16 01:10 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-16 01:10 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-16 01:10 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-16 01:10 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-16 01:10 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-16 01:10 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-16 01:10 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-16 01:10 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-16 01:10 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-16 01:10 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-16 01:10 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-16 01:10 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-15 23:35 - 2013-06-15 23:36 - 00000000 ____D C:\Users\Paul\AppData\Local\{5D726BDE-5866-4B65-BFA6-3B502625F887}
2013-06-13 22:15 - 2013-06-13 22:15 - 00000000 ____D C:\Users\Paul\AppData\Local\{8C0DE504-B37A-4546-A3E0-1D63147B8558}
2013-06-13 01:11 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 01:11 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 01:11 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 01:11 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 01:11 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-13 01:11 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-13 01:11 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 01:11 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-13 01:11 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 01:11 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-13 01:11 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 01:11 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 01:11 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 01:11 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-13 01:11 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-13 01:11 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 01:11 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-13 01:11 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 01:11 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 23:05 - 2013-06-12 23:05 - 00000000 ____D C:\Users\Paul\AppData\Local\{D5E7B292-41F5-4BA4-B8D8-413CD8FD0EDE}
2013-06-12 18:32 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 18:32 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 18:32 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 18:32 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 18:32 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 18:32 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 18:32 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 18:32 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 18:32 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 18:32 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 18:32 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 18:32 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 18:32 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 18:32 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 18:32 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 18:32 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 18:32 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 18:31 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 18:31 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-11 23:37 - 2013-06-11 23:37 - 08610696 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-11 23:25 - 2013-06-11 23:25 - 00000000 ____D C:\Users\Paul\AppData\Local\{73982FF4-43C5-4377-A815-E5F10483FC2E}
2013-06-11 10:44 - 2013-06-11 10:44 - 00000000 ____D C:\Users\Paul\AppData\Local\{5885A9E0-1AE6-4DDF-AB60-0C5298AC4EC1}
2013-06-10 20:27 - 2013-06-10 20:28 - 00000000 ____D C:\Users\Paul\AppData\Local\{AC2A0FF8-8FEA-4B83-ACC9-BD0F0C512914}
2013-06-10 08:27 - 2013-06-10 08:27 - 00000000 ____D C:\Users\Paul\AppData\Local\{903F5F3F-F01C-4BF2-93E4-8C45B1AE01F5}
2013-06-09 19:17 - 2013-06-09 19:17 - 00000000 ____D C:\Users\Paul\AppData\Local\{F3E1A28F-37CD-46D8-AA13-3B09DCDFD6EF}
2013-06-08 17:49 - 2013-06-08 17:50 - 00456960 ____A C:\Windows\Minidump\060813-16926-01.dmp
2013-06-07 13:19 - 2013-06-07 13:19 - 00000000 ____D C:\Users\Paul\AppData\Local\{B1D4588F-102B-4953-B0FC-E0D7558522F0}
2013-06-05 21:29 - 2013-06-05 21:30 - 00000000 ____D C:\Users\Paul\AppData\Local\{E18AF7C9-7418-46DF-841B-106D1F228CF9}
2013-06-04 20:48 - 2013-06-04 20:48 - 00000000 ____D C:\Users\Paul\AppData\Local\{EA73942A-5980-4B78-A93F-925890ADA6AE}
2013-06-03 14:20 - 2013-06-03 14:20 - 00000246 ____A C:\Users\Paul\Documents\yellowstrom.txt
2013-06-03 13:26 - 2013-06-03 13:26 - 00000000 ____D C:\Users\Paul\AppData\Local\{3B9B22BB-21F4-46C6-9A90-7187C72F7CFC}
2013-06-02 20:58 - 2013-06-02 20:58 - 00000000 ____D C:\Users\Paul\AppData\Local\{E1215D35-13D1-475C-9F1F-DB180696082A}
2013-05-31 20:17 - 2013-05-31 20:17 - 00000000 ____D C:\Users\Paul\AppData\Local\{5CA1AB71-FF4C-456C-B47B-0F0FF4D013DF}
2013-05-28 19:41 - 2013-05-28 19:41 - 00000000 ____D C:\Users\Paul\AppData\Local\{CA93E33B-3671-4659-BBFF-C7611624F6FE}
2013-05-26 22:00 - 2013-05-26 22:00 - 00010259 ____A C:\Users\Paul\Documents\mannschaft.xlsx
2013-05-26 20:43 - 2013-05-26 20:43 - 00000000 ____D C:\Users\Paul\AppData\Local\{03B1C27C-2BF8-4F36-80C8-9EBBE7444EFD}
2013-05-24 22:28 - 2013-05-24 22:28 - 00000000 ____D C:\Users\Paul\AppData\Local\{A99A268E-6120-4934-AC1B-A38F68D51331}
2013-05-22 21:12 - 2013-05-22 21:12 - 00000000 ____D C:\Users\Paul\AppData\Local\{4A9C357E-6360-4E56-A618-78D5A6206526}
2013-05-21 20:28 - 2013-05-21 20:28 - 00000000 ____D C:\Users\Paul\AppData\Local\{737FAC78-822B-4C1B-A57D-2E298E4E898B}
2013-05-20 11:42 - 2013-05-20 11:42 - 00000000 ____D C:\Users\Paul\AppData\Local\{8BAAE2D8-48AE-4EE4-8ADD-702DCB22380B}

==================== One Month Modified Files and Folders =======

2013-06-17 21:53 - 2013-06-17 21:51 - 01926844 ____A (Farbar) C:\Users\Sandra\Desktop\FRST64.exe
2013-06-17 21:52 - 2010-11-21 04:50 - 00000000 ____D C:\users\Administrator
2013-06-17 21:51 - 2013-06-17 21:51 - 00000000 ____D C:\FRST
2013-06-17 21:49 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-17 21:49 - 2009-07-14 06:51 - 00069876 ____A C:\Windows\setupact.log
2013-06-17 21:00 - 2012-09-25 07:41 - 01917607 ____A C:\Windows\WindowsUpdate.log
2013-06-17 20:37 - 2012-10-16 20:24 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-17 20:20 - 2013-06-17 20:20 - 00123738 ____A C:\Users\Sandra\Downloads\Extras.Txt
2013-06-17 20:19 - 2013-06-17 20:19 - 00095260 ____A C:\Users\Sandra\Downloads\OTL.Txt
2013-06-17 20:12 - 2013-06-17 20:12 - 00602112 ____A (OldTimer Tools) C:\Users\Sandra\Downloads\OTL.exe
2013-06-17 18:36 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-17 18:08 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-17 18:08 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-17 18:05 - 2012-12-07 00:14 - 00000629 ____A C:\Windows\wiso.ini
2013-06-17 18:02 - 2013-05-15 23:29 - 00011733 ____A C:\Windows\IE10_main.log
2013-06-17 17:37 - 2013-06-17 17:37 - 00000000 ____D C:\Users\Sandra\AppData\Roaming\Avira
2013-06-17 17:30 - 2010-11-21 05:47 - 00125136 ____A C:\Windows\PFRO.log
2013-06-17 15:14 - 2013-06-17 15:14 - 00000000 ____D C:\Users\Paul\AppData\Roaming\Avira
2013-06-17 15:11 - 2013-06-17 15:11 - 00083160 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-17 15:10 - 2013-06-17 15:10 - 00002070 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-17 15:10 - 2013-06-17 15:10 - 00000000 ____D C:\ProgramData\Avira
2013-06-17 15:10 - 2013-06-17 15:10 - 00000000 ____D C:\Program Files (x86)\Avira
2013-06-17 15:07 - 2012-07-03 15:51 - 00000000 ____D C:\ProgramData\McAfee
2013-06-17 15:01 - 2013-06-17 14:59 - 102323272 ____A C:\Users\Paul\Downloads\avira_free3640_antivirus_de.exe
2013-06-17 14:59 - 2013-06-17 14:59 - 00000000 ____D C:\Users\Sandra\AppData\Local\Deployment
2013-06-17 14:59 - 2013-06-17 14:59 - 00000000 ____D C:\Users\Sandra\AppData\Local\Apps\2.0
2013-06-17 13:45 - 2013-06-17 13:45 - 00847872 ____A (FileZilla Project) C:\Users\Paul\AppData\Roaming\ildefender.exe
2013-06-17 13:45 - 2013-06-17 13:45 - 00000800 ____A C:\Users\Paul\Desktop\Internet Security Pro.lnk
2013-06-17 13:40 - 2012-10-08 22:02 - 00000000 ____D C:\Users\Paul\AppData\Roaming\Skype
2013-06-16 17:50 - 2013-06-16 17:49 - 00000000 ____D C:\Users\Paul\AppData\Local\{1FB9E386-07F9-4BB9-B4B4-ED5EF767A493}
2013-06-15 23:36 - 2013-06-15 23:35 - 00000000 ____D C:\Users\Paul\AppData\Local\{5D726BDE-5866-4B65-BFA6-3B502625F887}
2013-06-13 22:55 - 2013-04-01 21:09 - 00074752 ____A C:\Users\Paul\Documents\Vorbereitung_Herren_2013.xls
2013-06-13 22:41 - 2012-11-03 20:27 - 00000072 ____A C:\Users\Public\LMDebug.log
2013-06-13 22:15 - 2013-06-13 22:15 - 00000000 ____D C:\Users\Paul\AppData\Local\{8C0DE504-B37A-4546-A3E0-1D63147B8558}
2013-06-13 01:12 - 2012-10-11 20:10 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 23:05 - 2013-06-12 23:05 - 00000000 ____D C:\Users\Paul\AppData\Local\{D5E7B292-41F5-4BA4-B8D8-413CD8FD0EDE}
2013-06-12 19:41 - 2013-04-01 21:04 - 00015198 ____A C:\Users\Paul\Documents\Statistik_2012.xlsx
2013-06-11 23:37 - 2013-06-11 23:37 - 08610696 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-11 23:37 - 2012-10-16 20:24 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 23:37 - 2012-07-03 16:16 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 23:25 - 2013-06-11 23:25 - 00000000 ____D C:\Users\Paul\AppData\Local\{73982FF4-43C5-4377-A815-E5F10483FC2E}
2013-06-11 10:44 - 2013-06-11 10:44 - 00000000 ____D C:\Users\Paul\AppData\Local\{5885A9E0-1AE6-4DDF-AB60-0C5298AC4EC1}
2013-06-10 22:33 - 2012-10-10 23:42 - 00000000 ____D C:\Users\Paul\AppData\Local\FreePDF_XP
2013-06-10 20:28 - 2013-06-10 20:27 - 00000000 ____D C:\Users\Paul\AppData\Local\{AC2A0FF8-8FEA-4B83-ACC9-BD0F0C512914}
2013-06-10 08:27 - 2013-06-10 08:27 - 00000000 ____D C:\Users\Paul\AppData\Local\{903F5F3F-F01C-4BF2-93E4-8C45B1AE01F5}
2013-06-09 19:17 - 2013-06-09 19:17 - 00000000 ____D C:\Users\Paul\AppData\Local\{F3E1A28F-37CD-46D8-AA13-3B09DCDFD6EF}
2013-06-08 17:50 - 2013-06-08 17:49 - 00456960 ____A C:\Windows\Minidump\060813-16926-01.dmp
2013-06-08 17:49 - 2013-01-12 11:57 - 428658452 ____A C:\Windows\MEMORY.DMP
2013-06-08 17:49 - 2013-01-12 11:57 - 00000000 ____D C:\Windows\Minidump
2013-06-08 16:08 - 2013-06-16 01:10 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 16:07 - 2013-06-16 01:10 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 16:06 - 2013-06-16 01:10 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 16:06 - 2013-06-16 01:10 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 16:06 - 2013-06-16 01:10 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 14:28 - 2013-06-16 01:10 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 13:42 - 2013-06-16 01:10 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 13:40 - 2013-06-16 01:10 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 13:40 - 2013-06-16 01:10 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 13:40 - 2013-06-16 01:10 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 13:40 - 2013-06-16 01:10 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 13:13 - 2013-06-16 01:10 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-08 00:34 - 2012-12-07 00:18 - 00000000 ____D C:\Users\Paul\Documents\Mein Steuer-Sparbuch Heute
2013-06-07 13:19 - 2013-06-07 13:19 - 00000000 ____D C:\Users\Paul\AppData\Local\{B1D4588F-102B-4953-B0FC-E0D7558522F0}
2013-06-05 21:30 - 2013-06-05 21:29 - 00000000 ____D C:\Users\Paul\AppData\Local\{E18AF7C9-7418-46DF-841B-106D1F228CF9}
2013-06-04 20:48 - 2013-06-04 20:48 - 00000000 ____D C:\Users\Paul\AppData\Local\{EA73942A-5980-4B78-A93F-925890ADA6AE}
2013-06-03 14:20 - 2013-06-03 14:20 - 00000246 ____A C:\Users\Paul\Documents\yellowstrom.txt
2013-06-03 13:26 - 2013-06-03 13:26 - 00000000 ____D C:\Users\Paul\AppData\Local\{3B9B22BB-21F4-46C6-9A90-7187C72F7CFC}
2013-06-03 02:24 - 2012-12-13 01:05 - 00023598 ____A C:\Users\Paul\Desktop\Mappe1.xlsx
2013-06-03 02:18 - 2012-12-07 00:21 - 00143360 ____A C:\Users\Paul\Desktop\Verbrauch_Wohnung.xls
2013-06-02 21:03 - 2012-09-25 17:34 - 00654166 ____A C:\Windows\System32\perfh007.dat
2013-06-02 21:03 - 2012-09-25 17:34 - 00130006 ____A C:\Windows\System32\perfc007.dat
2013-06-02 21:03 - 2009-07-14 07:13 - 01498506 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-02 20:58 - 2013-06-02 20:58 - 00000000 ____D C:\Users\Paul\AppData\Local\{E1215D35-13D1-475C-9F1F-DB180696082A}
2013-05-31 20:17 - 2013-05-31 20:17 - 00000000 ____D C:\Users\Paul\AppData\Local\{5CA1AB71-FF4C-456C-B47B-0F0FF4D013DF}
2013-05-30 13:42 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-05-28 19:41 - 2013-05-28 19:41 - 00000000 ____D C:\Users\Paul\AppData\Local\{CA93E33B-3671-4659-BBFF-C7611624F6FE}
2013-05-27 20:17 - 2012-10-08 20:38 - 00000000 ____D C:\Users\Sandra\AppData\Local\VirtualStore
2013-05-26 22:00 - 2013-05-26 22:00 - 00010259 ____A C:\Users\Paul\Documents\mannschaft.xlsx
2013-05-26 20:43 - 2013-05-26 20:43 - 00000000 ____D C:\Users\Paul\AppData\Local\{03B1C27C-2BF8-4F36-80C8-9EBBE7444EFD}
2013-05-24 22:28 - 2013-05-24 22:28 - 00000000 ____D C:\Users\Paul\AppData\Local\{A99A268E-6120-4934-AC1B-A38F68D51331}
2013-05-22 22:49 - 2013-04-29 16:01 - 00013458 ____A C:\Users\Paul\Documents\Abrechnung Strom 2013.xlsx
2013-05-22 21:12 - 2013-05-22 21:12 - 00000000 ____D C:\Users\Paul\AppData\Local\{4A9C357E-6360-4E56-A618-78D5A6206526}
2013-05-21 20:28 - 2013-05-21 20:28 - 00000000 ____D C:\Users\Paul\AppData\Local\{737FAC78-822B-4C1B-A57D-2E298E4E898B}
2013-05-20 11:42 - 2013-05-20 11:42 - 00000000 ____D C:\Users\Paul\AppData\Local\{8BAAE2D8-48AE-4EE4-8ADD-702DCB22380B}
2013-05-18 13:09 - 2013-03-25 20:47 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-05-18 13:09 - 2012-07-03 15:50 - 00000000 ____D C:\ProgramData\Skype

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-16 16:47

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-06-2013 01
Ran by Paul at 2013-06-17 21:53:43 Run:
Running from C:\Users\Sandra\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

???? ??? Windows Live (Version: 15.4.3502.0922)
???? Windows Live (Version: 15.4.3502.0922)
?????? ??????? ?? Windows Live (Version: 15.4.3502.0922)
???????? ?????????? Windows Live (Version: 15.4.3502.0922)
?????????? Windows Live (Version: 15.4.3502.0922)
??????????? ?? Windows Live (Version: 15.4.3502.0922)
Acer Backup Manager (Version: 3.0.0.99)
Acer Crystal Eye Webcam (Version: 1.0.1904)
Acer ePower Management (Version: 6.00.3008)
Acer eRecovery Management (Version: 5.00.3504)
Acer Games (Version: 1.0.2.5)
Acer Registration (Version: 1.04.3504)
Acer ScreenSaver (Version: 1.1.0519.2011)
Acer Updater (Version: 1.02.3500)
Adobe AIR (Version: 2.7.1.19610)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.224)
Adobe Reader X (10.1.0) MUI (Version: 10.1.0)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
Agatha Christie - Death on the Nile (Version: 2.2.0.98)
Apple Application Support (Version: 2.3.3)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Avira Free Antivirus (Version: 13.0.0.3640)
Backup Manager V3 (Version: 3.0.0.99)
Bejeweled 2 Deluxe (Version: 2.2.0.95)
Bing Bar (Version: 7.0.765.0)
Bonjour (Version: 3.0.0.10)
Broadcom Card Reader Driver Installer (Version: 14.8.2.2)
Broadcom NetLink Controller (Version: 14.8.4.1)
Chuzzle Deluxe (Version: 2.2.0.95)
clear.fi (Version: 1.0.1517_36458)
clear.fi (Version: 1.0.2024.00)
clear.fi (Version: 9.0.8026)
clear.fi Client (Version: 1.00.3500)
Common Desktop Agent (Version: 1.62.0)
Crazy Chicken Kart 2 (Version: 2.2.0.97)
D3DX10 (Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
dm-Fotowelt (Version: 5.0.1)
Dolby Advanced Audio v2 (Version: 7.2.7000.7)
eBay Worldwide (Version: 2.2.0409)
ETDWare PS/2-X64 8.0.6.3_WHQL (Version: 8.0.6.3)
Evernote v. 4.5.1 (Version: 4.5.1.5451)
FATE (Version: 2.2.0.97)
FileConverter 1.3 Toolbar (Version: 6.9.0.16)
FileZilla Client 3.5.3 (Version: 3.5.3)
Final Drive: Nitro (Version: 2.2.0.95)
Fooz Kids (Version: 3.0.8)
Fooz Kids Platform (Version: 2.1)
Fotogalerija Windows Live (Version: 15.4.3502.0922)
FreePDF (Remove only)
Galeria de Fotografias do Windows Live (Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (Version: 15.4.3502.0922)
Galeria fotogràfica del Windows Live (Version: 15.4.3502.0922)
Galeria fotografii uslugi Windows Live (Version: 15.4.3502.0922)
Galerie de photos Windows Live (Version: 15.4.3502.0922)
Galerie foto Windows Live (Version: 15.4.3502.0922)
GPL Ghostscript (Version: 9.04)
Identity Card (Version: 1.00.3501)
iDRS(tm) OCR Software by I.R.I.S (Version: 1.00.17 (17.04.2012))
Insaniquarium Deluxe (Version: 2.2.0.97)
Intel(R) Control Center (Version: 1.2.1.1007)
Intel(R) Management Engine Components (Version: 7.0.0.1144)
Intel(R) Processor Graphics (Version: 8.15.10.2418)
Intel(R) Rapid Storage Technology (Version: 10.5.0.1026)
Intel(R) WiDi Widget (Version: 1.2.0.0)
iTunes (Version: 11.0.2.26)
Java 7 Update 17 (Version: 7.0.170)
Java Auto Updater (Version: 2.1.9.0)
Jewel Match 3 (Version: 2.2.0.97)
Jewel Quest Solitaire (Version: 2.2.0.95)
John Deere Drive Green (Version: 2.2.0.95)
Junk Mail filter update (Version: 15.4.3502.0922)
Launch Manager (Version: 5.1.7)
Macromedia Dreamweaver MX (Version: 6.0)
Macromedia Extension Manager (Version: 1.5)
Mesh Runtime (Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (Version: 14.0.4763.1000)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 32-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT_amd64 (Version: 15.4.2862.0708)
Mystery of Mortlake Mansion (Version: 2.2.0.98)
MyWinLocker (Version: 4.0.14.27)
MyWinLocker 4 (Version: 4.0.14.27)
MyWinLocker Suite (Version: 4.0.14.19)
newsXpresso (Version: 1.0.0.40)
Norton Online Backup (Version: 2.1.17869)
NTI Media Maker 9 (Version: 9.0.2.9002)
NVIDIA Grafiktreiber 285.90 (Version: 285.90)
NVIDIA Install Application (Version: 2.1002.48.261)
NVIDIA Optimus 1.5.21 (Version: 1.5.21)
NVIDIA PhysX (Version: 9.10.0514)
NVIDIA Systemsteuerung 285.90 (Version: 285.90)
NVIDIA Update Components (Version: 1.5.21)
Penguins! (Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (Version: 2.2.0.95)
Poczta uslugi Windows Live (Version: 15.4.3502.0922)
Podstawowe programy Windows Live (Version: 15.4.3502.0922)
Polar Bowler (Version: 2.2.0.97)
Pošta Windows Live (Version: 15.4.3502.0922)
Raccolta foto di Windows Live (Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (Version: 6.0.1.6438)
RedMon - Redirection Port Monitor
Renesas Electronics USB 3.0 Host Controller Driver (Version: 2.0.34.0)
S?????? f?t???af??? t?? Windows Live (Version: 15.4.3502.0922)
Samsung CLX-3300 Series (Version: 1.01 (01.05.2012))
Samsung Easy Document Creator (Version: 1.02.09 (25.04.2012))
Samsung Easy Printer Manager (Version: 1.02.45.02(01.05.2012))
Samsung Printer Live Update (Version: 1.01.00.04)
Samsung Scan Process Machine (Version: 1.00.18.04)
Searchqu Toolbar (Version: 4.1.0.3114)
Shared C Run-time for x64 (Version: 10.0.0)
Shredder (Version: 2.0.8.9)
Skype™ 6.3 (Version: 6.3.107)
Slingo Deluxe (Version: 2.2.0.95)
SNS Upload for Easy Document Creator (Version: 1.0.0)
Torchlight (Version: 2.2.0.97)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.1.23.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition
Update for Microsoft Office 2010 (KB2553378) 64-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition
Update for Microsoft Outlook 2010 (KB2597090) 64-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2598240) 64-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life (Version: 2.2.0.97)
Wedding Dash (Version: 2.2.0.95)
Welcome Center (Version: 1.02.3504)
WildTangent Games App (Version: 4.0.10.5)
Windows Live ??? (Version: 15.4.3502.0922)
Windows Live ???? (Version: 15.4.3502.0922)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3538.0513)
Windows Live Fotogaléria (Version: 15.4.3502.0922)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live Fotogalleri (Version: 15.4.3502.0922)
Windows Live Fotograf Galerisi (Version: 15.4.3502.0922)
Windows Live Fotótár (Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (Version: 15.4.3502.0922)
Windows Live Galerija fotografija (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Temel Parçalar (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Liven asennustyökalu (Version: 15.4.3502.0922)
Windows Liven sähköposti (Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (Version: 15.4.3502.0922)
WISO Steuer-Sparbuch 2013 (Version: 20.00.8137)
Zuma Deluxe (Version: 2.2.0.95)

==================== Restore Points  =========================

27-05-2013 18:39:24 Geplanter Prüfpunkt
12-06-2013 23:10:44 Windows Update
15-06-2013 23:10:13 Windows Update

==================== Scheduled Tasks (whitelisted) =============

Task: {0EFF6600-B602-49B6-8CB7-4AB4F0BCE5AE} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2011-08-09] (Acer)
Task: {234165C6-77FA-4816-B6FE-A0B32BF4CE9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated)
Task: {3DFDCC71-68D0-4704-B1B4-BFD39A02869C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4536C5C5-0DD3-498F-ADE0-20FDF17E8032} - System32\Tasks\User_Feed_Synchronization-{D743778C-9899-437E-939C-B77BA2138A80} => C:\Windows\system32\msfeedssync.exe [2013-05-15] (Microsoft Corporation)
Task: {6EE2E1BD-0CD7-43A4-B8BC-EF2BEB1FE090} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => C:\Windows\system32\sc.exe [2009-07-14] (Microsoft Corporation)
Task: {81540B9F-B5BF-47EB-9C95-BE195BF2C664} - System32\Tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo => C:\Windows\system32\gatherNetworkInfo.vbs [2009-06-10] ()
Task: {8C72275B-4F22-40BC-9302-67ECDBD53829} - System32\Tasks\{C836A1DD-4FA0-4386-A582-6929A6D66E83} => C:\Program Files (x86)\Internet Explorer\iexplore.exe [2013-05-17] (Microsoft Corporation)
Task: {9D336B98-CC71-4DD4-B1BB-0AABA2CE5FBC} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {C15BC83C-8749-4978-8A05-965E3064E6F0} - System32\Tasks\clear.fiAgent => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe [2011-08-24] (CyberLink Corp.)
Task: {C8EC9FAA-3833-4407-B793-D1F39069BEBD} - System32\Tasks\clear.fi => C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fi.exe [2011-08-24] (Acer Incorporated)
Task: {D4C1C0BB-D4C2-4CBC-B8F9-911B1E958F20} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {ECD0DA4D-D90D-4A40-89D5-BF3AAC8711DF} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {F02776EE-822A-4494-9A28-BA27AF4B5782} - System32\Tasks\DMREngine => C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe [2011-08-24] (CyberLink)
Task: {FC336955-122A-4DA3-B7EC-78D983BFC81E} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/17/2013 09:50:46 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 09:03:25 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 06:04:43 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: NOBuClient.exe, Version: 2.1.17869.0, Zeitstempel: 0x4c056071
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x147c
Startzeit der fehlerhaften Anwendung: 0xNOBuClient.exe0
Pfad der fehlerhaften Anwendung: NOBuClient.exe1
Pfad des fehlerhaften Moduls: NOBuClient.exe2
Berichtskennung: NOBuClient.exe3

Error: (06/17/2013 05:42:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 05:32:08 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 03:08:25 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TurboBoost.exe, Version: 2.1.23.0, Zeitstempel: 0x4cf43103
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x119c
Startzeit der fehlerhaften Anwendung: 0xTurboBoost.exe0
Pfad der fehlerhaften Anwendung: TurboBoost.exe1
Pfad des fehlerhaften Moduls: TurboBoost.exe2
Berichtskennung: TurboBoost.exe3

Error: (06/17/2013 03:08:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TurboBoost.exe, Version: 2.1.23.0, Zeitstempel: 0x4cf43103
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0xce8
Startzeit der fehlerhaften Anwendung: 0xTurboBoost.exe0
Pfad der fehlerhaften Anwendung: TurboBoost.exe1
Pfad des fehlerhaften Moduls: TurboBoost.exe2
Berichtskennung: TurboBoost.exe3

Error: (06/17/2013 03:08:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 02:58:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ETDCtrlHelper.exe, Version: 8.2.0.8, Zeitstempel: 0x4d394e44
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x1490
Startzeit der fehlerhaften Anwendung: 0xETDCtrlHelper.exe0
Pfad der fehlerhaften Anwendung: ETDCtrlHelper.exe1
Pfad des fehlerhaften Moduls: ETDCtrlHelper.exe2
Berichtskennung: ETDCtrlHelper.exe3

Error: (06/17/2013 01:44:21 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: qcshm.exe, Version: 11.6.164.0, Zeitstempel: 0x504eafc8
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000009970a
ID des fehlerhaften Prozesses: 0x1a60
Startzeit der fehlerhaften Anwendung: 0xqcshm.exe0
Pfad der fehlerhaften Anwendung: qcshm.exe1
Pfad des fehlerhaften Moduls: qcshm.exe2
Berichtskennung: qcshm.exe3


System errors:
=============
Error: (06/17/2013 09:51:05 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (06/17/2013 09:03:43 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/17/2013 09:02:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/17/2013 09:02:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/17/2013 09:02:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/17/2013 09:02:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/17/2013 09:02:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/17/2013 09:01:58 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.

Modulpfad: C:\Windows\System32\bcmihvsrv64.dll
Fehlercode: 21

Error: (06/17/2013 09:01:57 PM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (06/17/2013 09:01:57 PM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}


Microsoft Office Sessions:
=========================
Error: (06/17/2013 09:50:46 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 09:03:25 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 06:04:43 PM) (Source: Application Error)(User: )
Description: NOBuClient.exe2.1.17869.04c056071ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a147c01ce6b74611299b4C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exeC:\Windows\SYSTEM32\ntdll.dll9f1cc570-d767-11e2-9819-dc0ea11c1d32

Error: (06/17/2013 05:42:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 05:32:08 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 03:08:25 PM) (Source: Application Error)(User: )
Description: TurboBoost.exe2.1.23.04cf43103ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a119c01ce6b5bc0a64fe3C:\Program Files\Intel\TurboBoost\TurboBoost.exeC:\Windows\SYSTEM32\ntdll.dllfe59fee4-d74e-11e2-a34d-dc0ea11c1d32

Error: (06/17/2013 03:08:17 PM) (Source: Application Error)(User: )
Description: TurboBoost.exe2.1.23.04cf43103ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970ace801ce6b5bbb171783C:\Program Files\Intel\TurboBoost\TurboBoost.exeC:\Windows\SYSTEM32\ntdll.dllf93845d1-d74e-11e2-a34d-dc0ea11c1d32

Error: (06/17/2013 03:08:02 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/17/2013 02:58:06 PM) (Source: Application Error)(User: )
Description: ETDCtrlHelper.exe8.2.0.84d394e44ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a149001ce6b5a4f75acb4C:\Program Files\Elantech\ETDCtrlHelper.exeC:\Windows\SYSTEM32\ntdll.dll8d39c6d6-d74d-11e2-afec-dc0ea11c1d32

Error: (06/17/2013 01:44:21 PM) (Source: Application Error)(User: )
Description: qcshm.exe11.6.164.0504eafc8ntdll.dll6.1.7601.177254ec4aa8ec0000005000000000009970a1a6001ce6b5000ae8d88c:\PROGRA~1\mcafee\mqs\qcshm.exeC:\Windows\SYSTEM32\ntdll.dll3f930be5-d743-11e2-afec-dc0ea11c1d32


==================== Memory info =========================== 

Percentage of memory in use: 36%
Total physical RAM: 5995.86 MB
Available physical RAM: 3792.47 MB
Total Pagefile: 11989.9 MB
Available Pagefile: 9568.29 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:222.73 GB) (Free:146.44 GB) NTFS (Disk=0 Partition=3)
Drive d: (DATA) (Fixed) (Total:223.4 GB) (Free:223.17 GB) NTFS (Disk=0 Partition=4)
Drive e: (04 Feb 2013) (CDROM) (Total:0.64 GB) (Free:0 GB) UDF
Drive f: (KINGSTON) (Removable) (Total:7.45 GB) (Free:3.33 GB) FAT32 (Disk=1 Partition=1)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 855188C3)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=223 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=223 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 5EE44B9B)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================

schrauber · 18.06.2013, 06:42

Hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

paulifun · 18.06.2013, 20:46

Servus schrauber,

hier die Combox Logfile:

Code:

ATTFilter

Combofix Logfile:

	Code: 

 ATTFilter

  
	ComboFix 13-06-18.02 - Paul 18.06.2013  21:31:57.1.8 - x64
ausgeführt von:: c:\users\Sandra\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Paul\AppData\Roaming\ildefender.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-05-18 bis 2013-06-18  ))))))))))))))))))))))))))))))
.
.
2013-06-18 19:38 . 2013-06-18 19:38	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-06-18 19:38 . 2013-06-18 19:38	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-06-18 19:38 . 2013-06-18 19:38	--------	d-----w-	c:\users\Paul\AppData\Local\temp
2013-06-17 19:51 . 2013-06-17 19:51	--------	d-----w-	C:\FRST
2013-06-17 15:37 . 2013-06-17 15:37	--------	d-----w-	c:\users\Sandra\AppData\Roaming\Avira
2013-06-17 13:14 . 2013-06-17 13:14	--------	d-----w-	c:\users\Paul\AppData\Roaming\Avira
2013-06-17 13:11 . 2013-06-17 13:11	83160	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-06-17 13:10 . 2013-06-17 13:10	--------	d-----w-	c:\programdata\Avira
2013-06-17 13:10 . 2013-06-17 13:10	--------	d-----w-	c:\program files (x86)\Avira
2013-06-17 13:10 . 2013-03-06 14:13	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-06-17 13:10 . 2013-02-26 14:56	130016	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-06-17 13:10 . 2013-02-26 14:56	100712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-06-17 12:59 . 2013-06-17 12:59	--------	d-----w-	c:\users\Sandra\AppData\Local\Deployment
2013-06-17 12:59 . 2013-06-17 12:59	--------	d-----w-	c:\users\Sandra\AppData\Local\Apps
2013-06-12 23:12 . 2013-05-17 01:25	257536	----a-w-	c:\program files (x86)\Internet Explorer\ieproxy.dll
2013-06-12 23:12 . 2013-05-17 01:25	235520	----a-w-	c:\program files (x86)\Internet Explorer\IEShims.dll
2013-06-12 23:12 . 2013-05-17 00:58	701952	----a-w-	c:\program files\Internet Explorer\ieproxy.dll
2013-06-12 23:12 . 2013-05-17 00:58	356352	----a-w-	c:\program files\Internet Explorer\IEShims.dll
2013-06-12 16:31 . 2013-04-25 23:30	1505280	----a-w-	c:\windows\SysWow64\d3d11.dll
2013-06-12 16:31 . 2013-03-31 22:52	1887232	----a-w-	c:\windows\system32\d3d11.dll
2013-06-11 21:37 . 2013-06-11 21:37	8610696	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 23:12 . 2012-10-11 18:10	75825640	----a-w-	c:\windows\system32\MRT.exe
2013-06-11 21:37 . 2012-10-16 18:24	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-11 21:37 . 2012-07-03 14:16	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-15 21:42 . 2011-03-29 01:36	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-15 21:32 . 2013-05-15 21:32	73728	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-15 21:32 . 2013-05-15 21:32	719360	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2013-05-15 21:32 . 2013-05-15 21:32	523264	----a-w-	c:\windows\SysWow64\vbscript.dll
2013-05-15 21:32 . 2013-05-15 21:32	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2013-05-15 21:32 . 2013-05-15 21:32	38400	----a-w-	c:\windows\SysWow64\imgutil.dll
2013-05-15 21:32 . 2013-05-15 21:32	226304	----a-w-	c:\windows\system32\elshyph.dll
2013-05-15 21:32 . 2013-05-15 21:32	185344	----a-w-	c:\windows\SysWow64\elshyph.dll
2013-05-15 21:32 . 2013-05-15 21:32	158720	----a-w-	c:\windows\SysWow64\msls31.dll
2013-05-15 21:32 . 2013-05-15 21:32	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2013-05-15 21:32 . 2013-05-15 21:32	138752	----a-w-	c:\windows\SysWow64\wextract.exe
2013-05-15 21:32 . 2013-05-15 21:32	137216	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2013-05-15 21:32 . 2013-05-15 21:32	12800	----a-w-	c:\windows\SysWow64\mshta.exe
2013-05-15 21:32 . 2013-05-15 21:32	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2013-05-15 21:32 . 2013-05-15 21:32	1054720	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-15 21:32 . 2013-05-15 21:32	97280	----a-w-	c:\windows\system32\mshtmled.dll
2013-05-15 21:32 . 2013-05-15 21:32	92160	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2013-05-15 21:32 . 2013-05-15 21:32	905728	----a-w-	c:\windows\system32\mshtmlmedia.dll
2013-05-15 21:32 . 2013-05-15 21:32	81408	----a-w-	c:\windows\system32\icardie.dll
2013-05-15 21:32 . 2013-05-15 21:32	77312	----a-w-	c:\windows\system32\tdc.ocx
2013-05-15 21:32 . 2013-05-15 21:32	762368	----a-w-	c:\windows\system32\ieapfltr.dll
2013-05-15 21:32 . 2013-05-15 21:32	62976	----a-w-	c:\windows\system32\pngfilt.dll
2013-05-15 21:32 . 2013-05-15 21:32	61952	----a-w-	c:\windows\SysWow64\tdc.ocx
2013-05-15 21:32 . 2013-05-15 21:32	599552	----a-w-	c:\windows\system32\vbscript.dll
2013-05-15 21:32 . 2013-05-15 21:32	52224	----a-w-	c:\windows\system32\msfeedsbs.dll
2013-05-15 21:32 . 2013-05-15 21:32	51200	----a-w-	c:\windows\system32\imgutil.dll
2013-05-15 21:32 . 2013-05-15 21:32	48640	----a-w-	c:\windows\system32\mshtmler.dll
2013-05-15 21:32 . 2013-05-15 21:32	452096	----a-w-	c:\windows\system32\dxtmsft.dll
2013-05-15 21:32 . 2013-05-15 21:32	441856	----a-w-	c:\windows\system32\html.iec
2013-05-15 21:32 . 2013-05-15 21:32	361984	----a-w-	c:\windows\SysWow64\html.iec
2013-05-15 21:32 . 2013-05-15 21:32	281600	----a-w-	c:\windows\system32\dxtrans.dll
2013-05-15 21:32 . 2013-05-15 21:32	27648	----a-w-	c:\windows\system32\licmgr10.dll
2013-05-15 21:32 . 2013-05-15 21:32	270848	----a-w-	c:\windows\system32\iedkcs32.dll
2013-05-15 21:32 . 2013-05-15 21:32	247296	----a-w-	c:\windows\system32\webcheck.dll
2013-05-15 21:32 . 2013-05-15 21:32	235008	----a-w-	c:\windows\system32\url.dll
2013-05-15 21:32 . 2013-05-15 21:32	23040	----a-w-	c:\windows\SysWow64\licmgr10.dll
2013-05-15 21:32 . 2013-05-15 21:32	216064	----a-w-	c:\windows\system32\msls31.dll
2013-05-15 21:32 . 2013-05-15 21:32	197120	----a-w-	c:\windows\system32\msrating.dll
2013-05-15 21:32 . 2013-05-15 21:32	173568	----a-w-	c:\windows\system32\ieUnatt.exe
2013-05-15 21:32 . 2013-05-15 21:32	167424	----a-w-	c:\windows\system32\iexpress.exe
2013-05-15 21:32 . 2013-05-15 21:32	1509376	----a-w-	c:\windows\system32\inetcpl.cpl
2013-05-15 21:32 . 2013-05-15 21:32	149504	----a-w-	c:\windows\system32\occache.dll
2013-05-15 21:32 . 2013-05-15 21:32	144896	----a-w-	c:\windows\system32\wextract.exe
2013-05-15 21:32 . 2013-05-15 21:32	1441280	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2013-05-15 21:32 . 2013-05-15 21:32	1400416	----a-w-	c:\windows\system32\ieapfltr.dat
2013-05-15 21:32 . 2013-05-15 21:32	13824	----a-w-	c:\windows\system32\mshta.exe
2013-05-15 21:32 . 2013-05-15 21:32	136192	----a-w-	c:\windows\system32\iepeers.dll
2013-05-15 21:32 . 2013-05-15 21:32	135680	----a-w-	c:\windows\system32\IEAdvpack.dll
2013-05-15 21:32 . 2013-05-15 21:32	12800	----a-w-	c:\windows\system32\msfeedssync.exe
2013-05-15 21:32 . 2013-05-15 21:32	102912	----a-w-	c:\windows\system32\inseng.dll
2013-05-15 21:31 . 2013-05-15 21:31	9728	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	9728	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	648192	----a-w-	c:\windows\system32\d3d10level9.dll
2013-05-15 21:31 . 2013-05-15 21:31	604160	----a-w-	c:\windows\SysWow64\d3d10level9.dll
2013-05-15 21:31 . 2013-05-15 21:31	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	5632	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	5632	---ha-w-	c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	522752	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2013-05-15 21:31 . 2013-05-15 21:31	465920	----a-w-	c:\windows\system32\WMPhoto.dll
2013-05-15 21:31 . 2013-05-15 21:31	417792	----a-w-	c:\windows\SysWow64\WMPhoto.dll
2013-05-15 21:31 . 2013-05-15 21:31	4096	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	4096	---ha-w-	c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	3928064	----a-w-	c:\windows\system32\d2d1.dll
2013-05-15 21:31 . 2013-05-15 21:31	364544	----a-w-	c:\windows\SysWow64\XpsGdiConverter.dll
2013-05-15 21:31 . 2013-05-15 21:31	363008	----a-w-	c:\windows\system32\dxgi.dll
2013-05-15 21:31 . 2013-05-15 21:31	3584	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	3584	---ha-w-	c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	3419136	----a-w-	c:\windows\SysWow64\d2d1.dll
2013-05-15 21:31 . 2013-05-15 21:31	333312	----a-w-	c:\windows\system32\d3d10_1core.dll
2013-05-15 21:31 . 2013-05-15 21:31	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	3072	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	3072	---ha-w-	c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	296960	----a-w-	c:\windows\system32\d3d10core.dll
2013-05-15 21:31 . 2013-05-15 21:31	293376	----a-w-	c:\windows\SysWow64\dxgi.dll
2013-05-15 21:31 . 2013-05-15 21:31	2776576	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2013-05-15 21:31 . 2013-05-15 21:31	2565120	----a-w-	c:\windows\system32\d3d10warp.dll
2013-05-15 21:31 . 2013-05-15 21:31	2560	---ha-w-	c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	2560	---ha-w-	c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-15 21:31 . 2013-05-15 21:31	249856	----a-w-	c:\windows\SysWow64\d3d10_1core.dll
2013-05-15 21:31 . 2013-05-15 21:31	245248	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2013-05-15 21:31 . 2013-05-15 21:31	2284544	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2013-05-15 21:31 . 2013-05-15 21:31	221184	----a-w-	c:\windows\system32\UIAnimation.dll
2013-05-15 21:31 . 2013-05-15 21:31	220160	----a-w-	c:\windows\SysWow64\d3d10core.dll
2013-05-15 21:31 . 2013-05-15 21:31	207872	----a-w-	c:\windows\SysWow64\WindowsCodecsExt.dll
2013-05-15 21:31 . 2013-05-15 21:31	1988096	----a-w-	c:\windows\SysWow64\d3d10warp.dll
2013-05-15 21:31 . 2013-05-15 21:31	194560	----a-w-	c:\windows\system32\d3d10_1.dll
2013-05-15 21:31 . 2013-05-15 21:31	187392	----a-w-	c:\windows\SysWow64\UIAnimation.dll
2013-05-15 21:31 . 2013-05-15 21:31	1682432	----a-w-	c:\windows\system32\XpsPrint.dll
2013-05-15 21:31 . 2013-05-15 21:31	1643520	----a-w-	c:\windows\system32\DWrite.dll
2013-05-15 21:31 . 2013-05-15 21:31	161792	----a-w-	c:\windows\SysWow64\d3d10_1.dll
2013-05-15 21:31 . 2013-05-15 21:31	1247744	----a-w-	c:\windows\SysWow64\DWrite.dll
2013-05-15 21:31 . 2013-05-15 21:31	1238528	----a-w-	c:\windows\system32\d3d10.dll
2013-05-15 21:31 . 2013-05-15 21:31	1175552	----a-w-	c:\windows\system32\FntCache.dll
2013-05-15 21:31 . 2013-05-15 21:31	1158144	----a-w-	c:\windows\SysWow64\XpsPrint.dll
2013-05-15 21:31 . 2013-05-15 21:31	1080832	----a-w-	c:\windows\SysWow64\d3d10.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{78e516ef-11de-47a1-8364-a99b917ec5ee}"= "c:\program files (x86)\FileConverter_1.3\prxtbFile.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{78e516ef-11de-47a1-8364-a99b917ec5ee}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{78e516ef-11de-47a1-8364-a99b917ec5ee}]
2011-05-09 09:49	176936	----a-w-	c:\program files (x86)\FileConverter_1.3\prxtbFile.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}]
2012-02-27 08:42	88976	----a-w-	c:\progra~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{9D717F81-9148-4f12-8568-69135F087DB0}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{78e516ef-11de-47a1-8364-a99b917ec5ee}"= "c:\program files (x86)\FileConverter_1.3\prxtbFile.dll" [2011-05-09 176936]
"{99079a25-328f-4bd4-be04-00955acaa0a7}"= "c:\progra~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll" [2012-02-27 88976]
.
[HKEY_CLASSES_ROOT\clsid\{78e516ef-11de-47a1-8364-a99b917ec5ee}]
.
[HKEY_CLASSES_ROOT\clsid\{99079a25-328f-4bd4-be04-00955acaa0a7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
"OfficeSyncProcess"="c:\program files\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-18 911160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-09-20 341360]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2011-04-24 297280]
"OOTag"="c:\program files (x86)\Acer\OOBEOffer\OOTag.exe" [2010-02-23 13856]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" [2011-06-01 506712]
"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-08-26 177448]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-04-04 345312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\SEARCH~1\Datamngr\datamngr.dll c:\progra~2\SEARCH~1\Datamngr\IEBHO.dll c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\DRIVERS\b57xdbd.sys;c:\windows\SYSNATIVE\DRIVERS\b57xdbd.sys [x]
S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\DRIVERS\b57xdmp.sys;c:\windows\SYSNATIVE\DRIVERS\b57xdmp.sys [x]
S3 bScsiMSa;bScsiMSa;c:\windows\system32\DRIVERS\bScsiMSa.sys;c:\windows\SYSNATIVE\DRIVERS\bScsiMSa.sys [x]
S3 bScsiSDa;bScsiSDa;c:\windows\system32\DRIVERS\bScsiSDa.sys;c:\windows\SYSNATIVE\DRIVERS\bScsiSDa.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-16 21:37]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-06-21 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-06-21 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-06-21 416024]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-16 12673128]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-08-16 2277480]
"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-08-02 1831016]
"OOTag"="c:\program files (x86)\Acer\OOBEOffer\ootag.exe" [2010-02-23 13856]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-02-20 456704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\SEARCH~1\Datamngr\x64\datamngr.dll c:\progra~2\SEARCH~1\Datamngr\x64\IEBHO.dll c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Evernote 4.0 - c:\program files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-Internet Security - c:\users\Paul\AppData\Roaming\ildefender.exe
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
WebBrowser-{78E516EF-11DE-47A1-8364-A99B917EC5EE} - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-18  21:42:44
ComboFix-quarantined-files.txt  2013-06-18 19:42
.
Vor Suchlauf: 8 Verzeichnis(se), 161.483.141.120 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 162.495.352.832 Bytes frei
.
- - End Of File - - B216AD63AEAB5E177D7A057A32F68B38
         
 --- --- ---
D41D8CD98F00B204E9800998ECF8427E

schrauber · 19.06.2013, 07:14

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches OTL log bitte.

paulifun · 19.06.2013, 19:51

Servus schrauber,

so, da bin ich wieder. Der ESET Scan hat ein paar Stunden bei mir gedauert.
Hier nun die Logs:
AdwCleaner:
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v2.303 - Datei am 19/06/2013 um 17:40:10 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Paul - PAUL-NOTEBOOK
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Sandra\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Gelöscht mit Neustart : C:\Program Files (x86)\Searchqu Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\FileConverter_1.3
Ordner Gelöscht : C:\Users\Paul\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Paul\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Paul\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Paul\AppData\LocalLow\FileConverter_1.3
Ordner Gelöscht : C:\Users\Paul\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Paul\AppData\LocalLow\Searchqutoolbar

***** [Registrierungsdatenbank] *****

Daten Gelöscht : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll
Daten Gelöscht : [x64] HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll
Daten Gelöscht : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll
Daten Gelöscht : HKLM\..\Windows [AppInit_DLLs] = C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\FileConverter_1.3
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{78E516EF-11DE-47A1-8364-A99B917EC5EE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{78E516EF-11DE-47A1-8364-A99B917EC5EE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3241949
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\FileConverter_1.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{153D7D79-706C-443D-BA98-41CA86982C9D}
Schlüssel Gelöscht : HKLM\Software\SearchquMediabarTb
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{153D7D79-706C-443D-BA98-41CA86982C9D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78E516EF-11DE-47A1-8364-A99B917EC5EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0F72CB7C-4755-4953-8CEF-E82D51832ECB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F534B088-70E4-4693-BCEC-E9F37A19E056}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78E516EF-11DE-47A1-8364-A99B917EC5EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FileConverter_1.3 Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{78E516EF-11DE-47A1-8364-A99B917EC5EE}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{78E516EF-11DE-47A1-8364-A99B917EC5EE}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{78E516EF-11DE-47A1-8364-A99B917EC5EE}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{78E516EF-11DE-47A1-8364-A99B917EC5EE}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{99079A25-328F-4BD4-BE04-00955ACAA0A7}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Die Registrierungsdatenbank ist sauber.

*************************

AdwCleaner[S1].txt - [7502 octets] - [19/06/2013 17:40:10]

########## EOF - \AdwCleaner[S1].txt - [7562 octets] ##########

--- --- ---

[/CODE]
JRT:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Paul on 19.06.2013 at 17:44:57,42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Paul\appdata\locallow\datamngr"
Successfully deleted: [Folder] "C:\Program Files (x86)\searchqu toolbar"
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{02969AEF-97E1-4B4B-9220-5DC468FC202B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{03B1C27C-2BF8-4F36-80C8-9EBBE7444EFD}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{048B1774-E11D-4763-8293-C1117E5D3006}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{04E3A50D-6FEC-46A5-A651-EF7C5994C5AE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{0698B6FE-6D12-446A-86EE-ABB7B21A61DC}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{07165629-F0E4-4A42-A9EB-CC56AF84CD5F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{0733B7DA-8475-4425-8756-D3F86FD1D3AE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{0778BF66-9F3D-4100-A897-2A852361DA3B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{0A345D40-C1BA-4025-BBB5-9A48402EB98B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{0A92D374-9E61-4196-9EC3-6D4394509C4A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{0B4AE857-E72B-4509-9AB9-0AE01483D445}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{0F1CA82A-67B0-4A4F-B3F6-1DCA82EE7418}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{1113673D-55B4-478B-B636-74B5821F0D42}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{124E941F-BCE2-4DC5-BD0C-112E857E3F5E}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{12E87746-FA39-4409-ABB8-616704879472}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{16DFDA24-1983-43E7-9A24-E74B39FE6F47}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{175D7195-CD8B-4564-ACCE-0309D5CFA7F3}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{180187FD-B201-416D-B8B2-700765AB3176}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{1A9E84D1-E2DA-48AC-9175-6DBB435B7B14}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{1B63F5C5-4E7C-4F92-BD1C-FA748216FFF3}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{1E3E0D91-AE6A-48D3-AB03-C1271B60FBA9}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{1FB9E386-07F9-4BB9-B4B4-ED5EF767A493}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{22B30DC1-8532-4C22-8E09-86B23A17F307}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{25564F6B-1968-433C-95F4-AF24DCBE9B02}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{2606F964-E7E3-4128-8F8D-73A6CD52249B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{262D8295-0FCB-4955-82C7-9692976E9714}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{26DA7984-D9FA-42DD-B71F-12532CC50731}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{2A81AA9B-C61E-41B8-A5C9-4BC41C940EE7}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{2DB3377E-D7A8-41D6-A282-A984263A9424}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3022FA32-EDFF-4473-BC81-91C56D008D8F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{30AF7A4E-3B59-43F8-B027-E7F04DEF8627}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{32C5D2CD-05FE-4B0D-AA2A-3EC719D74FF5}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{37DB1433-3E56-4648-B59F-98D10A1B94C9}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{38826215-6D3E-4090-AF95-A1DA798A4919}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3AB59C52-FA5A-4634-9199-5815A5FAA411}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3B9B22BB-21F4-46C6-9A90-7187C72F7CFC}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3C5DEAC3-95E4-4065-9384-E48A63E8667F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3C7EC784-D63C-472A-ADA7-49BD052BD39A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3DB1B30E-74C1-4B3D-8DE8-1CF37D6C92E1}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3DCDA579-50D8-4305-9C07-D40C17C08674}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{3EC087ED-CC52-4039-8430-EF9960F71476}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{47948966-EE1D-4F95-98FB-A7B4DADAD414}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{47E38F77-615B-4491-A3E3-EEE5D1EE6246}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{48A9E68A-968F-40C7-9CCC-3CF4294D5AE9}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{4A9C357E-6360-4E56-A618-78D5A6206526}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{4B11AF8F-02AD-458B-B03B-C9BF211AD509}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{4C8A1C8E-3E0C-4C79-ADE4-8B11D5621762}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{4E5D74C1-9C7F-4388-B8A9-AD1B585BF948}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{4EA4B42D-FF86-4DEE-AEB4-46121AFEB4C4}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{4F8143E2-E670-4ADC-B33A-190C1039E111}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5068E551-B32E-4C59-9059-97340DD24DCF}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5102CEB4-F40C-422C-ABD8-AE9BDF56F39D}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5134B76B-D591-48BD-9653-5BD9847E2232}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5650CAF9-F40B-4BF6-9A29-E1D70416FEAD}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{56CD8B59-36A0-418A-9E57-0B51074297FA}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5730DAC2-749B-4123-AF03-69E6289C501B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5885A9E0-1AE6-4DDF-AB60-0C5298AC4EC1}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{591C7D43-CD16-41C9-A81E-BBE3F668D45F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5CA1AB71-FF4C-456C-B47B-0F0FF4D013DF}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5CEC6389-E8A7-4AA4-A3CA-2789E8155EC5}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5D726BDE-5866-4B65-BFA6-3B502625F887}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5EA8A05A-B58B-4273-9936-ACE5AAA23CD1}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{5EDDC8F7-2A80-48D9-B1C7-B8FE54038F84}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{61D986CF-7C78-4316-B129-6B39C7EC3093}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{6243C17F-8964-4BF9-ACF5-3682BCC9473D}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{62700E69-5D97-475F-9A82-22BE1D3AEC8A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{6272152E-C632-4CB6-B834-44F5E3FA7623}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{62748C33-A003-434F-9C08-F0C728886A5C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{632B330A-81E3-4488-8D4B-51EB6EAE8A03}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{66FCE8FA-860E-4904-BD12-69FF4BE7E91C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{6727FEB5-1C90-40FC-A035-C8C49618A829}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{6C9A8120-B02F-4982-9D4A-A62812597059}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{6DC106B8-5074-4F61-A947-D7DE8AF47AF9}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{6EDA61B6-8DDB-4E3E-860D-C8FAD4969F97}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{71BFD39B-1DC1-4CC0-9C33-319509CCC128}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{72371480-D035-418C-89AB-CB0D16EAB0BF}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{7249DF8D-1B36-43D9-8169-20587EE04929}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{737FAC78-822B-4C1B-A57D-2E298E4E898B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{7386A56C-1C58-4FF9-95E5-01F0F84E83BB}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{73982FF4-43C5-4377-A815-E5F10483FC2E}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{744128A6-03DC-4C88-9130-AC7CDA7D3FE1}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{76E9BFFD-FC4C-4541-A8FA-9A61400AB28C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{7810CFE5-C35D-41DF-AA4B-70F8F5550583}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{7CD3ADD7-8D40-461C-B8E1-01B2C7123326}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{7DDD906E-34F8-4681-9BD0-86FB47E85422}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{7E823159-988E-4406-B2E6-F6116D33CDAC}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{815CC851-E80A-41ED-8E12-6214CB2D4208}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{81E15342-09C3-4872-8E95-FCA787744F2C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{83C5B4DA-0747-4C4F-8A1D-0FA13447B12A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{847571AB-0D42-4EF7-9F05-0D59E03209ED}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8487710D-9E1D-493B-BA72-0BCCCE919F86}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{864C85DE-3CC2-4B9F-9E59-98D1D7FC6A37}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{86B122AC-ED17-44AC-8C2E-8C78282B0971}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{87113852-DFE5-491A-8DAB-368E4F16574D}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{894F49DD-14CF-4A12-944C-84C95BAE3447}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{89D64819-32BB-4F21-A46B-A14B80EE41FE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8A36E5E4-DF60-4ABE-86D5-1402C4C7D57B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8BAAE2D8-48AE-4EE4-8ADD-702DCB22380B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8C0DE504-B37A-4546-A3E0-1D63147B8558}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8C855A29-19B1-4327-8F0A-4C8FF59D15C7}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8C98149A-B05A-4749-BD04-75CBDEAA715E}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8D16625B-BF80-4D0F-A547-8D0F4AC62680}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8D8965BB-820D-4E39-8098-2CB76377F958}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8E297E61-CF62-46D6-81D7-924A2B6D9449}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8E354F21-EC27-4622-B0B3-317F16C7441E}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8E7F40C7-018B-48F8-A68A-0D93D4FA0AE8}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8EB5296F-8E0C-4948-BA67-F8825ABE912D}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{8F11AA2F-171B-41DF-B048-4B1D6575C546}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{903F5F3F-F01C-4BF2-93E4-8C45B1AE01F5}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{90DA1D9A-C76A-4111-AEE2-B351E5677890}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9515A5E0-F9C1-444B-ACC8-D4E5DCD7332C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{96932835-79AD-404D-90F1-A9953F72E922}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9A096D42-B486-48C4-B264-D62B5B3F9A74}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9D71A3D4-8EAA-44E4-85E9-89F74AE2DF90}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9D7744D4-AAFA-4DF1-AA22-4FDD48D2856C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9DB70963-630B-4A1E-A050-F3E15B7CDDA8}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9DD91BDD-2F79-49E2-AF27-C9A49BE153BB}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9E09EE91-92D8-4CD4-89D6-1258B38AD0D3}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9E54305B-5A98-4B1E-9CF2-C33687A00168}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{9F47FFEE-B859-4284-9950-0F482A2CC25B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{A1122A9B-D67B-4B63-9A26-000A28A32D3A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{A14AA844-A8CF-4B2C-977A-E7C69D00CA41}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{A64A0B4D-D04E-4C1B-A2D3-368DE4F58229}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{A99A268E-6120-4934-AC1B-A38F68D51331}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{AC2A0FF8-8FEA-4B83-ACC9-BD0F0C512914}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{AD2B78EB-6587-4DEB-BE6B-2A8BBAA0F60A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B0AF6F4F-D4F2-417D-B857-32BA4B54871F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B1D4588F-102B-4953-B0FC-E0D7558522F0}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B20C22FE-418C-4E86-B946-1E1CE73C3EE1}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B2B2108F-A7FE-4663-92EF-C44E81ADE5AF}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B3381F85-9B38-4C38-9B4F-6FCF772AF036}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B498176E-8120-473F-9CBE-F4B966EA877D}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B51DD5A6-5D83-4012-9A7D-802BCB130C6C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B58ED8D0-0FD6-46EF-8EC3-8427D846817F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B78ACBF8-2642-4BDE-AA58-BC871A21025B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B8ABA4C8-1B7E-4B44-816F-65AE3002ABAD}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{B943E68F-CCF0-4261-8C36-B68C64E70B7F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{BAECE300-7F2C-4DDD-A983-079ED3BB3764}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{BB7D0DAF-A6D3-4487-99C6-121BB7C2F8F2}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{BE3361BF-0A1B-4C87-93C9-F9ADD94DE46A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{BEAAC7A2-5C2F-41B7-A14F-F157E4752DA7}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{BEFAD51A-F19B-4251-A1CE-5FB80062C50D}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{BF96289C-C5A1-49B1-B85B-29DB6BEDE76C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{C27E8E7F-2DA9-45E8-9E0C-3F59AE7026F9}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{C32E3311-73E3-47FB-98E5-6FF5EA00CE94}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{C45DF68D-7AC0-41CF-AD8A-E4C44DD3DCD2}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{C5575069-1B4E-4447-977F-9CB3B2F8C62F}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{C8078EE0-6596-4990-B0CE-F437B8B8FEDA}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{C9312208-CF5F-47BE-A943-0FEF8FEFD5FB}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{CA68ACED-4714-4711-B71D-6EC47D25EE6B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{CA6992C8-791A-4533-A6FF-05B7E1361E5E}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{CA93E33B-3671-4659-BBFF-C7611624F6FE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{CC541FA6-A9E1-465C-9993-C82D131E6AC6}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{CDA4EF17-986B-4859-8CFD-70194F5CD341}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{CDD8C614-266A-4EC6-9716-A25C57CD12F4}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{CEC98C06-942C-4C35-AC87-446C83D01863}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D029EAD8-D602-4EA0-8DC4-073539459587}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D2109215-1FEA-42F3-85C5-C25E46D90299}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D33341FB-15BD-41FF-9FC7-265B42465236}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D4A4B654-A304-4366-8FC4-E921E1906BF4}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D5E7B292-41F5-4BA4-B8D8-413CD8FD0EDE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D6F2B72C-9029-4580-8242-DB48CF7A0333}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D87E209E-02E9-4CED-ADA9-0FDD31EF1CBE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D90DD56D-C7A9-4C5E-B6AF-AF6F8C9FA5EF}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{D9D961C9-E5A9-4DD2-B3A3-62E916674F8E}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{DC7C477B-4B92-44A7-9AD9-A7973E2421D8}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{DD1FE296-B0A8-4687-848D-5604D0CECAC7}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{DDC84347-6F4A-4670-81B9-FA7D332AFFA2}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{DF4FB8F3-0376-4592-9C7F-A763FB3580A4}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{DFDB8A12-0207-4317-9844-AA087B03A9A9}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{E111AAB1-3381-4EB8-A0D7-77D60DB72D12}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{E1215D35-13D1-475C-9F1F-DB180696082A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{E18AF7C9-7418-46DF-841B-106D1F228CF9}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{E5D5EB14-E05C-48F2-A209-8E3C1E962082}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{E656D414-9D9B-423A-A089-BEBDFB27143A}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{E85F379B-AEEA-4E66-97B8-0F82FA6169FE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{EA73942A-5980-4B78-A93F-925890ADA6AE}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{ECCBC8DC-EA5B-4868-8806-A7200718477B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{EF61BCC0-AEA3-4C55-9F10-AB61DF0A0E67}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{EFFE631E-F94E-4D67-B974-E030BF84262B}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{F09E261A-D25C-4D5A-972C-79E1E5D5AB95}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{F0E477E0-2746-4F5F-AF34-7EA7741782D1}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{F27C3BA5-7ED9-453B-B915-CECE65C77E3E}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{F3E1A28F-37CD-46D8-AA13-3B09DCDFD6EF}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{F46EC9EF-770B-4289-947F-68F7689616EB}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{F6E84EBD-DB19-4790-84F0-191A4E9B4DC4}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{F79B5D37-0FB0-4258-BD57-ACEB012659ED}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{FA1BA2AB-835E-46D9-AC23-E139C9C8DF2C}
Successfully deleted: [Empty Folder] C:\Users\Paul\appdata\local\{FF2DF1BC-210B-4428-BD39-AE5F26BEADC9}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.06.2013 at 17:49:34,59
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ESET:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=a28ca4d89e42eb4980a5b5d8862ccf45
# engine=14111
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-19 06:22:18
# local_time=2013-06-19 08:22:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 9662 237089428 2698 0
# compatibility_mode=5893 16776574 100 94 2987736 123295988 0 0
# scanned=199994
# found=2
# cleaned=0
# scan_time=8643
sh=3E6E944A33FF6929AF8793A586E0133A2E8EDED0 ft=1 fh=c71c0011a7f63234 vn="a variant of Win32/Kryptik.BDTN trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Paul\AppData\Roaming\ildefender.exe.vir"
sh=DC27D280CE16017A9096EB86DE5E5B7CF7A4CA79 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.OOR trojan" ac=I fn="C:\Users\Paul\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\25ae4688-4c6f7aab"

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.64  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
 WMI entry may not exist for antivirus; attempting automatic update. 
 Avira successfully updated! 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 17  
 Java version out of Date! 
 Adobe Reader 10.1.0 Adobe Reader out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Symantec Norton Online Backup NOBuAgent.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

und ein frisches OTL:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 19.06.2013 20:38:26 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sandra\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,86 Gb Total Physical Memory | 3,81 Gb Available Physical Memory | 65,10% Memory free
11,71 Gb Paging File | 9,60 Gb Available in Paging File | 82,02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 222,73 Gb Total Space | 150,71 Gb Free Space | 67,66% Space Free | Partition Type: NTFS
Drive D: | 223,40 Gb Total Space | 223,17 Gb Free Space | 99,90% Space Free | Partition Type: NTFS
Drive E: | 654,09 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
Drive F: | 7,45 Gb Total Space | 3,32 Gb Free Space | 44,61% Space Free | Partition Type: FAT32
 
Computer Name: PAUL-NOTEBOOK | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.19 17:37:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sandra\Desktop\OTL.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.04 11:22:39 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.02.25 16:47:33 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.02.25 16:47:19 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.11.27 00:57:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.08.26 14:14:40 | 000,177,448 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
PRC - [2011.08.24 18:03:44 | 000,120,104 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
PRC - [2011.08.24 18:03:42 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
PRC - [2011.07.01 04:51:14 | 000,418,896 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe
PRC - [2011.07.01 04:51:14 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2011.07.01 04:51:12 | 001,103,440 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2011.07.01 04:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2011.05.12 16:59:00 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.04.24 03:29:20 | 000,256,832 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
PRC - [2011.04.24 03:28:38 | 000,297,280 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
PRC - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.11.17 03:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.27 22:33:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.08.27 22:33:08 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.08.24 18:03:42 | 000,206,216 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
MOD - [2011.08.24 18:03:42 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
MOD - [2011.04.24 03:29:56 | 000,465,640 | ---- | M] () -- C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.06.11 23:37:16 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.02.25 16:47:33 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.02.25 16:47:19 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.09.25 08:15:45 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.11.27 00:57:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.08.02 11:59:46 | 000,872,552 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2011.07.01 04:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2011.06.21 21:55:04 | 000,173,424 | ---- | M] (Egis Technology Inc. ) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service)
SRV - [2011.06.07 12:25:12 | 000,191,752 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2011.05.12 16:59:00 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.04.24 03:29:20 | 000,256,832 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service)
SRV - [2011.03.29 06:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.11.29 15:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Running] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV - [2010.10.12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.06.02 00:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:20:56 | 000,174,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose64)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.03.06 16:13:37 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2013.02.26 16:56:51 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.02.26 16:56:50 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.09.28 11:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.07.03 16:09:03 | 000,062,776 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2012.07.03 16:09:03 | 000,022,648 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2012.07.03 16:09:03 | 000,020,520 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 15:16:48 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT)
DRV:64bit: - [2011.11.27 00:57:00 | 000,028,992 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2011.09.20 12:02:55 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2011.09.20 12:02:55 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2011.07.14 07:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.07.14 07:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.06.10 20:16:10 | 012,230,912 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.06.08 18:36:14 | 004,729,408 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2011.05.16 14:57:32 | 000,051,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiMSa.sys -- (bScsiMSa)
DRV:64bit: - [2011.05.09 20:42:16 | 000,425,000 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2011.05.06 10:11:12 | 000,086,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiSDa.sys -- (bScsiSDa)
DRV:64bit: - [2011.04.26 11:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.04.05 13:26:26 | 000,142,632 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2011.02.10 08:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2011.02.10 08:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2011.01.20 18:15:30 | 000,019,496 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdmp.sys -- (b57xdmp)
DRV:64bit: - [2011.01.20 18:15:28 | 000,067,624 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdbd.sys -- (b57xdbd)
DRV:64bit: - [2010.11.29 15:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.15 10:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\msktbird@mcafee.com: C:\Program Files\McAfee\MSK
 
 
O1 HOSTS File: ([2013.06.18 21:41:11 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20121008221328.dll File not found
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121008221328.dll File not found
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [CDAServer] C:\Programme\Common Files\Common Desktop Agent\CDASrv.exe ()
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [OOTag] C:\Program Files (x86)\Acer\OOBEOffer\ootag.exe (Microsoft)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcadeMovieService] C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
O4 - HKLM..\Run: [Dolby Advanced Audio v2] C:\Dolby PCEE4\pcee4.exe (Dolby Laboratories Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [OOTag] C:\Program Files (x86)\Acer\OOBEOffer\OOTag.exe (Microsoft)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35F05D5D-0BED-4E4B-A3CA-813873290AF4}: DhcpNameServer = 10.57.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBFDA0E7-74BA-4483-8BA4-CC777F893BD8}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.19 17:44:55 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.19 17:44:51 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.18 21:46:22 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.18 21:42:46 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\temp
[2013.06.18 21:29:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.06.18 21:29:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.06.18 21:29:29 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.06.18 21:29:14 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.06.18 21:28:56 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.06.17 21:51:17 | 000,000,000 | ---D | C] -- C:\FRST
[2013.06.17 15:14:59 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Avira
[2013.06.17 15:11:28 | 000,083,160 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.06.17 15:10:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.06.17 15:10:29 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.06.17 15:10:29 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.06.17 15:10:29 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.06.17 15:10:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.06.17 15:10:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.19 20:37:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.19 20:01:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.19 17:59:43 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.19 17:59:43 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.19 17:52:08 | 420,368,383 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.18 21:41:11 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.17 18:05:25 | 000,000,629 | ---- | M] () -- C:\Windows\wiso.ini
[2013.06.17 15:11:12 | 000,083,160 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.06.17 15:10:38 | 000,002,070 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.06.17 13:45:27 | 000,000,800 | ---- | M] () -- C:\Users\Paul\Desktop\Internet Security Pro.lnk
[2013.06.10 22:33:17 | 000,481,745 | ---- | M] () -- C:\Users\Paul\Desktop\Reisetipp von Sandra und Paul.pdf
[2013.06.10 22:25:46 | 000,021,466 | ---- | M] () -- C:\Users\Paul\Documents\p1000646.jpg
[2013.06.10 22:25:00 | 000,015,800 | ---- | M] () -- C:\Users\Paul\Documents\bali2008_149.jpg
[2013.06.10 22:20:43 | 000,012,943 | ---- | M] () -- C:\Users\Paul\Documents\smil.png
[2013.06.10 21:31:03 | 000,012,044 | ---- | M] () -- C:\Users\Paul\Documents\mexiko.png
[2013.06.10 21:16:49 | 000,044,837 | ---- | M] () -- C:\Users\Paul\Documents\cat012565_018_02.jpg
[2013.06.10 21:16:39 | 000,038,247 | ---- | M] () -- C:\Users\Paul\Documents\12565_rk_0018_cun70005ca.jpg
[2013.06.10 21:06:24 | 000,388,816 | ---- | M] () -- C:\Users\Paul\Documents\Reisetipp von Sandra und Tomek.pdf
[2013.06.10 21:06:18 | 002,267,856 | ---- | M] () -- C:\Users\Paul\Documents\Oli und Tine.pdf
[2013.06.08 17:49:54 | 428,658,452 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.06.02 21:03:02 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.02 21:03:02 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.02 21:03:02 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.02 21:03:02 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.02 21:03:02 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
 
========== Files Created - No Company Name ==========
 
[2013.06.18 21:29:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.06.18 21:29:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.06.18 21:29:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.06.18 21:29:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.06.18 21:29:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.17 15:10:38 | 000,002,070 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.06.17 13:45:27 | 000,000,800 | ---- | C] () -- C:\Users\Paul\Desktop\Internet Security Pro.lnk
[2013.06.10 22:33:15 | 000,481,745 | ---- | C] () -- C:\Users\Paul\Desktop\Reisetipp von Sandra und Paul.pdf
[2013.06.10 22:30:59 | 000,015,800 | ---- | C] () -- C:\Users\Paul\Documents\bali2008_149.jpg
[2013.06.10 22:26:09 | 000,021,466 | ---- | C] () -- C:\Users\Paul\Documents\p1000646.jpg
[2013.06.10 22:20:43 | 000,012,943 | ---- | C] () -- C:\Users\Paul\Documents\smil.png
[2013.06.10 21:31:03 | 000,012,044 | ---- | C] () -- C:\Users\Paul\Documents\mexiko.png
[2013.06.10 21:17:58 | 000,044,837 | ---- | C] () -- C:\Users\Paul\Documents\cat012565_018_02.jpg
[2013.06.10 21:17:43 | 000,038,247 | ---- | C] () -- C:\Users\Paul\Documents\12565_rk_0018_cun70005ca.jpg
[2013.06.10 21:06:21 | 000,388,816 | ---- | C] () -- C:\Users\Paul\Documents\Reisetipp von Sandra und Tomek.pdf
[2013.06.10 21:06:05 | 002,267,856 | ---- | C] () -- C:\Users\Paul\Documents\Oli und Tine.pdf
[2012.12.07 00:14:34 | 000,000,629 | ---- | C] () -- C:\Windows\wiso.ini
[2012.11.03 20:25:07 | 000,150,904 | ---- | C] () -- C:\Windows\Wiainst64.exe
[2012.07.03 15:59:36 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012.07.03 15:59:35 | 013,906,944 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012.07.03 15:59:35 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012.07.03 15:59:35 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012.07.03 15:59:35 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.12.18 00:15:32 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Buhl Data Service
[2012.10.25 23:38:03 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\FileZilla
[2012.10.08 22:18:04 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\FoozKids
[2012.10.10 23:41:16 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\FreePDF
[2012.11.03 20:11:21 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PowerCinema
[2012.11.03 20:25:42 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Samsung
[2012.10.08 23:16:50 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\WildTangent
[2012.10.10 23:28:16 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Windows Live Writer
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

[/CODE]

Freue mich auf dein Feedback.

Gruß
paulifun

schrauber · 20.06.2013, 08:01

Java und Adobe bitte updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Noch Probleme?

paulifun · 20.06.2013, 22:08

Servus schrauber,

leider habe ich tatsächlich noch ein Problem, und zwar beim Update von Java.
Nach der "erfolgreichen" Installation erhalte ich die Meldung: BrowerLaunchError: 3.

So konnnte ich TFC über meinen IE10 nicht downloaden, weil angeblich JavaScript nicht aktiv wäre.

Ich habe die alte und neue Java-Version deinstalliert und die neue Version installiert, leider ohne Erfolg.

Ich bitte dich nochmals um Unterstützung.

Ansonsten läuft wieder alles top

!

Gruß
paul

sorry, mir ist gerade doch noch etwas aufgefallen:

bei google oder youtube funktioniert der automatische Vorschlag nicht mehr und ich kann über youtube keine Videos starten

please, help!

schrauber · 21.06.2013, 09:09

Java und Flash bitte deinstallieren (falls noch vorhanden). Flash Player bitte neue Version installieren.

JavaRa Free Download

Javara laden und laufen lassen, Überreste von Java entfernen und nach Reboot aktuelle Java Version installieren

paulifun · 21.06.2013, 21:43

Hallo schrauber,

ich weiß nicht was los ist, aber ich bekomme Java nicht zum Laufen.
Ich hoffe, dass ich mich nicht allzu doof anstelle und ich Java und Flash korrekt aktualisiert habe.

Zusätzlich ist mir gerade aufgefallen, dass sich der Browserverlauf nicht löschen lässt.

Was kann ich noch tun ?

Gruß

schrauber · 22.06.2013, 12:55

Hm,

poste mal bitte ein frisches OTL Log. Javara haste laufen lassen?

paulifun · 23.06.2013, 14:51

Servus,

ja, ich habe javara laufen lassen.
Ich kann mein Problem überhaupt nicht verstehen.
Ich bekam bei der Neuinstallation von Flash und JAVA keine Fehlermeldung oder ähnliches.
Sehr seltsam kommt mir vor, dass ich den Browserverlauf nicht löschen kann.

hier noch ein aktuelles otl:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.06.2013 15:44:16 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sandra\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,86 Gb Total Physical Memory | 3,93 Gb Available Physical Memory | 67,11% Memory free
11,71 Gb Paging File | 9,59 Gb Available in Paging File | 81,89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 222,73 Gb Total Space | 151,79 Gb Free Space | 68,15% Space Free | Partition Type: NTFS
Drive D: | 223,40 Gb Total Space | 223,17 Gb Free Space | 99,90% Space Free | Partition Type: NTFS
Drive E: | 654,09 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: PAUL-NOTEBOOK | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.19 17:37:10 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sandra\Desktop\OTL.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.04.04 11:22:39 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.02.25 16:47:33 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.02.25 16:47:19 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.11.27 00:57:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011.08.26 14:14:40 | 000,177,448 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe
PRC - [2011.08.24 18:03:44 | 000,120,104 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
PRC - [2011.08.24 18:03:42 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
PRC - [2011.07.01 04:51:14 | 000,418,896 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe
PRC - [2011.07.01 04:51:14 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2011.07.01 04:51:12 | 001,103,440 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2011.07.01 04:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2011.05.12 16:59:00 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
PRC - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2011.04.24 03:29:20 | 000,256,832 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
PRC - [2011.04.24 03:28:38 | 000,297,280 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
PRC - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2011.02.23 22:19:22 | 000,371,200 | ---- | M] (shbox.de) -- C:\Program Files (x86)\FreePDF_XP\fpassist.exe
PRC - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.11.17 03:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.27 22:33:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.08.27 22:33:08 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.08.24 18:03:42 | 000,206,216 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll
MOD - [2011.08.24 18:03:42 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
MOD - [2011.04.24 03:29:56 | 000,465,640 | ---- | M] () -- C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.06.21 21:10:48 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.02.25 16:47:33 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.02.25 16:47:19 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.09.25 08:15:45 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.11.27 00:57:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011.08.02 11:59:46 | 000,872,552 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2011.07.01 04:51:12 | 000,353,360 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2011.06.21 21:55:04 | 000,173,424 | ---- | M] (Egis Technology Inc. ) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service)
SRV - [2011.06.07 12:25:12 | 000,191,752 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2011.05.12 16:59:00 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011.04.30 00:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011.04.24 03:29:20 | 000,256,832 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service)
SRV - [2011.03.29 06:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.11.29 15:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Running] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV - [2010.10.12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.06.02 00:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:20:56 | 000,174,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose64)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.03.06 16:13:37 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2013.02.26 16:56:51 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.02.26 16:56:50 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.09.28 11:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.07.03 16:09:03 | 000,062,776 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2012.07.03 16:09:03 | 000,022,648 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2012.07.03 16:09:03 | 000,020,520 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 15:16:48 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT)
DRV:64bit: - [2011.11.27 00:57:00 | 000,028,992 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2011.09.20 12:02:55 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2011.09.20 12:02:55 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2011.07.14 07:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.07.14 07:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.06.10 20:16:10 | 012,230,912 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.06.08 18:36:14 | 004,729,408 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2011.05.16 14:57:32 | 000,051,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiMSa.sys -- (bScsiMSa)
DRV:64bit: - [2011.05.09 20:42:16 | 000,425,000 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2011.05.06 10:11:12 | 000,086,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bScsiSDa.sys -- (bScsiSDa)
DRV:64bit: - [2011.04.26 11:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.04.05 13:26:26 | 000,142,632 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2011.02.10 08:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2011.02.10 08:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2011.01.20 18:15:30 | 000,019,496 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdmp.sys -- (b57xdmp)
DRV:64bit: - [2011.01.20 18:15:28 | 000,067,624 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\b57xdbd.sys -- (b57xdbd)
DRV:64bit: - [2010.11.29 15:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.10.15 10:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\msktbird@mcafee.com: C:\Program Files\McAfee\MSK
 
 
O1 HOSTS File: ([2013.06.18 21:41:11 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20121008221328.dll File not found
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [CDAServer] C:\Programme\Common Files\Common Desktop Agent\CDASrv.exe ()
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [OOTag] C:\Program Files (x86)\Acer\OOBEOffer\ootag.exe (Microsoft)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcadeMovieService] C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
O4 - HKLM..\Run: [Dolby Advanced Audio v2] C:\Dolby PCEE4\pcee4.exe (Dolby Laboratories Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [OOTag] C:\Program Files (x86)\Acer\OOBEOffer\OOTag.exe (Microsoft)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Add to Evernote 4.0 - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{35F05D5D-0BED-4E4B-A3CA-813873290AF4}: DhcpNameServer = 10.57.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BBFDA0E7-74BA-4483-8BA4-CC777F893BD8}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.23 15:39:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.06.23 15:25:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.06.21 22:51:26 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{CBE58922-BE44-4311-A73E-8510DC058935}
[2013.06.21 22:25:36 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\Diagnostics
[2013.06.20 22:45:25 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Paul\Desktop\TFC.exe
[2013.06.20 22:42:36 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\{6EDA66F8-DE7C-45BD-A247-4E2E1CC318DB}
[2013.06.19 17:44:55 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.19 17:44:51 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.18 21:46:22 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.18 21:42:46 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Local\temp
[2013.06.18 21:29:29 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.06.18 21:29:29 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.06.18 21:29:29 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.06.18 21:29:14 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.06.18 21:28:56 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.06.17 21:51:17 | 000,000,000 | ---D | C] -- C:\FRST
[2013.06.17 15:14:59 | 000,000,000 | ---D | C] -- C:\Users\Paul\AppData\Roaming\Avira
[2013.06.17 15:11:28 | 000,083,160 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.06.17 15:10:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2013.06.17 15:10:29 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.06.17 15:10:29 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.06.17 15:10:29 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.06.17 15:10:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2013.06.17 15:10:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.23 15:24:36 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.23 15:24:36 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.23 15:17:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.23 15:16:53 | 420,368,383 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.21 23:56:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.21 22:35:45 | 000,000,622 | ---- | M] () -- C:\Windows\wiso.ini
[2013.06.20 22:44:36 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Paul\Desktop\TFC.exe
[2013.06.20 22:19:09 | 000,002,023 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2013.06.18 21:41:11 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.17 15:11:12 | 000,083,160 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2013.06.17 15:10:38 | 000,002,070 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.06.10 22:33:17 | 000,481,745 | ---- | M] () -- C:\Users\Paul\Desktop\Reisetipp von Sandra und Paul.pdf
[2013.06.10 22:25:46 | 000,021,466 | ---- | M] () -- C:\Users\Paul\Documents\p1000646.jpg
[2013.06.10 22:25:00 | 000,015,800 | ---- | M] () -- C:\Users\Paul\Documents\bali2008_149.jpg
[2013.06.10 22:20:43 | 000,012,943 | ---- | M] () -- C:\Users\Paul\Documents\smil.png
[2013.06.10 21:31:03 | 000,012,044 | ---- | M] () -- C:\Users\Paul\Documents\mexiko.png
[2013.06.10 21:16:49 | 000,044,837 | ---- | M] () -- C:\Users\Paul\Documents\cat012565_018_02.jpg
[2013.06.10 21:16:39 | 000,038,247 | ---- | M] () -- C:\Users\Paul\Documents\12565_rk_0018_cun70005ca.jpg
[2013.06.10 21:06:24 | 000,388,816 | ---- | M] () -- C:\Users\Paul\Documents\Reisetipp von Sandra und Tomek.pdf
[2013.06.10 21:06:18 | 002,267,856 | ---- | M] () -- C:\Users\Paul\Documents\Oli und Tine.pdf
[2013.06.08 17:49:54 | 428,658,452 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.06.02 21:03:02 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.02 21:03:02 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.02 21:03:02 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.02 21:03:02 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.02 21:03:02 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
 
========== Files Created - No Company Name ==========
 
[2013.06.21 22:27:13 | 000,001,425 | ---- | C] () -- C:\Users\Paul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.06.21 21:10:49 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.18 21:29:29 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.06.18 21:29:29 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.06.18 21:29:29 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.06.18 21:29:29 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.06.18 21:29:29 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.06.17 15:10:38 | 000,002,070 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2013.06.10 22:33:15 | 000,481,745 | ---- | C] () -- C:\Users\Paul\Desktop\Reisetipp von Sandra und Paul.pdf
[2013.06.10 22:30:59 | 000,015,800 | ---- | C] () -- C:\Users\Paul\Documents\bali2008_149.jpg
[2013.06.10 22:26:09 | 000,021,466 | ---- | C] () -- C:\Users\Paul\Documents\p1000646.jpg
[2013.06.10 22:20:43 | 000,012,943 | ---- | C] () -- C:\Users\Paul\Documents\smil.png
[2013.06.10 21:31:03 | 000,012,044 | ---- | C] () -- C:\Users\Paul\Documents\mexiko.png
[2013.06.10 21:17:58 | 000,044,837 | ---- | C] () -- C:\Users\Paul\Documents\cat012565_018_02.jpg
[2013.06.10 21:17:43 | 000,038,247 | ---- | C] () -- C:\Users\Paul\Documents\12565_rk_0018_cun70005ca.jpg
[2013.06.10 21:06:21 | 000,388,816 | ---- | C] () -- C:\Users\Paul\Documents\Reisetipp von Sandra und Tomek.pdf
[2013.06.10 21:06:05 | 002,267,856 | ---- | C] () -- C:\Users\Paul\Documents\Oli und Tine.pdf
[2012.12.07 00:14:34 | 000,000,622 | ---- | C] () -- C:\Windows\wiso.ini
[2012.11.03 20:25:07 | 000,150,904 | ---- | C] () -- C:\Windows\Wiainst64.exe
[2012.07.03 15:59:36 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2012.07.03 15:59:35 | 013,906,944 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2012.07.03 15:59:35 | 000,218,304 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2012.07.03 15:59:35 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2012.07.03 15:59:35 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.12.18 00:15:32 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Buhl Data Service
[2012.10.25 23:38:03 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\FileZilla
[2012.10.08 22:18:04 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\FoozKids
[2012.10.10 23:41:16 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\FreePDF
[2012.11.03 20:11:21 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\PowerCinema
[2012.11.03 20:25:42 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Samsung
[2012.10.08 23:16:50 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\WildTangent
[2012.10.10 23:28:16 | 000,000,000 | ---D | M] -- C:\Users\Paul\AppData\Roaming\Windows Live Writer
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

[/CODE]

17.06.2013, 20:15	#4
schrauber /// the machine /// TB-Ausbilder	Problem W32/blaster.worm / Internet Security / Kannst du die tools von einem anderen Rechner laden und per USB Stick transferieren? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

22.06.2013, 12:55	#14
schrauber /// the machine /// TB-Ausbilder	Problem W32/blaster.worm / Internet Security / Hm, poste mal bitte ein frisches OTL Log. Javara haste laufen lassen? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Problem W32/blaster.worm / Internet Security /

Log-Analyse und Auswertung: Problem W32/blaster.worm / Internet Security /