Hallo zusammen,

als Laie und neuer im Forum hoffe ich, ich habe das richtige Rubrik im richtigen Forum gepostet.

Seit einigen Wochen kann ich weder Programme updaten noch neuinstallieren.
Mein Firefox und auch mein Internet Explorer sind nicht mehr da.
Ich kann nur noch den Explorer ohne Add Ons verwenden.

Wenn ich auf installieren klicke bekomme ich die Meldung ob ich als Administrator oder als Current User installieren möchte. Beides ist identisch.

Nachdem ich eine Variante angeklickt habe tut sich nichts mehr.

Ich verzweifele gerade und hoffe mir kann jemand von Euch helfen.

Schon jetzt vielen Dank
Entericher

Ich habe die OTL Geschichte laufen lassen, hier das Ergebnis.

OTL logfile created on: 23.07.2015 15:12:42 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Michael\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,91 Gb Total Physical Memory | 2,25 Gb Available Physical Memory | 57,56% Memory free
7,82 Gb Paging File | 5,16 Gb Available in Paging File | 66,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 143,56 Gb Total Space | 50,25 Gb Free Space | 35,00% Space Free | Partition Type: NTFS
Drive E: | 139,78 Gb Total Space | 14,17 Gb Free Space | 10,13% Space Free | Partition Type: NTFS

Computer Name: MICHAEL-PC | User Name: Michael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Michael\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
PRC - C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
PRC - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
PRC - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
PRC - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\Maps\R66Api.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.7.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\sqlite3.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\HtcDetect.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDetectLegend.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\htcDisk.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\OutputLog.dll ()
MOD - C:\Program Files (x86)\HTC\HTC Sync 3.0\fdHttpd.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\d599db4bed83bba71fe4fcc6c136afcb\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\820d67f73bbcc073564c7d90a7a1b4d4\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cea5d9b8e3d6ff3bf3be32cf5fcbcd02\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ad9c2f4737e1e07fa774af31a7d74235\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\86f429e0a23238cf277d464bd0433d86\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eba4ec48e3f7f16864c6d96f510fafd9\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\456d5e9d3a0a37697ab28c150e9ac5b7\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\155679a9c8991cc33f90d6b27bac1977\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\0bddc91cbf37d143f08f6684b2919566\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\610374fef100556da252243e673ac64b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\23bc3936180ff789f44259a211dfc7fc\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll ()
MOD - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll ()
MOD - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\LibXml2.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()


========== Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirMailService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (PassThru Service) -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe ()
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (STacSV) -- C:\Programme\IDT\WDM\stacsv64.exe (IDT, Inc.)
SRV - (EvtEng) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV - (RegSrvc) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (TurboBoost) -- C:\Programme\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV - (RoxWatch12) -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions)
SRV - (RoxMediaDB12OEM) -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (Bluetooth OBEX Service) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AESTFilters) -- C:\Programme\IDT\WDM\AESTSr64.exe (Andrea Electronics Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (avnetflt) -- C:\Windows\SysNative\drivers\avnetflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (NETwNs64) -- C:\Windows\SysNative\drivers\NETwsw00.sys (Intel Corporation)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Netaapl) -- C:\Windows\SysNative\drivers\netaapl64.sys (Apple Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (intelkmd) -- C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (STHDA) -- C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV:64bit: - (wdkmd) -- C:\Windows\SysNative\drivers\WDKMD.sys (Intel Corporation)
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (btmaux) -- C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (RSUSBSTOR) -- C:\Windows\SysNative\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (htcnprot) -- C:\Windows\SysNative\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (HTCAND64) -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV:64bit: - (silabser) -- C:\Windows\SysNative\drivers\silabser.sys (Silicon Laboratories)
DRV:64bit: - (silabenm) -- C:\Windows\SysNative\drivers\silabenm.sys (Silicon Laboratories, Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (cdrbsdrv) -- C:\Windows\SysWow64\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{2F1E335A-858A-4BE9-8F6B-D0AF1D018B53}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=hp
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..\SearchScopes\{125C6911-57D7-46C4-9907-430B26C5C007}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.countryCode: "DE"
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12"
FF - prefs.js..browser.search.region: "DE"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.internetcologne.de"
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20131118
FF - prefs.js..extensions.enabledAddons: %7B5384767E-00D9-40E9-B72F-9CC39D655D6F%7D:1.5.0.6
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.9.22
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:37.0.2
FF - prefs.js..keyword.URL: "hxxp://feed.snap.do/?publisher=SnapdoEMon&dpid=SnapdoEMon&co=DE&userid=7240ce40-cafc-440f-95fb-4e545f2ed0c6&searchtype=ds&q="


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.40.2: C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre1.8.0_40\bin\new_plugin\npjp2.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2: C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.40.2: C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2: C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)


[2011.08.07 10:04:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Extensions
[2015.04.23 09:58:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions
[2015.04.23 09:58:12 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2013.11.26 20:24:49 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Michael\AppData\Roaming\mozilla\Firefox\Profiles\0ukgw2b0.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2015.04.23 09:58:06 | 000,546,981 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2015.04.03 14:07:23 | 000,970,672 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.29 19:42:09 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.12.23 18:19:17 | 000,002,389 | ---- | M] () -- C:\Users\Michael\AppData\Roaming\mozilla\firefox\profiles\0ukgw2b0.default\searchplugins\Web Search.xml
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2015.05.05 20:12:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe (Dell, Inc.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Desktop Disc Tool] c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RoxWatchTray] c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.)
O4 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001..\Run: [Spybot-S&D Cleaning] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [DSUpdateLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe (Dell)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2053025297-1392147252-2601704167-1001\..Trusted Domains: blank ([]about in Lokales Intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 11.40.2)
O16:64bit: - DPF: {CAFEEFAC-0018-0000-0040-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 1.8.0_40)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_40-windows-i586.cab (Java Plug-in 1.8.0_40)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{499F0A3D-319F-4DFD-B959-FB4CCB904B4E}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{876B86BE-E977-45B7-AE7A-F7D7C5CC90FD}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (bj.dll) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{1bb7672f-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{1bb7672f-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{1bb76756-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{1bb76756-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{1bb7675f-6f84-11e1-9f48-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{1bb7675f-6f84-11e1-9f48-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{24b33342-6f9a-11e1-863c-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{24b33342-6f9a-11e1-863c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{24b333a1-6f9a-11e1-863c-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{24b333a1-6f9a-11e1-863c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{337f4733-6ec7-11e1-9a9a-001e101f1f81}\Shell - "" = AutoRun
O33 - MountPoints2\{337f4733-6ec7-11e1-9a9a-001e101f1f81}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{57795498-6e03-11e1-97d5-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{57795498-6e03-11e1-97d5-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{577954a6-6e03-11e1-97d5-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{577954a6-6e03-11e1-97d5-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{6959f816-6e01-11e1-99e9-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{6959f816-6e01-11e1-99e9-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{6959f82c-6e01-11e1-99e9-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{6959f82c-6e01-11e1-99e9-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{74bf0d38-5218-11e1-866c-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{74bf0d38-5218-11e1-866c-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{99b8c3cb-4e92-11e1-8551-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{99b8c3cb-4e92-11e1-8551-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{99b8c3df-4e92-11e1-8551-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{99b8c3df-4e92-11e1-8551-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{c500ba12-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{c500ba12-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{c500ba24-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{c500ba24-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{c500ba33-7005-11e1-969d-bc77373c0491}\Shell - "" = AutoRun
O33 - MountPoints2\{c500ba33-7005-11e1-969d-bc77373c0491}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{e1b790af-70d8-11e1-9792-001e101f4da1}\Shell - "" = AutoRun
O33 - MountPoints2\{e1b790af-70d8-11e1-9792-001e101f4da1}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{e1b790c2-70d8-11e1-9792-001e101f4da1}\Shell - "" = AutoRun
O33 - MountPoints2\{e1b790c2-70d8-11e1-9792-001e101f4da1}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2015.07.23 15:14:08 | 004,796,740 | ---- | C] (WinZip International LLC ) -- C:\Users\Michael\Desktop\wzmp_10.exe
[2015.07.23 15:11:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe

========== Files - Modified Within 30 Days ==========

[2015.07.23 15:14:12 | 004,796,740 | ---- | M] (WinZip International LLC ) -- C:\Users\Michael\Desktop\wzmp_10.exe
[2015.07.23 15:11:23 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Michael\Desktop\OTL.exe
[2015.07.23 14:51:31 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015.07.23 14:51:01 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015.07.23 14:24:43 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015.07.23 14:24:43 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015.07.23 14:24:01 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015.07.23 14:24:01 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2015.07.23 14:24:01 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015.07.23 14:24:01 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2015.07.23 14:24:01 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015.07.23 14:17:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015.07.23 14:17:24 | 3148,218,368 | -HS- | M] () -- C:\hiberfil.sys

========== Files Created - No Company Name ==========

[2013.09.16 21:03:06 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.08.24 20:46:14 | 000,016,650 | ---- | C] () -- C:\Users\Michael\AppData\Local\slot1.mm1

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010.07.27 16:59:11 | 014,162,944 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010.07.27 16:03:24 | 012,867,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 03:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013.03.21 10:14:10 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\2monkeys
[2013.07.07 22:21:36 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\8Floor
[2013.07.04 09:01:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar
[2013.05.17 08:06:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar Entertainment
[2012.06.21 22:02:45 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Alawar Stargaze
[2013.05.12 17:28:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AlawarEntertainment
[2013.01.02 17:49:51 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AquaSoft
[2011.08.15 20:45:03 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Artifex Mundi
[2011.10.17 21:25:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Astra Jigsaw Gift
[2012.08.04 21:30:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\AtlanticJourney
[2011.09.14 21:37:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Awem
[2012.09.20 12:35:25 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Big Finish
[2013.07.05 15:09:08 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Big Top Games
[2012.07.01 21:02:41 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\bigwig_media
[2013.08.11 11:58:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Blue Tea Games
[2013.05.31 12:56:56 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Boolat Games
[2013.05.15 13:44:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Boomzap
[2012.12.26 19:27:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\calibre
[2011.09.12 14:50:34 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Camel101
[2015.01.11 14:16:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Canneverbe Limited
[2014.10.07 09:44:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Canon
[2011.09.14 20:19:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\casanova
[2013.03.29 17:33:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\casualArts
[2012.09.19 11:53:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\CasualMechanics
[2011.08.22 21:20:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Chirurgie Simulation
[2013.06.01 21:07:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Color Brush
[2011.08.22 21:27:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Daedalic Entertainment
[2014.05.08 11:05:40 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Deep Shadows
[2012.06.26 20:21:50 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\DieselPuppet
[2012.07.20 20:42:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Digital Quarter
[2012.05.20 19:40:10 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\DominiGame Das Geheimnis des verschollenen Tempels
[2011.09.15 17:00:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Dragon Altar Games
[2011.08.26 20:23:28 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\driveridentifier
[2015.02.01 16:55:00 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Dropbox
[2012.07.10 21:36:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\EleFun Games
[2013.08.13 09:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Elephant Games
[2011.12.20 17:48:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\elsterformular
[2013.05.09 18:33:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\ERS Game Studios
[2011.08.07 13:23:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Fingertapps
[2011.08.21 20:54:02 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Flood Light Games
[2011.10.10 20:11:35 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Floodlight Games
[2011.09.29 19:58:53 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Friday's games
[2011.09.15 16:50:50 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Frogwares
[2013.05.10 09:35:58 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Funlinker
[2011.09.06 19:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GameHouse
[2013.06.06 22:27:22 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GameMill Entertainment
[2011.08.21 14:48:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GamersDigital
[2011.09.12 14:50:31 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GarageGames
[2011.08.13 21:29:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\GestaltGames
[2011.09.18 16:56:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gogii
[2013.06.04 16:57:38 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gogii Games
[2012.09.24 13:27:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Gunnar Games
[2012.06.17 18:33:49 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Happy Artist Studio
[2011.09.15 17:00:01 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HdO Adventure
[2013.03.24 22:40:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects Petrodollars
[2012.06.28 20:45:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects Romance
[2013.05.08 19:09:23 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Hidden Objects XIII
[2011.09.06 20:45:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HitPoint Studios
[2012.11.30 17:50:16 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HTC
[2012.11.30 17:50:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2014.03.31 21:31:00 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IcarusGames
[2011.08.26 19:38:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IDT
[2011.12.16 21:44:20 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IN-MEDIAKG
[2013.05.14 18:28:49 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Intenium
[2014.06.03 10:23:04 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\IteraLabs
[2012.07.25 21:21:28 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Jetdogs Studios
[2012.06.20 21:48:01 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\JoyBits
[2012.05.06 13:22:39 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\kingdom
[2011.08.13 20:30:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Lazy Turtle Games
[2011.08.07 09:24:14 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Leadertech
[2013.05.22 19:47:20 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LegacyGames
[2012.05.05 20:06:26 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LegacyInteractive
[2013.05.28 11:16:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\LocalLow
[2013.03.25 12:16:06 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MagicIndie
[2014.10.01 17:44:25 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Marmiko IT-Solutions GmbH
[2011.08.13 20:10:08 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Maximize Games
[2012.06.20 21:33:51 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MediaArt
[2011.08.18 20:43:55 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Meridian93
[2011.09.30 23:02:58 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MoMB_Full_Ger
[2011.12.16 21:45:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\mresreg
[2013.04.01 17:58:18 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MumboJumbo
[2011.08.08 20:40:43 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\My Games
[2013.04.20 13:07:14 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MyPhoneExplorer
[2014.03.31 21:16:38 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\MysteriousCaseOfJekyllAndHyde
[2011.10.19 18:56:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Orneon
[2011.11.07 17:30:33 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Pegasys Inc
[2011.09.25 20:42:47 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\PlayFirst
[2012.06.20 15:48:32 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Rainbow
[2012.03.08 20:41:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Rovio
[2012.09.21 10:43:46 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SecretsOfTheTitanic
[2013.05.08 19:26:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Seven Sails
[2012.06.04 20:49:59 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\ShamanGS
[2013.05.17 19:49:55 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Silverback Games
[2011.08.21 15:16:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Sleepwalker Games
[2013.04.07 13:30:44 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Specialbit
[2011.09.15 20:18:11 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SpinTop Games
[2013.05.10 16:33:19 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\SulusGames
[2012.03.16 18:34:26 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Temp
[2014.03.31 21:23:48 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TheLastDays
[2012.06.21 21:36:21 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TheMissingMonaLisa
[2012.04.25 20:34:57 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\thriXXX
[2012.07.23 21:09:13 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TikisLab
[2013.05.31 14:51:46 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\TWODESPERADOS
[2013.05.13 09:16:53 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Vast Studios
[2014.03.28 14:23:27 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\VendelGAMES
[2012.05.26 20:53:29 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Vogat Interactive
[2011.08.11 19:42:23 | 000,000,000 | ---D | M] -- C:\Users\Michael\AppData\Roaming\Windows Live Writer

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2013.11.11 11:43:45 | 103,682,728 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\の楒’
[2013.11.11 09:42:11 | 103,682,728 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\の楒’

========== Alternate Data Streams ==========

@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:E690114B
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TempB2748F7
@Alternate Data Stream - 138 bytes -> C:\ProgramData\Temp:72C99D4E
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:BEACE4C8
@Alternate Data Stream - 131 bytes -> C:\ProgramData\Temp:2C86E2AD
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:B3C7433B
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:4C31986D
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:53F09A92
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:B38BEEEE
@Alternate Data Stream - 112 bytes -> C:\ProgramData\Temp:0441DB7A

< End of report >

Hallo Entericher und ,

hier ist nicht ganz der richtige Bereich und "OTL" ist schon ein wenig veraltet - bitte eröffne hier ein neues Thema:

http://www.trojaner-board.de/newthre...=newthread&f=8

((PS: Einen Hijacker habe ich schon beim Überfliegen gesehen - "snap.do"))

Liebe Grüße, Alois

Post © Alois 2015 – Alle Rechte vorbehalten – kein Teil darf in irgendeiner Form ohne schriftliche Genehmigung des Autors kritisiert werden!