Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   TR/ATRAPS.Gen2 und TR/ATRAPS.Gen (https://www.trojaner-board.de/121110-tr-atraps-gen2-tr-atraps-gen.html)

Regina14 02.08.2012 23:12
TR/ATRAPS.Gen2 und TR/ATRAPS.Gen
 
Hallo,

heute morgen hat mein Avira Free Antivirus das erste Mal W32/Patched.UA in C:\Windows\System32\services.exe gemeldet. Dieses Ding habe ich in die Quarantäne verschoben.

Seitdem meldet mir Avira alle 3-4 min, während ich im Internet bin: TR/ATRAPS.Gen2
Quelle: C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U\800000cb.@

und kurz danach:
TR/ATRAPS.Gen
Quelle: C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U\80000000.@

Freue mich, wenn jemand helfen kann!

lg,
Regina

PS: In Aviras Quarantäne steht noch ein Eintrag vom 29.07.2012, an dessen Meldung ich mich nicht erinnern kann, und zwar: TR/Vundo.Gen7
Quelle: C:\Program Files (x86)\VectorWorks 11\Plug-Ins\Roofer.dll

OTL.txt
Code:
OTL logfile created on: 02.08.2012 23:26:46 - Run 1
OTL by OldTimer - Version 3.2.55.0    Folder = C:\Users\Regina\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,68 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 53,09% Memory free
7,35 Gb Paging File | 5,54 Gb Available in Paging File | 75,34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 583,07 Gb Total Space | 111,37 Gb Free Space | 19,10% Space Free | Partition Type: NTFS
 
Computer Name: REGINA-PC | User Name: Regina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found --
PRC - [2012.08.02 23:24:15 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Regina\Downloads\OTL.exe
PRC - [2012.08.02 12:43:32 | 000,045,568 | ---- | M] (Sweetest Information Corporation) -- C:\Users\Regina\AppData\Local\Temp\8861153.exe
PRC - [2012.06.27 19:01:03 | 000,935,008 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012.06.27 19:01:02 | 001,107,552 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
PRC - [2012.06.13 17:37:04 | 001,088,904 | ---- | M] (Spigot, Inc.) -- C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2012.06.06 21:33:42 | 001,564,872 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2012.05.12 11:09:29 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.05.12 11:09:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.12 11:09:28 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.12 11:09:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.01.18 14:02:04 | 000,508,136 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
PRC - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe
PRC - [2010.09.30 14:00:28 | 000,139,088 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe
PRC - [2010.07.12 08:52:50 | 000,548,864 | ---- | M] () -- C:\Program Files (x86)\Greenshot\Greenshot.exe
PRC - [2010.04.17 07:56:48 | 000,305,520 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
PRC - [2010.03.09 01:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.04 05:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.03.03 15:21:16 | 001,300,560 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010.03.03 15:21:16 | 000,325,200 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.03.03 15:21:16 | 000,297,040 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.13 10:47:44 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.27 19:01:04 | 000,132,704 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012.06.27 19:01:02 | 001,107,552 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
MOD - [2012.06.18 23:28:06 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll
MOD - [2012.06.18 23:27:25 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012.06.18 23:27:13 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012.05.10 10:15:34 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\73baa23d28d21c7c01e334211330a84e\IAStorUtil.ni.dll
MOD - [2012.05.10 10:09:16 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012.05.10 10:08:36 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll
MOD - [2012.05.10 10:08:32 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012.05.10 10:08:29 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012.05.10 10:08:28 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012.05.10 10:08:22 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2010.09.30 14:00:28 | 000,139,088 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe
MOD - [2010.07.12 08:52:50 | 000,548,864 | ---- | M] () -- C:\Program Files (x86)\Greenshot\Greenshot.exe
MOD - [2010.07.12 08:52:48 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Greenshot\GreenshotPlugin.dll
MOD - [2010.06.12 05:56:26 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.06.12 05:56:23 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.01.13 10:47:44 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
MOD - [2009.05.20 08:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.09.27 16:42:04 | 004,180,576 | ---- | M] (SafeNet Inc.) [Auto | Running] -- C:\Windows\SysNative\hasplms.exe -- (hasplms)
SRV:64bit: - [2010.04.21 01:34:40 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.07.18 20:03:48 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.27 19:01:03 | 000,935,008 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe -- (vToolbarUpdater11.2.0)
SRV - [2012.05.12 11:09:29 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.05.12 11:09:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.12 11:09:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.07.13 22:11:59 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.11.08 17:09:29 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010.04.23 10:46:04 | 000,820,768 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.04.22 19:39:54 | 000,171,040 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Optical Drive Power Management\ODDPWRSvc.exe -- (ODDPwrSvc)
SRV - [2010.04.17 07:56:48 | 000,305,520 | ---- | M] (Egis Technology Inc.) [Auto | Running] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.03.26 11:46:48 | 000,920,352 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.09 01:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.03.03 15:21:16 | 000,325,200 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.12 11:09:29 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.12 11:09:29 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.15 12:23:22 | 000,358,480 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ta2avs.sys -- (ta2avs)
DRV:64bit: - [2010.12.15 12:23:22 | 000,075,856 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ta2usb.sys -- (ta2usb_svc)
DRV:64bit: - [2010.09.27 16:42:10 | 000,131,072 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksfridge.sys -- (aksfridge)
DRV:64bit: - [2010.09.27 16:42:06 | 000,075,648 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf)
DRV:64bit: - [2010.09.27 16:42:04 | 000,053,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\akshasp.sys -- (akshasp)
DRV:64bit: - [2010.09.27 16:42:02 | 000,318,464 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (Hardlock)
DRV:64bit: - [2010.09.27 16:42:00 | 000,025,344 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\aksusb.sys -- (aksusb)
DRV:64bit: - [2010.09.27 16:41:58 | 000,056,960 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\akshhl.sys -- (akshhl)
DRV:64bit: - [2010.04.21 03:15:04 | 006,406,144 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.04.21 00:39:36 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.04.21 00:08:04 | 010,322,848 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdpmd64.sys -- (intelkmd)
DRV:64bit: - [2010.04.07 22:12:02 | 000,124,944 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.04.01 10:18:30 | 003,060,800 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2010.03.17 16:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.03.05 12:04:08 | 000,335,400 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.03.01 17:37:40 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.02.14 22:05:12 | 000,102,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.01.13 17:41:12 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.01.13 17:41:06 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2009.12.22 03:18:48 | 000,074,280 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009.10.29 19:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009.10.26 06:39:44 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.09.28 09:55:42 | 000,051,760 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\OXSDIDRV_x64.sys -- (OXSDIDRV_x64)
DRV:64bit: - [2009.09.17 14:12:06 | 000,292,912 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.09.17 12:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.26 15:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009.05.05 10:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.05 10:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2009.04.29 16:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.11.05 11:08:06 | 000,670,208 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\hardlock.sys -- (Hardlock)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={F118EE41-0E6B-4AD4-A128-C9721C543BF4}&mid=c1111d06f68847d0a3861943ef67903b-406d00295e6c021b0ac631abf69d7746503e64b8&lang=de&ds=od011&pr=sa&d=2012-06-27 19:01:04&v=11.1.0.12&sap=hp
IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE383DE383
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={F118EE41-0E6B-4AD4-A128-C9721C543BF4}&mid=c1111d06f68847d0a3861943ef67903b-406d00295e6c021b0ac631abf69d7746503e64b8&lang=de&ds=od011&pr=sa&d=2012-06-27 19:01:04&v=11.1.0.12&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{E1CCAF70-21BD-4CB8-B683-98CA1166A051}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.8
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7B7c74c064-44b8-4774-ab4b-bb3e93c462ba%7D&mid=c1111d06f68847d0a3861943ef67903b-406d00295e6c021b0ac631abf69d7746503e64b8&ds=od011&v=11.1.0.12&lang=de&pr=sa&d=2012-06-27%2019%3A01%3A04&sap=ku&q="
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\11.1.0.12\ [2012.06.27 19:01:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 20:03:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.14 22:38:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.25 09:26:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.12.05 21:58:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 20:03:48 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.14 22:38:43 | 000,000,000 | ---D | M]
 
[2010.06.21 19:56:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Regina\AppData\Roaming\mozilla\Extensions
[2010.06.21 19:56:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Regina\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.08.02 23:17:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Regina\AppData\Roaming\mozilla\Firefox\Profiles\p1y5cce8.default\extensions
[2012.07.26 11:00:46 | 000,000,000 | ---D | M] (Foxit Toolbar) -- C:\Users\Regina\AppData\Roaming\mozilla\Firefox\Profiles\p1y5cce8.default\extensions\toolbar@ask.com
[2012.04.29 12:39:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.01.08 18:20:46 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012.07.05 07:30:19 | 000,340,684 | ---- | M] () (No name found) -- C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
[2012.07.18 20:03:48 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.04.14 22:38:12 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.12 21:10:33 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012.04.02 22:14:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.27 19:01:02 | 000,003,750 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.04.02 22:14:31 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.04.02 22:14:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.02 22:14:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.02 22:14:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.02 22:14:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [ODDPwr] C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\SysWOW64\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UIExec] C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe ()
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [DAT3709.tmp.exe] C:\Users\Regina\AppData\Local\Temp\DAT3709.tmp.exe (Sweetest Information Corporation)
O4 - HKCU..\Run: [Greenshot] C:\Program Files (x86)\Greenshot\Greenshot.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F3665061-F5E3-4DE3-8538-A9B2F0B01307}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\Shell - "" = AutoRun
O33 - MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\Shell\AutoRun\command - "" = Iomega Encryption Utility.exe
O33 - MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\Shell - "" = AutoRun
O33 - MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\Shell\AutoRun\command - "" = D:\SetupSeriesA.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.02 12:46:39 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.07.12 08:38:10 | 000,000,000 | ---D | C] -- C:\Users\Regina\AppData\Roaming\pdfforge
[2012.07.12 08:38:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.07.12 08:38:06 | 000,095,744 | ---- | C] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
[2012.07.06 13:46:18 | 000,000,000 | ---D | C] -- C:\UserData
[2012.07.06 13:41:29 | 000,119,680 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys
[2012.07.06 13:41:29 | 000,119,680 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys
[2012.07.06 13:41:29 | 000,119,680 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys
[2012.07.06 13:41:29 | 000,011,776 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\massfilter.sys
[2012.07.06 13:40:59 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\SupportAppCB
[2012.07.06 13:40:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1&1 Surf-Stick
[2012.07.06 13:40:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\1&1 Surf-Stick
[2012.07.05 15:38:53 | 000,000,000 | ---D | C] -- C:\Users\Regina\AppData\Roaming\elsterformular
[2012.07.05 15:38:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
[2012.07.05 15:38:30 | 000,000,000 | ---D | C] -- C:\ProgramData\elsterformular
[2012.07.05 15:38:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular
[2010.08.07 01:15:40 | 000,061,440 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Regina\_0AA6EBFE1D884E4E80D3DF6A7757540D
 
========== Files - Modified Within 30 Days ==========
 
File not found -- C:\Windows\SysNative\
[2012.08.02 23:23:25 | 000,000,000 | ---- | M] () -- C:\Users\Regina\defogger_reenable
[2012.08.02 23:10:39 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.02 23:09:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.02 16:55:17 | 001,512,418 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.02 16:55:17 | 000,659,238 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.02 16:55:17 | 000,620,384 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.02 16:55:17 | 000,132,776 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.02 16:55:17 | 000,108,566 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.02 16:40:09 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.02 16:39:12 | 005,105,423 | ---- | M] () -- C:\Users\Regina\Desktop\120802_Aussenbereich.vwx
[2012.08.02 10:23:41 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 10:23:41 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.02 10:15:58 | 2962,243,584 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.29 14:55:08 | 000,160,989 | ---- | M] () -- C:\Users\Regina\Desktop\Variante 1,20m.pdf
[2012.07.29 14:18:10 | 000,159,056 | ---- | M] () -- C:\Users\Regina\Desktop\Variante 1.pdf
[2012.07.28 23:46:56 | 000,020,483 | ---- | M] () -- C:\Users\Regina\Desktop\img-patti-smith-1_133132350240.jpg_med_thumb.jpg
[2012.07.28 23:40:31 | 000,315,656 | ---- | M] () -- C:\Users\Regina\Desktop\superstudio6_905.jpg
[2012.07.28 23:37:04 | 000,427,283 | ---- | M] () -- C:\Users\Regina\Desktop\Auroville_master_plan_1_905.jpg
[2012.07.28 23:36:18 | 000,226,308 | ---- | M] () -- C:\Users\Regina\Desktop\02-keith-kawaii-Sundrips_905.jpg
[2012.07.28 23:35:44 | 000,146,850 | ---- | M] () -- C:\Users\Regina\Desktop\Anuszkiewicz4.jpg
[2012.07.20 15:32:57 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2012.07.12 08:46:51 | 002,296,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.05 13:02:30 | 000,095,744 | ---- | M] (pdfforge GbR) -- C:\Windows\SysNative\pdfcmon.dll
 
========== Files Created - No Company Name ==========
 
File not found -- C:\Windows\SysNative\
[2012.08.02 23:33:24 | 000,023,552 | ---- | C] () -- C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U\800000cb.@
[2012.08.02 23:33:24 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U\80000000.@
[2012.08.02 23:23:25 | 000,000,000 | ---- | C] () -- C:\Users\Regina\defogger_reenable
[2012.08.02 17:01:13 | 005,105,423 | ---- | C] () -- C:\Users\Regina\Desktop\120802_Aussenbereich.vwx
[2012.08.02 12:43:56 | 000,001,712 | ---- | C] () -- C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U\00000001.@
[2012.07.29 14:54:13 | 000,160,989 | ---- | C] () -- C:\Users\Regina\Desktop\Variante 1,20m.pdf
[2012.07.29 14:08:12 | 000,159,056 | ---- | C] () -- C:\Users\Regina\Desktop\Variante 1.pdf
[2012.07.28 23:46:55 | 000,020,483 | ---- | C] () -- C:\Users\Regina\Desktop\img-patti-smith-1_133132350240.jpg_med_thumb.jpg
[2012.07.28 23:40:31 | 000,315,656 | ---- | C] () -- C:\Users\Regina\Desktop\superstudio6_905.jpg
[2012.07.28 23:37:04 | 000,427,283 | ---- | C] () -- C:\Users\Regina\Desktop\Auroville_master_plan_1_905.jpg
[2012.07.28 23:36:17 | 000,226,308 | ---- | C] () -- C:\Users\Regina\Desktop\02-keith-kawaii-Sundrips_905.jpg
[2012.07.28 23:35:40 | 000,146,850 | ---- | C] () -- C:\Users\Regina\Desktop\Anuszkiewicz4.jpg
[2012.07.06 13:46:18 | 000,000,557 | ---- | C] () -- C:\NetworkCfg.xml
[2012.06.12 19:54:19 | 000,010,569 | ---- | C] () -- C:\Windows\CSTBox.INI
[2012.05.15 14:13:44 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.05.15 14:13:44 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2140.DAT
[2012.01.11 17:41:33 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@
[2012.01.11 17:41:33 | 000,002,048 | -HS- | C] () -- C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@
[2011.08.18 11:39:57 | 000,000,809 | ---- | C] () -- C:\Windows\NTIWVEDT.INI
[2011.07.13 22:16:44 | 002,463,976 | ---- | C] () -- C:\Windows\SysWow64\NPSWF32.dll
[2011.04.06 20:52:12 | 000,000,000 | ---- | C] () -- C:\Users\Regina\.gtk-bookmarks
[2011.04.06 20:46:48 | 000,678,241 | ---- | C] () -- C:\Users\Regina\.fonts.cache-1
[2011.04.05 21:46:01 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\UNWISE.EXE
[2011.04.05 21:46:01 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\hdsuinst.exe
[2011.04.05 21:46:01 | 000,006,836 | ---- | C] () -- C:\Windows\SysWow64\UNWISE.INI
[2010.11.08 17:09:31 | 000,000,000 | ---- | C] () -- C:\Windows\eDrawingOfficeAutomator.INI
[2010.08.08 12:30:51 | 000,016,384 | ---- | C] () -- C:\Windows\SysWow64\FileOps.exe
[2010.06.28 20:41:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.13 12:56:05 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2012.06.12 19:45:54 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Canon
[2012.05.27 09:15:09 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\CD-LabelPrint
[2010.11.08 17:10:03 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\EDrawings
[2012.07.05 15:38:57 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\elsterformular
[2012.07.29 17:34:51 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\foobar2000
[2010.09.12 21:11:33 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Foxit Software
[2011.12.07 18:19:50 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Greenshot
[2011.04.11 19:33:38 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Nemetschek
[2011.12.05 22:46:18 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\net.nemetschek.vectorworks.2012.help.eng.CC16605A57FA88F0CED2B1A19E704F482AB2B1EB.1
[2012.06.27 18:59:44 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\OpenCandy
[2010.09.14 21:12:52 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\OpenOffice.org
[2010.08.07 01:18:09 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\PACE Anti-Piracy
[2012.07.12 08:38:10 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\pdfforge
[2010.06.12 19:37:13 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\PowerCinema
[2011.11.08 18:07:44 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\SimpleScreenshot
[2011.12.13 18:21:48 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Sync App Settings
[2010.06.21 19:56:04 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Thunderbird
[2012.05.04 09:00:29 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
Extras.txt
Code:
OTL Extras logfile created on: 02.08.2012 23:26:46 - Run 1
OTL by OldTimer - Version 3.2.55.0    Folder = C:\Users\Regina\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,68 Gb Total Physical Memory | 1,95 Gb Available Physical Memory | 53,09% Memory free
7,35 Gb Paging File | 5,54 Gb Available in Paging File | 75,34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 583,07 Gb Total Space | 111,37 Gb Free Space | 19,10% Space Free | Partition Type: NTFS
 
Computer Name: REGINA-PC | User Name: Regina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_Pro9500_II_series" = Canon Pro9500 II series Printer Driver
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4803" = CanoScan 4400F
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4804" = CanoScan 8600F
"{1F557316-CFC0-41BD-AFF7-8BC49CE444D7}" = Shredder
"{3054FEFA-4748-4cf0-8C3C-8DB887DE379F}" = Native Instruments Traktor Audio 2
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3B582B41-5FFC-4AB8-B006-A087BDE74494}" = Iomega Encryption
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9822326F-410C-96A5-2F58-65E58F65D63B}" = ccc-utility64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5816A09-786E-C91D-3D99-8A8C92648750}" = ATI Catalyst Install Manager
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CCleaner" = CCleaner
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{04FCD5DE-1662-4F99-BDA9-C57212113EF2}" = RemoteComms External Disk Access
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0B148875-7C4D-A5A7-79FA-82D679939663}" = CCC Help Danish
"{0D49143F-5710-6EAF-986F-86306C54D9F7}" = CCC Help Dutch
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{0DCE424F-F4A8-A3EA-3416-7A4CA189A164}" = CCC Help Czech
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13702021-43FB-480C-912F-D9B74A538288}" = OpenProj
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{193B70F8-D757-B1D6-B2B0-826E92D889CC}" = CCC Help Polish
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23640476-5D3A-F071-A40F-345E16C91301}" = CCC Help Hungarian
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{37918F52-75C8-47F8-AEFB-389B8E62B5DA}" = pdfforge Toolbar v5.9
"{39BE50E7-8059-C383-D8D0-3EC7B9A0B2C2}" = CCC Help Turkish
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer PowerSmart Manager
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{3F07D7AF-4E33-95E3-DDD6-360C6CCAF34F}" = Vectorworks 2012 Help
"{411E0CC3-587A-468C-B461-95FAFD05E4DE}" = Adobe InDesign CS3
"{416DFEDD-9F1B-4EFC-AF70-FCA891AE0251}" = Adobe InDesign CS
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4393DE35-AD67-4F37-95E4-30F06EA0FDB2}" = Adobe Creative Suite 3 Design Premium
"{4394B319-1CA6-9535-5A97-3407DE7B2865}" = CCC Help Chinese Traditional
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4968622A-4D3F-489E-9ACE-5FEC4CC0BDE3}" = MediaShow Espresso
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E242AB2-86A7-4231-82A9-1E4226D23CA8}" = Catalyst Control Center - Branding
"{4E2AC91C-090D-C0BE-98E0-35480A693D53}" = CCC Help Russian
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{5518E08A-2053-4A3E-85B2-F912D4666C9F}" = Adobe Setup
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{59A58CB1-5177-4AF7-DC09-886DC5175561}" = CCC Help Thai
"{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{61D199C4-5E32-4616-BA4E-1EB52CA6DA2B}" = SolidWorks eDrawings 2011
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6B70AFEB-18E9-0BBA-C876-50E61D2F1585}" = CCC Help Korean
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{7BBEA5FB-5BDA-5568-F370-66934F5862F8}" = Catalyst Control Center Graphics Light
"{7C3E29B2-038E-312D-938C-DED2C6451411}" = CCC Help German
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{800E5862-A2A2-B903-6B6E-660F5DFB1BFF}" = CCC Help Norwegian
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{804D666C-1FB8-F116-358B-15F297113547}" = CCC Help English
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Foxit Toolbar
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90497F91-64AA-6732-266E-4B7023989E5C}" = ccc-core-static
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A990CB5E-6951-12C0-6B29-4C0102E80827}" = CCC Help Portuguese
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = 1&1 Surf-Stick
"{AAB17558-7189-1415-2370-D689FDD44B33}" = PX Profile Update
"{ABC74AD3-8488-2D59-71CA-FE1FDBD99293}" = CCC Help Greek
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0 Professional
"{AE09C972-EEB2-4DA5-8090-0FCF54576854}" = Optical Drive Power Management
"{B399B936-CDED-C8E5-D621-E6323855CF5B}" = Catalyst Control Center Graphics Full New
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B906C11A-D193-4143-9FA7-E2EE8A5A8F21}" = Acer Arcade Movie
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{BE985F96-BFD5-BCE2-97F6-B73BBF122943}" = CCC Help Japanese
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C314EA94-9FAF-969D-544F-816FE102EAFD}" = Catalyst Control Center InstallProxy
"{C40DCE3C-E042-2DEE-4F77-8725E18BAE17}" = CCC Help Spanish
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1F8C3EA-8274-90C1-460B-EE2DFA7B492B}" = CCC Help French
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}" = Adobe Photoshop CS3
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E573FE55-5A89-F7CC-0A00-A9E79BB20C3B}" = CCC Help Finnish
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E75093FD-D74A-D7D0-AE15-BA89B30D9E54}" = Catalyst Control Center Localization All
"{E92EAA89-9597-E7DF-6EB6-F21655D245F2}" = Catalyst Control Center Graphics Previews Vista
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EEEDE742-915B-2D3F-5763-E7375BE7B144}" = CCC Help Chinese Standard
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F9B82B36-5FC0-1E0D-0D56-066D1EDAC9E8}" = Catalyst Control Center Graphics Full Existing
"{FC3CCF4F-ABE4-1CF6-347B-DEAFC9D82F1C}" = Catalyst Control Center Core Implementation
"{FC4AAE94-A221-0725-4FD8-56262B0262BA}" = CCC Help Italian
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"{FFAC99FD-DDF8-E138-E8F4-538B639C6984}" = CCC Help Swedish
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Adobe_061850775b1c6d22bf2a145678e05e0" = Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen
"Allway Sync_is1" = Allway Sync version 9.2.11
"AVG Secure Search" = AVG Security Toolbar
"Avira AntiVir Desktop" = Avira Free Antivirus
"Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9000 series Extention Data
"Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data" = Canon Easy-PhotoPrint Pro - Pro9500 series Extention Data
"Canon Pro9500 Mark II series Benutzerregistrierung" = Canon Pro9500 Mark II series Benutzerregistrierung
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CanoScan Toolbox 5.0" = Canon CanoScan Toolbox 5.0
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Easy-PhotoPrint Pro" = Canon Utilities Easy-PhotoPrint Pro
"ElsterFormular 13.2.0.8623u" = ElsterFormular
"foobar2000" = foobar2000 v1.1.10
"Foxit Reader" = Foxit Reader
"Google Chrome" = Google Chrome
"Greenshot_is1" = Greenshot
"HASP HL Device Driver" = HASP HL Device Driver
"HASP License Manager" = HASP License Manager
"Identity Card" = Identity Card
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Acer Backup Manager
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"LManager" = Launch Manager
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Native Instruments Traktor Audio 2" = Native Instruments Traktor Audio 2
"Nero - Burning Rom!UninstallKey" = Nero 6 Demo (32-bit)
"net.nemetschek.vectorworks.2012.help.eng.CC16605A57FA88F0CED2B1A19E704F482AB2B1EB.1" = Vectorworks 2012 Help
"Soulseek2" = SoulSeek 157 NS 13e
"ST5UNST #1" = Kaminfeuer Titanium Edition II
"StandardTime" = Standard Time
"VectorWorks 11" = VectorWorks 11
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Foxit Toolbar Updater
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 06.07.2012 07:42:12 | Computer Name = Regina-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\1&1 Surf-Stick\Component\BKATProtocol.dll".  Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 09.07.2012 05:09:08 | Computer Name = Regina-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 13.0.1.4548,
 Zeitstempel: 0x4fda5ff0  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x2e8  Startzeit der fehlerhaften Anwendung: 0x01cd5db27ba62a87  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 bcc86419-c9a5-11e1-a2b7-c80aa98379c8
 
Error - 12.07.2012 02:29:46 | Computer Name = Regina-PC | Source = Application Hang | ID = 1002
Description = Programm PDFCreator.exe, Version 1.4.0.1 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: d20    Startzeit:
01cd5ff7a18bc5b3    Endzeit: 24    Anwendungspfad: C:\Program Files (x86)\PDFCreator\PDFCreator.exe

Berichts-ID:
 ec46da2e-cbea-11e1-b4c1-c80aa98379c8 
 
Error - 12.07.2012 02:32:43 | Computer Name = Regina-PC | Source = Application Hang | ID = 1002
Description = Programm PDFCreator.exe, Version 1.4.0.1 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 112c    Startzeit:
 01cd5ff80192a136    Endzeit: 31    Anwendungspfad: C:\Program Files (x86)\PDFCreator\PDFCreator.exe

Berichts-ID:
 5f1154b2-cbeb-11e1-b4c1-c80aa98379c8 
 
Error - 13.07.2012 04:31:15 | Computer Name = Regina-PC | Source = Application Hang | ID = 1002
Description = Programm STTime.scr, Version 0.0.0.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: c6c    Startzeit:
01cd60d0bf2d6136    Endzeit: 23    Anwendungspfad: C:\PROGRA~2\STANDA~1\STANDA~1\STTime.scr

Berichts-ID:
 100b6abc-ccc5-11e1-9994-c80aa98379c8 
 
Error - 13.07.2012 09:26:15 | Computer Name = Regina-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 13.0.1.4548,
 Zeitstempel: 0x4fda5ff0  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x578  Startzeit der fehlerhaften Anwendung: 0x01cd60fb110ccd1a  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 5200889c-ccee-11e1-9994-c80aa98379c8
 
Error - 18.07.2012 06:52:10 | Computer Name = Regina-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 13.0.1.4548,
 Zeitstempel: 0x4fda5ff0  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x2a4  Startzeit der fehlerhaften Anwendung: 0x01cd64d35f1886f6  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 9f40a140-d0c6-11e1-905f-c80aa98379c8
 
Error - 19.07.2012 05:05:10 | Computer Name = Regina-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b69d  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0x1248  Startzeit der fehlerhaften Anwendung: 0x01cd658d97772d16  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 d738307b-d180-11e1-b0ac-c80aa98379c8
 
Error - 19.07.2012 05:13:23 | Computer Name = Regina-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: plugin-container.exe, Version: 14.0.1.4577,
 Zeitstempel: 0x5000b69d  Name des fehlerhaften Moduls: FOXITR~1.OCX, Version: 1.0.1.224,
 Zeitstempel: 0x4b849404  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00002dce  ID des fehlerhaften
 Prozesses: 0xd8c  Startzeit der fehlerhaften Anwendung: 0x01cd658ebe21c9e0  Pfad der
 fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
Pfad
 des fehlerhaften Moduls: C:\PROGRA~2\FOXITS~1\FOXITR~1\plugins\FOXITR~1.OCX  Berichtskennung:
 fd343b37-d181-11e1-b0ac-c80aa98379c8
 
Error - 19.07.2012 05:42:55 | Computer Name = Regina-PC | Source = Application Hang | ID = 1002
Description = Programm STTime.scr, Version 0.0.0.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1394    Startzeit:
 01cd6592cf73fe66    Endzeit: 18    Anwendungspfad: C:\PROGRA~2\STANDA~1\STANDA~1\STTime.scr

Berichts-ID:
 124b26fe-d186-11e1-b0ac-c80aa98379c8 
 
[ System Events ]
Error - 28.07.2012 13:00:23 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  TPkd
 
Error - 29.07.2012 04:27:17 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  TPkd
 
Error - 29.07.2012 12:41:35 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Avira Planer erreicht.
 
Error - 29.07.2012 12:41:35 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Avira Planer" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1053
 
Error - 29.07.2012 12:42:27 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  TPkd
 
Error - 29.07.2012 17:16:07 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom  TPkd
 
Error - 30.07.2012 16:33:07 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom  TPkd
 
Error - 31.07.2012 17:29:47 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom  TPkd
 
Error - 01.08.2012 02:30:21 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom  TPkd
 
Error - 02.08.2012 04:16:33 | Computer Name = Regina-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom  TPkd
 
 
< End of report >

cosinus 05.08.2012 12:26
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

Regina14 07.08.2012 17:19
Hallo Arne,

veieln Dank für deine Hilfe! Leider hat das Scannen tatsächlich zwei Tage gedauert. Anbei die Ergebnisse:

Code:
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.06.05

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Regina :: REGINA-PC [Administrator]

06.08.2012 11:01:46
mbam-log-2012-08-06 (11-01-46).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 787289
Laufzeit: 10 Stunde(n), 1 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\Users\Regina\AppData\Local\Temp\DAT3709.tmp.exe (Trojan.FakeAlert) -> 3020 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DAT3709.tmp.exe (Trojan.FakeAlert) -> Daten: C:\Users\Regina\AppData\Local\Temp\DAT3709.tmp.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Regina\AppData\Local\Temp\2F88.tmp (Exploit.Drop.GS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Regina\AppData\Local\Temp\DAT3709.tmp.exe (Trojan.FakeAlert) -> Löschen bei Neustart.

(Ende)
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-07 10:16:37
# local_time=2012-08-07 12:16:37 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=1792 16777215 100 0 21094661 21094661 0 0
# compatibility_mode=5893 16776574 66 94 382935 95917016 0 0
# compatibility_mode=8192 67108863 100 0 192 192 0 0
# scanned=598117
# found=5
# cleaned=0
# scan_time=47431
C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe        a variant of Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\fc5e071-140a22e2        a variant of Java/Exploit.CVE-2012-1723.AB trojan (unable to clean)        00000000000000000000000000000000        I
C:\Windows\Installer\56756.msi        a variant of Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I
C:\Windows\Temp\pdfforgeToolbar.exe        Win32/Toolbar.Widgi application (unable to clean)        00000000000000000000000000000000        I
${Memory}        a variant of Win32/Toolbar.Widgi application        00000000000000000000000000000000        I
Ich hoffe man kann die Dinge noch entfernen ohne den Rechner komplett neu aufzusetzten?

Danke+Grüße
Regina

cosinus 08.08.2012 18:36
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Regina14 08.08.2012 21:54
Hallo Arne,

das ging jetzt fix, anbei das Ergebnis:

Code:
# AdwCleaner v1.800 - Logfile created 08/08/2012 at 22:52:02
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium  (64 bits)
# User : Regina - REGINA-PC
# Running from : C:\Users\Regina\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****

Found : vToolbarUpdater11.2.0

***** [Files / Folders] *****

Folder Found : C:\Users\Regina\AppData\Local\AskToolbar
Folder Found : C:\Users\Regina\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Regina\AppData\Local\Temp\AskSearch
Folder Found : C:\Users\Regina\AppData\Local\Temp\avg@toolbar
Folder Found : C:\Users\Regina\AppData\Local\Temp\boost_interprocess
Folder Found : C:\Users\Regina\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Regina\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Regina\AppData\LocalLow\pdfforge
Folder Found : C:\Users\Regina\AppData\LocalLow\Search Settings
Folder Found : C:\Users\Regina\AppData\Roaming\OpenCandy
Folder Found : C:\Users\Regina\AppData\Roaming\pdfforge
Folder Found : C:\Users\Regina\AppData\Roaming\Mozilla\Firefox\Profiles\p1y5cce8.default\extensions\toolbar@ask.com
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\ProgramData\boost_interprocess
Folder Found : C:\Program Files (x86)\Ask.com
Folder Found : C:\Program Files (x86)\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\spigot
Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [Registry] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\AskToolbarInfo
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AskToolbar
Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\pdfforge
Key Found : HKCU\Software\Search Settings
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\APN
Key Found : HKLM\SOFTWARE\AskToolbar
Key Found : HKLM\SOFTWARE\AVG Secure Search
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Found : HKLM\SOFTWARE\Classes\S
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Found : HKLM\SOFTWARE\pdfforge
Key Found : HKLM\SOFTWARE\Search Settings
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
[x64] Key Found : HKCU\Software\APN
[x64] Key Found : HKCU\Software\AppDataLow\AskToolbarInfo
[x64] Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
[x64] Key Found : HKCU\Software\Ask.com
[x64] Key Found : HKCU\Software\AskToolbar
[x64] Key Found : HKCU\Software\AVG Secure Search
[x64] Key Found : HKCU\Software\IGearSettings
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
[x64] Key Found : HKCU\Software\pdfforge
[x64] Key Found : HKCU\Software\Search Settings
[x64] Key Found : HKCU\Software\Softonic
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
[x64] Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
[x64] Key Found : HKLM\SOFTWARE\Classes\S
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[x64] Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
[x64] Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{B922D405-6D13-4A2B-AE89-08A030DA4402}]
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
[x64] Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{B922D405-6D13-4A2B-AE89-08A030DA4402}]

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.avg.com/?cid={F118EE41-0E6B-4AD4-A128-C9721C543BF4}&mid=c1111d06f68847d0a3861943ef67903b-406d00295e6c021b0ac631abf69d7746503e64b8&lang=de&ds=od011&pr=sa&d=2012-06-27 19:01:04&v=11.1.0.12&sap=hp
[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={F118EE41-0E6B-4AD4-A128-C9721C543BF4}&mid=c1111d06f68847d0a3861943ef67903b-406d00295e6c021b0ac631abf69d7746503e64b8&lang=de&ds=od011&pr=sa&d=2012-06-27 19:01:04&v=11.1.0.12&sap=nt

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Regina\AppData\Roaming\Mozilla\Firefox\Profiles\p1y5cce8.default\prefs.js

Found : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\11.1.0.12");
Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Found : user_pref("extensions.asktb.cbid", "F4");
Found : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}[...]
Found : user_pref("extensions.asktb.dtid", "YYYYYYYYDE");
Found : user_pref("extensions.asktb.l", "dis");
Found : user_pref("extensions.asktb.last-config-req", "1284318713458");
Found : user_pref("extensions.asktb.locale", "en_US");
Found : user_pref("extensions.asktb.o", "101699");
Found : user_pref("extensions.asktb.qsrc", "2871");
Found : user_pref("keyword.URL", "hxxp://isearch.avg.com/search?cid=%7B7c74c064-44b8-4774-ab4b-bb3e93c462ba%[...]

-\\ Google Chrome v21.0.1180.60

File : C:\Users\Regina\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found : {"backup":{"_version":1,"homepage":true,"homepage_is_newtabpage":false,"session":{"restore_on_startu[...]

*************************

AdwCleaner[R1].txt - [16095 octets] - [08/08/2012 22:52:02]

########## EOF - C:\AdwCleaner[R1].txt - [16224 octets] ##########
Grüße
Regina

cosinus 09.08.2012 15:49
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Regina14 09.08.2012 19:39
Hallo Arne,

hier das Ergebnis:

Code:
# AdwCleaner v1.800 - Logfile created 08/09/2012 at 20:31:35
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium  (64 bits)
# User : Regina - REGINA-PC
# Running from : C:\Users\Regina\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****

Stopped & Deleted : vToolbarUpdater11.2.0

***** [Files / Folders] *****

Folder Deleted : C:\Users\Regina\AppData\Local\AskToolbar
Folder Deleted : C:\Users\Regina\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Regina\AppData\Local\Temp\AskSearch
Folder Deleted : C:\Users\Regina\AppData\Local\Temp\avg@toolbar
Folder Deleted : C:\Users\Regina\AppData\Local\Temp\boost_interprocess
Folder Deleted : C:\Users\Regina\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Regina\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Regina\AppData\LocalLow\pdfforge
Folder Deleted : C:\Users\Regina\AppData\LocalLow\Search Settings
Folder Deleted : C:\Users\Regina\AppData\Roaming\OpenCandy
Folder Deleted : C:\Users\Regina\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Regina\AppData\Roaming\Mozilla\Firefox\Profiles\p1y5cce8.default\extensions\toolbar@ask.com
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Common Files\spigot
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [Registry] *****

Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\AskToolbarInfo
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\AskToolbar
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\pdfforge
Key Deleted : HKCU\Software\Search Settings
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\APN
Key Deleted : HKLM\SOFTWARE\AskToolbar
Key Deleted : HKLM\SOFTWARE\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\pdfforge
Key Deleted : HKLM\SOFTWARE\Search Settings
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchSettings]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{B922D405-6D13-4A2B-AE89-08A030DA4402}]
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16385

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.avg.com/?cid={F118EE41-0E6B-4AD4-A128-C9721C543BF4}&mid=c1111d06f68847d0a3861943ef67903b-406d00295e6c021b0ac631abf69d7746503e64b8&lang=de&ds=od011&pr=sa&d=2012-06-27 19:01:04&v=11.1.0.12&sap=hp --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={F118EE41-0E6B-4AD4-A128-C9721C543BF4}&mid=c1111d06f68847d0a3861943ef67903b-406d00295e6c021b0ac631abf69d7746503e64b8&lang=de&ds=od011&pr=sa&d=2012-06-27 19:01:04&v=11.1.0.12&sap=nt --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Regina\AppData\Roaming\Mozilla\Firefox\Profiles\p1y5cce8.default\prefs.js

Deleted : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\11.1.0.12");
Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Deleted : user_pref("extensions.asktb.cbid", "F4");
Deleted : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}[...]
Deleted : user_pref("extensions.asktb.dtid", "YYYYYYYYDE");
Deleted : user_pref("extensions.asktb.l", "dis");
Deleted : user_pref("extensions.asktb.last-config-req", "1284318713458");
Deleted : user_pref("extensions.asktb.locale", "en_US");
Deleted : user_pref("extensions.asktb.o", "101699");
Deleted : user_pref("extensions.asktb.qsrc", "2871");
Deleted : user_pref("keyword.URL", "hxxp://isearch.avg.com/search?cid=%7B7c74c064-44b8-4774-ab4b-bb3e93c462ba%[...]

-\\ Google Chrome v21.0.1180.75

File : C:\Users\Regina\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted : {"backup":{"_version":1,"homepage":true,"homepage_is_newtabpage":false,"session":{"restore_on_startu[...]

*************************

AdwCleaner[R1].txt - [16106 octets] - [08/08/2012 22:52:02]
AdwCleaner[S1].txt - [11993 octets] - [09/08/2012 20:31:35]

########## EOF - C:\AdwCleaner[S1].txt - [12122 octets] ##########
Grüße
Regina

cosinus 10.08.2012 21:15
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Regina14 11.08.2012 14:28
Hallo Arne,

also, der Computer/Windows läuft wieder genauso wie früher. Ich habe weder Probleme noch meldet der Antivir irgendwas, optisch ist auch alles wie vorher.

Im Startmenü fehlen keine Programme und unter "Alle Programme" sind keine leeren Ordner.

Wie gehts denn jetzt weiter oder wars das schon? ;-)
Ich mache seit der Meldung kein Online-Banking etc. mit dem Computer. Darf ich das schon wieder machen?

Vielen Dank!
Grüße
Regina

cosinus 11.08.2012 18:38
Hm, du machst OnlineBanking normalerweise?
Das ist immer so Sache, gerade auf bereinigten Systemen.
Willst du wirklich bereinigen oder lieber neu aufsetzen?
Alternativ kann man OnlineBanking auch über ein parallel installiertes Linux oder sowas wie Sicheres Online-Banking mit Bankix | c't machen

Regina14 14.08.2012 08:59
Hallo Arne,

ich muss an meinem Computer jeden Tag arbeiten (bin selbstständig) und möchte wenn es irgendwie möglich ist lieber bereinigen als alles neu aufzusetzten, da das bestimmt zwei Tage dauert. Meinst Du das macht Sinn und wie lange brauchen wir dafür noch?
Ich würde jetzt erstmal weiter Online Banking auf einem anderen Rechner machen und dann dieses Bankix verwenden , wenn Du meinst dass man das auf einem bereinigten Rechner nicht machen sollte. Warum ist das eigentlich so?
Danke!!!

Grüße
Regina

cosinus 14.08.2012 15:52
Zitat:
wenn Du meinst dass man das auf einem bereinigten Rechner nicht machen sollte. Warum ist das eigentlich so?
Versteht sich das nicht von selbst, dass man bei kritischen Dingen lieber keine Kompromisse eingeht?! :confused:
Wenn es dir nicht zu umständlich ist mit Bankix zu arbeiten und du auch sonst das Risiko eingehen willst, ja dann kann man bereinigen. Du kannst auch gern auf eigenes Risiko unter dem bereinigten Windows OnlineBanking machen :pfeiff:


Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Regina14 16.08.2012 10:09
Hallo Arne,

hab ich verstanden, ich mach gar nix riskantes mehr mit dem Rechner.

Avira hat wieder neue Sachen gefunden:


Code:
Beginne mit der Suche in 'C:\' <Acer>
C:\00 Daten\02 Programme\Winamp\winamp3.00c_de.exe
  [WARNUNG]  Die Version dieses Archives wird nicht unterstützt
C:\Program Files (x86)\SoulseekNS\uninstall.exe
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Regina\AppData\Local\Temp\jar_cache1059954291097618488.tmp
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\fc5e071-140a22e2
  [0] Archivtyp: ZIP
  --> O1.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lamar.FH
  --> O2.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-1723.CT
  --> O3.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-1723.CU
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U\00000001.@
  [FUND]      Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/ZAccess.W
C:\Windows\SoftwareDistribution\Download\4e74c5414ee4f4ca4c8355d23b4c49e8\BIT6691.tmp
  [WARNUNG]  Die komprimierten Daten sind fehlerhaft

Beginne mit der Desinfektion:
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U\00000001.@
  [FUND]      Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/ZAccess.W
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56cbcfac.qua' verschoben!
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\fc5e071-140a22e2
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lamar.FH
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e59e057.qua' verschoben!

Und hier das Ergebnis vom OTL-Scan:

Code:
OTL logfile created on: 16.08.2012 09:56:24 - Run 2
OTL by OldTimer - Version 3.2.57.0    Folder = C:\Users\Regina\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,68 Gb Total Physical Memory | 2,50 Gb Available Physical Memory | 67,87% Memory free
7,35 Gb Paging File | 5,70 Gb Available in Paging File | 77,44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 583,07 Gb Total Space | 109,90 Gb Free Space | 18,85% Space Free | Partition Type: NTFS
 
Computer Name: REGINA-PC | User Name: Regina | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found --
PRC - [2012.08.16 09:51:11 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Regina\Desktop\OTL(1).exe
PRC - [2012.08.10 14:29:13 | 000,302,961 | ---- | M] () -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
PRC - [2012.08.08 09:26:16 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.12 11:09:29 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.05.12 11:09:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.12 11:09:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe
PRC - [2010.09.30 14:00:28 | 000,139,088 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe
PRC - [2010.07.12 08:52:50 | 000,548,864 | ---- | M] () -- C:\Program Files (x86)\Greenshot\Greenshot.exe
PRC - [2010.04.17 07:56:48 | 000,305,520 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
PRC - [2010.03.09 01:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.03.04 05:16:04 | 000,284,696 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.03.03 15:21:16 | 001,300,560 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010.03.03 15:21:16 | 000,325,200 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.03.03 15:21:16 | 000,297,040 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.13 10:47:44 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
PRC - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.10 14:29:13 | 000,302,961 | ---- | M] () -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
MOD - [2012.06.18 23:27:25 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll
MOD - [2012.06.18 23:27:13 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll
MOD - [2012.05.10 10:15:34 | 000,452,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\73baa23d28d21c7c01e334211330a84e\IAStorUtil.ni.dll
MOD - [2012.05.10 10:09:16 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll
MOD - [2012.05.10 10:08:36 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll
MOD - [2012.05.10 10:08:32 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll
MOD - [2012.05.10 10:08:29 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll
MOD - [2012.05.10 10:08:28 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll
MOD - [2012.05.10 10:08:22 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll
MOD - [2010.09.30 14:00:28 | 000,139,088 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe
MOD - [2010.07.12 08:52:50 | 000,548,864 | ---- | M] () -- C:\Program Files (x86)\Greenshot\Greenshot.exe
MOD - [2010.07.12 08:52:48 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\Greenshot\GreenshotPlugin.dll
MOD - [2010.06.12 05:56:26 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.06.12 05:56:23 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.01.13 10:47:44 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
MOD - [2009.05.20 08:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010.09.27 16:42:04 | 004,180,576 | ---- | M] (SafeNet Inc.) [Auto | Running] -- C:\Windows\SysNative\hasplms.exe -- (hasplms)
SRV:64bit: - [2010.04.21 01:34:40 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.08.10 14:29:12 | 000,285,795 | ---- | M] () [Auto | Stopped] -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe -- (HOSTS Anti-PUPs)
SRV - [2012.07.18 20:03:48 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.12 11:09:29 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.05.12 11:09:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.12 11:09:28 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.07.13 22:11:59 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.11.08 17:09:29 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010.04.23 10:46:04 | 000,820,768 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.04.22 19:39:54 | 000,171,040 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Optical Drive Power Management\ODDPWRSvc.exe -- (ODDPwrSvc)
SRV - [2010.04.17 07:56:48 | 000,305,520 | ---- | M] (Egis Technology Inc.) [Auto | Running] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.03.26 11:46:48 | 000,920,352 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.09 01:58:24 | 000,250,368 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.03.04 05:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.03.03 15:21:16 | 000,325,200 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.12 11:09:29 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.12 11:09:29 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 08:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.10.19 17:56:15 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.03.11 08:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.01.15 18:21:04 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2010.12.15 12:23:22 | 000,358,480 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ta2avs.sys -- (ta2avs)
DRV:64bit: - [2010.12.15 12:23:22 | 000,075,856 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ta2usb.sys -- (ta2usb_svc)
DRV:64bit: - [2010.09.27 16:42:10 | 000,131,072 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksfridge.sys -- (aksfridge)
DRV:64bit: - [2010.09.27 16:42:06 | 000,075,648 | ---- | M] (SafeNet Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aksdf.sys -- (aksdf)
DRV:64bit: - [2010.09.27 16:42:04 | 000,053,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\akshasp.sys -- (akshasp)
DRV:64bit: - [2010.09.27 16:42:02 | 000,318,464 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hardlock.sys -- (Hardlock)
DRV:64bit: - [2010.09.27 16:42:00 | 000,025,344 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\aksusb.sys -- (aksusb)
DRV:64bit: - [2010.09.27 16:41:58 | 000,056,960 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\akshhl.sys -- (akshhl)
DRV:64bit: - [2010.04.21 03:15:04 | 006,406,144 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.04.21 00:39:36 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.04.21 00:08:04 | 010,322,848 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdpmd64.sys -- (intelkmd)
DRV:64bit: - [2010.04.07 22:12:02 | 000,124,944 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010.04.01 10:18:30 | 003,060,800 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2010.03.17 16:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64)
DRV:64bit: - [2010.03.05 12:04:08 | 000,335,400 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.03.01 17:37:40 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.02.14 22:05:12 | 000,102,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.01.13 17:41:12 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.01.13 17:41:06 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2009.12.22 03:18:48 | 000,074,280 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009.10.29 19:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009.10.26 06:39:44 | 000,151,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009.09.28 09:55:42 | 000,051,760 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\OXSDIDRV_x64.sys -- (OXSDIDRV_x64)
DRV:64bit: - [2009.09.17 14:12:06 | 000,292,912 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.09.17 12:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.06.03 04:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009.06.03 04:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009.06.03 04:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009.05.26 15:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009.05.05 10:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.05 10:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2009.04.29 16:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.11.05 11:08:06 | 000,670,208 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\hardlock.sys -- (Hardlock)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\..\SearchScopes\{E1CCAF70-21BD-4CB8-B683-98CA1166A051}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.8
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 20:03:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.14 22:38:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.25 09:26:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011.12.05 21:58:08 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 20:03:48 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.14 22:38:43 | 000,000,000 | ---D | M]
 
[2010.06.21 19:56:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Regina\AppData\Roaming\mozilla\Extensions
[2010.06.21 19:56:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Regina\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.08.16 09:46:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Regina\AppData\Roaming\mozilla\Firefox\Profiles\p1y5cce8.default\extensions
[2012.04.29 12:39:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.01.08 18:20:46 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012.08.16 09:46:17 | 000,341,151 | ---- | M] () (No name found) -- C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI
[2012.07.18 20:03:48 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.04.14 22:38:12 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.09.12 21:10:33 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012.04.02 22:14:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.02 22:14:31 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.04.02 22:14:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.02 22:14:31 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.02 22:14:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.02 22:14:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2012.08.10 14:34:33 | 000,012,319 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 dde.integration.storage.conduit-services.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 cf1.vuze.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 download.cdn.imesh.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 files.download1click.ws # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 data.oa-software.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 api.yontoo.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 dl-plugin.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 www.nlstorage.info # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 plugnrex.info # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 install.optimum-installer.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 ads.traff.co # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 popander.mobi # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 universal-downloader.softonic.fr # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 www.messengerdusexe.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 speedmaxpc.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 cdneu.friedcookiescdn.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 file-extractor.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 bfd34af056e54c8abcb9dd50862f0b9b.integration.download.conduit-services.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 www.winload.de # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 ct2319825.ourtoolbar.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 ie.conduit-download.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 ct2319825.ourtoolbar.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 servicemap.conduit-services.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 usage.toolbar.conduit-services.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 127.0.0.1 ff.conduit-download.com # Hosts Anti-Adware / PUPs
O1 - Hosts: 194 more lines...
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [ODDPwr] C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HOSTS Anti-Adware_PUPs] C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\SysWOW64\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UIExec] C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe ()
O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2053579269-2245281128-2635259758-1000..\Run: [Greenshot] C:\Program Files (x86)\Greenshot\Greenshot.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F3665061-F5E3-4DE3-8538-A9B2F0B01307}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\Shell - "" = AutoRun
O33 - MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\Shell\AutoRun\command - "" = Iomega Encryption Utility.exe
O33 - MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\Shell - "" = AutoRun
O33 - MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\Shell\AutoRun\command - "" = D:\SetupSeriesA.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk - C:\PROGRA~2\Acer\ACERVC~1\AcerVCM.exe - (Acer Incorporated)
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acrobat Assistant.lnk - C:\PROGRA~2\Adobe\ACROBA~1.0\Distillr\acrotray.exe - (Adobe Systems Inc.)
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe - (Broadcom Corporation.)
MsConfig:64bit - StartUpFolder: C:^Users^Regina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk - C:\PROGRA~2\OPENOF~1.ORG\program\QUICKS~1.EXE - ()
MsConfig:64bit - StartUpReg: AmIcoSinglun64 - hkey= - key= - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
MsConfig:64bit - StartUpReg: ArcadeMovieService - hkey= - key= - C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: BackupManagerTray - hkey= - key= - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
MsConfig:64bit - StartUpReg: EgisTecPMMUpdate - hkey= - key= - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
MsConfig:64bit - StartUpReg: EgisUpdate - hkey= - key= - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
MsConfig:64bit - StartUpReg: HotKeysCmds - hkey= - key= - C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: IgfxTray - hkey= - key= - C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: MDS_Menu - hkey= - key= - C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: mwlDaemon - hkey= - key= - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
MsConfig:64bit - StartUpReg: Persistence - hkey= - key= - C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: RtHDVBg - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
MsConfig:64bit - StartUpReg: SuiteTray - hkey= - key= - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: MCODS - Reg Error: Value error.
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MCODS - Reg Error: Value error.
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: BFE - Service
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: MCODS - Reg Error: Value error.
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: BFE - Service
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: MCODS - Reg Error: Value error.
SafeBootNet: Messenger - Service
SafeBootNet: MPSSvc - C:\Windows\SysWOW64\wbem\mpssvc.mof ()
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Reg Error: Value error.
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.16 09:51:09 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Regina\Desktop\OTL(1).exe
[2012.08.10 14:46:16 | 000,000,000 | ---D | C] -- C:\Users\Regina\Desktop\Computerbereinigung
[2012.08.10 14:29:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
[2012.08.09 19:12:42 | 000,000,000 | ---D | C] -- C:\Users\Regina\AppData\Roaming\Simfy
[2012.08.09 19:12:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\simfy
[2012.08.09 19:12:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\simfy
[2012.08.07 18:27:26 | 000,000,000 | ---D | C] -- C:\Users\Regina\AppData\Local\.elfohilfe
[2012.08.06 23:02:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.08.06 23:00:58 | 000,000,000 | -H-D | C] -- C:\Windows\AxInstSV
[2012.08.06 10:59:35 | 000,000,000 | ---D | C] -- C:\Users\Regina\AppData\Roaming\Malwarebytes
[2012.08.06 10:59:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.06 10:59:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.06 10:59:09 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.06 10:59:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.02 12:46:39 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2010.08.07 01:15:40 | 000,061,440 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Regina\_0AA6EBFE1D884E4E80D3DF6A7757540D
 
========== Files - Modified Within 30 Days ==========
 
File not found -- C:\Windows\SysNative\
[2012.08.16 09:51:11 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Regina\Desktop\OTL(1).exe
[2012.08.16 09:40:04 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.16 09:11:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.15 16:40:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.15 13:45:19 | 000,356,823 | ---- | M] () -- C:\Users\Regina\Desktop\Angebot AG71256-001.pdf
[2012.08.15 09:39:52 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.15 09:39:52 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.15 09:31:44 | 2962,243,584 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.10 18:08:01 | 001,512,418 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.10 18:08:01 | 000,659,238 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.10 18:08:01 | 000,620,384 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.10 18:08:01 | 000,132,776 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.10 18:08:01 | 000,108,566 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.10 18:01:44 | 000,159,724 | ---- | M] () -- C:\Users\Regina\Desktop\Stundenzettel Villa Neuss korrekt.jpg
[2012.08.10 17:30:48 | 000,170,029 | ---- | M] () -- C:\Users\Regina\Desktop\Stundenzettel Villa Neuss.jpg
[2012.08.10 14:34:33 | 000,012,319 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.08.09 19:12:44 | 000,000,032 | ---- | M] () -- C:\Users\Regina\.simfy
[2012.08.08 22:51:02 | 000,614,903 | ---- | M] () -- C:\Users\Regina\Desktop\adwcleaner.exe
[2012.08.06 10:59:11 | 000,001,117 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.03 19:09:48 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2012.08.02 23:23:25 | 000,000,000 | ---- | M] () -- C:\Users\Regina\defogger_reenable
[2012.07.20 15:32:57 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
 
========== Files Created - No Company Name ==========
 
File not found -- C:\Windows\SysNative\
[2012.08.15 13:45:18 | 000,356,823 | ---- | C] () -- C:\Users\Regina\Desktop\Angebot AG71256-001.pdf
[2012.08.10 18:01:44 | 000,159,724 | ---- | C] () -- C:\Users\Regina\Desktop\Stundenzettel Villa Neuss korrekt.jpg
[2012.08.10 17:30:48 | 000,170,029 | ---- | C] () -- C:\Users\Regina\Desktop\Stundenzettel Villa Neuss.jpg
[2012.08.09 19:12:44 | 000,000,032 | ---- | C] () -- C:\Users\Regina\.simfy
[2012.08.08 22:51:40 | 000,614,903 | ---- | C] () -- C:\Users\Regina\Desktop\adwcleaner.exe
[2012.08.06 10:59:11 | 000,001,117 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.02 23:23:25 | 000,000,000 | ---- | C] () -- C:\Users\Regina\defogger_reenable
[2012.06.12 19:54:19 | 000,010,569 | ---- | C] () -- C:\Windows\CSTBox.INI
[2012.05.15 14:13:44 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.05.15 14:13:44 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD2140.DAT
[2012.01.11 17:41:33 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@
[2012.01.11 17:41:33 | 000,002,048 | -HS- | C] () -- C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@
[2011.08.18 11:39:57 | 000,000,809 | ---- | C] () -- C:\Windows\NTIWVEDT.INI
[2011.07.13 22:16:44 | 002,463,976 | ---- | C] () -- C:\Windows\SysWow64\NPSWF32.dll
[2011.04.06 20:52:12 | 000,000,000 | ---- | C] () -- C:\Users\Regina\.gtk-bookmarks
[2011.04.06 20:46:48 | 000,678,241 | ---- | C] () -- C:\Users\Regina\.fonts.cache-1
[2011.04.05 21:46:01 | 000,164,864 | ---- | C] () -- C:\Windows\SysWow64\UNWISE.EXE
[2011.04.05 21:46:01 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\hdsuinst.exe
[2011.04.05 21:46:01 | 000,006,836 | ---- | C] () -- C:\Windows\SysWow64\UNWISE.INI
[2010.11.08 17:09:31 | 000,000,000 | ---- | C] () -- C:\Windows\eDrawingOfficeAutomator.INI
[2010.06.28 20:41:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.13 12:56:05 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2012.06.12 19:45:54 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Canon
[2012.05.27 09:15:09 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\CD-LabelPrint
[2010.11.08 17:10:03 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\EDrawings
[2012.07.05 15:38:57 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\elsterformular
[2012.08.07 23:22:22 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\foobar2000
[2010.09.12 21:11:33 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Foxit Software
[2011.12.07 18:19:50 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Greenshot
[2011.04.11 19:33:38 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Nemetschek
[2011.12.05 22:46:18 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\net.nemetschek.vectorworks.2012.help.eng.CC16605A57FA88F0CED2B1A19E704F482AB2B1EB.1
[2010.09.14 21:12:52 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\OpenOffice.org
[2010.08.07 01:18:09 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\PACE Anti-Piracy
[2010.06.12 19:37:13 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\PowerCinema
[2012.08.09 19:12:42 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Simfy
[2011.11.08 18:07:44 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\SimpleScreenshot
[2011.12.13 18:21:48 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Sync App Settings
[2010.06.21 19:56:04 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Thunderbird
[2012.05.04 09:00:29 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.12.05 22:46:12 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Adobe
[2011.01.22 13:51:38 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\AdobeAUM
[2010.08.07 01:02:57 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\AdobeUM
[2012.01.24 00:18:49 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Ahead
[2010.06.11 20:28:27 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\ATI
[2011.12.07 14:33:57 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Avira
[2012.05.15 14:13:58 | 000,000,000 | R--D | M] -- C:\Users\Regina\AppData\Roaming\Brother
[2012.06.12 19:45:54 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Canon
[2012.05.27 09:15:09 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\CD-LabelPrint
[2010.06.12 19:36:57 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\CyberLink
[2010.11.08 17:10:03 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\EDrawings
[2012.07.05 15:38:57 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\elsterformular
[2012.08.07 23:22:22 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\foobar2000
[2010.09.12 21:11:33 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Foxit Software
[2010.06.11 20:37:31 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Google
[2011.12.07 18:19:50 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Greenshot
[2010.06.11 20:26:47 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Identities
[2010.06.11 20:29:03 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\InstallShield
[2010.06.11 20:27:23 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Intel Corporation
[2010.06.11 20:38:01 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Macromedia
[2012.08.06 10:59:35 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Malwarebytes
[2009.07.14 09:44:38 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Media Center Programs
[2011.07.18 13:09:58 | 000,000,000 | --SD | M] -- C:\Users\Regina\AppData\Roaming\Microsoft
[2010.06.12 19:27:03 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Mozilla
[2011.04.11 19:33:38 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Nemetschek
[2011.12.05 22:46:18 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\net.nemetschek.vectorworks.2012.help.eng.CC16605A57FA88F0CED2B1A19E704F482AB2B1EB.1
[2010.09.14 21:12:52 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\OpenOffice.org
[2010.08.07 01:18:09 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\PACE Anti-Piracy
[2010.06.12 19:37:13 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\PowerCinema
[2012.08.09 19:12:42 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Simfy
[2011.11.08 18:07:44 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\SimpleScreenshot
[2012.08.06 10:55:28 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Skype
[2012.08.06 10:17:34 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\skypePM
[2011.12.13 18:21:48 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Sync App Settings
[2010.06.21 19:56:04 | 000,000,000 | ---D | M] -- C:\Users\Regina\AppData\Roaming\Thunderbird
 
< %APPDATA%\*.exe /s >
[2012.08.07 18:33:24 | 004,158,816 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_10_8623_9066.exe
[2012.08.07 18:33:42 | 004,158,616 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_11_8623_9066.exe
[2012.08.07 18:33:59 | 004,158,880 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_dfv_12_8623_9066.exe
[2012.08.07 18:34:16 | 004,169,424 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_09_8623_9066.exe
[2012.08.07 18:34:34 | 004,194,184 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_10_8623_9066.exe
[2012.08.07 18:34:51 | 004,282,320 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_eur_11_8623_9066.exe
[2012.08.07 18:36:04 | 004,142,944 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_09_8623_9066.exe
[2012.08.07 18:36:21 | 004,166,112 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_10_8623_9066.exe
[2012.08.07 18:36:38 | 004,267,600 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gstz_11_8623_9066.exe
[2012.08.07 18:35:09 | 004,174,952 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_09_8623_9066.exe
[2012.08.07 18:35:26 | 004,172,360 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_10_8623_9066.exe
[2012.08.07 18:35:46 | 004,288,400 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_gst_11_8623_9066.exe
[2012.08.07 18:36:56 | 004,159,936 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_10_8623_9066.exe
[2012.08.07 18:37:13 | 004,142,080 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_11_8623_9066.exe
[2012.08.07 18:37:31 | 004,162,872 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lsta_12_8623_9066.exe
[2012.08.07 18:37:48 | 004,196,864 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_10_8623_9066.exe
[2012.08.07 18:38:05 | 004,195,616 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_11_8623_9066.exe
[2012.08.07 18:38:23 | 004,197,384 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_lstb_12_8623_9066.exe
[2012.08.07 18:38:40 | 004,252,240 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_09_8623_9066.exe
[2012.08.07 18:38:58 | 004,252,928 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_10_8623_9066.exe
[2012.08.07 18:39:16 | 004,257,944 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_par34a_11_8623_9066.exe
[2012.08.07 18:32:55 | 006,013,856 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_pica_0_8623_9066.exe
[2012.08.07 18:40:25 | 004,169,824 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_10_8623_9066.exe
[2012.08.07 18:40:42 | 004,166,720 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_11_8623_9066.exe
[2012.08.07 18:41:00 | 004,182,552 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ustva_12_8623_9066.exe
[2012.08.07 18:39:34 | 004,175,632 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_09_8623_9066.exe
[2012.08.07 18:39:51 | 004,151,560 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_10_8623_9066.exe
[2012.08.07 18:40:08 | 004,177,200 | ---- | M] (Landesfinanzdirektion Thüringen) -- C:\Users\Regina\AppData\Roaming\elsterformular\pluginmanager\tmp\update_ust_11_8623_9066.exe
[2012.04.30 13:16:55 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Regina\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.07.18 13:43:34 | 003,085,984 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Regina\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\drivers\iaStor.sys
[2010.03.04 04:51:40 | 000,540,696 | ---- | M] (Intel Corporation) MD5=ABBF174CB394F5C437410A788B7E404A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_78ebae21a80aa2b4\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\SysNative\netlogon.dll
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\SysNative\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\SysNative\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
Ich würde halt gerne auf Grund deiner Erfahrung deine Meinung wissen und fragen ob es wohl sinnvoller ist zu bereinigen oder ob ich lieber die zwei Tage für neu Aufsetzten benutze, weil es nie ein richtig sauberes Ergebnis geben wird.
Ich bin da völlig ahnungslos ob das jetzt noch wegzumachen ist oder ob ich mich jetzt für immer mit Sorgen rumschlagen muss, dass da einer auf meinen Rechner guckt oder der Rechner plötzlich mitten in der Arbeit abschmiert oder ähnliches. Ist alles so beunruhigend.
Danke!
Regina

cosinus 16.08.2012 11:53
Die Bereinigung kann ein Erfolg werden, aber es gibt keine Garantie für die Schädlingsfreiheit - auch wenn alle Logs unauffällig sind, das System auch symptomfrei werkelt und kein Virenscanner etwas meldet - 100% Sicherheit gibt es nicht

Regina14 16.08.2012 12:18
Hallo Arne,

danke für die Einschätzung, dann würde ich doch sehr gerne versuchen weiter zu bereinigen!

Grüße
Regina

cosinus 16.08.2012 13:49
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
FF - user.js - File not found
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\Shell - "" = AutoRun
O33 - MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\Shell\AutoRun\command - "" = Iomega Encryption Utility.exe
O33 - MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\Shell - "" = AutoRun
O33 - MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\Shell\AutoRun\command - "" = D:\SetupSeriesA.exe
:Files
C:\Users\Regina\_0AA6EBFE1D884E4E80D3DF6A7757540D
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\L
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\n
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@
C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\L
C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U
C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\n
C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@
C:\Program Files (x86)\Common Files\Spigot
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Regina14 17.08.2012 10:28
Hallo Arne,

hier das Ergebnis:

Code:
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f986b3a-9908-11e0-a556-c80aa98379c8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3f986b3a-9908-11e0-a556-c80aa98379c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f986b3a-9908-11e0-a556-c80aa98379c8}\ not found.
File Iomega Encryption Utility.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{eceb4d5a-74e4-11e0-a0e2-c80aa98379c8}\ not found.
File D:\SetupSeriesA.exe not found.
========== FILES ==========
C:\Users\Regina\_0AA6EBFE1D884E4E80D3DF6A7757540D moved successfully.
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\L folder moved successfully.
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U folder moved successfully.
File\Folder C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\n not found.
C:\Windows\Installer\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@ moved successfully.
C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\L folder moved successfully.
C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\U folder moved successfully.
File\Folder C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\n not found.
C:\Users\Regina\AppData\Local\{5c0b5c6d-ea04-f662-e6ee-6a7ba91c9543}\@ moved successfully.
File\Folder C:\Program Files (x86)\Common Files\Spigot not found.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Regina\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Regina
->Temp folder emptied: 2511733632 bytes
->Temporary Internet Files folder emptied: 95505729 bytes
->FireFox cache emptied: 1117249816 bytes
->Google Chrome cache emptied: 819568 bytes
->Flash cache emptied: 3208891 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 759974393 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 119691 bytes
RecycleBin emptied: 6181595 bytes
 
Total Files Cleaned = 4.287,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Regina
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.57.0 log created on 08162012_172922

Files\Folders moved on Reboot...
C:\Users\Regina\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File move failed. C:\Windows\temp\TmpFile1 scheduled to be moved on reboot.

PendingFileRenameOperations files...
File C:\Users\Regina\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
[2012.08.16 17:49:46 | 000,000,000 | ---- | M] () C:\Windows\temp\dsiwmis.log : Unable to obtain MD5
[2012.08.16 17:49:44 | 008,405,015 | ---- | M] () C:\Windows\temp\TmpFile1 : Unable to obtain MD5

Registry entries deleted on Reboot...
Grüße
Regina

cosinus 17.08.2012 20:24
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Regina14 17.08.2012 21:46
Hallo Arne,

hier der Report vom TDSSKiller:

Code:
22:38:20.0799 4148  TDSS rootkit removing tool 2.8.6.0 Aug 13 2012 17:24:05
22:38:21.0095 4148  ============================================================
22:38:21.0095 4148  Current date / time: 2012/08/17 22:38:21.0095
22:38:21.0095 4148  SystemInfo:
22:38:21.0095 4148 
22:38:21.0095 4148  OS Version: 6.1.7600 ServicePack: 0.0
22:38:21.0095 4148  Product type: Workstation
22:38:21.0095 4148  ComputerName: REGINA-PC
22:38:21.0095 4148  UserName: Regina
22:38:21.0095 4148  Windows directory: C:\Windows
22:38:21.0095 4148  System windows directory: C:\Windows
22:38:21.0095 4148  Running under WOW64
22:38:21.0095 4148  Processor architecture: Intel x64
22:38:21.0095 4148  Number of processors: 4
22:38:21.0095 4148  Page size: 0x1000
22:38:21.0095 4148  Boot type: Normal boot
22:38:21.0095 4148  ============================================================
22:38:21.0828 4148  Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
22:38:21.0844 4148  ============================================================
22:38:21.0844 4148  \Device\Harddisk0\DR0:
22:38:21.0844 4148  MBR partitions:
22:38:21.0844 4148  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1A00800, BlocksNum 0x32000
22:38:21.0844 4148  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1A32800, BlocksNum 0x48E25000
22:38:21.0844 4148  ============================================================
22:38:21.0860 4148  C: <-> \Device\Harddisk0\DR0\Partition2
22:38:21.0860 4148  ============================================================
22:38:21.0860 4148  Initialize success
22:38:21.0860 4148  ============================================================
22:40:01.0606 5076  ============================================================
22:40:01.0606 5076  Scan started
22:40:01.0606 5076  Mode: Manual; SigCheck; TDLFS;
22:40:01.0606 5076  ============================================================
22:40:01.0934 5076  ================ Scan services =============================
22:40:02.0199 5076  [ 1b00662092f9f9568b995902f0cc40d5 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
22:40:02.0339 5076  1394ohci - ok
22:40:02.0386 5076  [ 6f11e88748cdefd2f76aa215f97ddfe5 ] ACPI            C:\Windows\system32\DRIVERS\ACPI.sys
22:40:02.0402 5076  ACPI - ok
22:40:02.0449 5076  [ 63b05a0420ce4bf0e4af6dcc7cada254 ] AcpiPmi        C:\Windows\system32\DRIVERS\acpipmi.sys
22:40:02.0542 5076  AcpiPmi - ok
22:40:02.0605 5076  [ 2f6b34b83843f0c5118b63ac634f5bf4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
22:40:02.0620 5076  adp94xx - ok
22:40:02.0636 5076  [ 597f78224ee9224ea1a13d6350ced962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
22:40:02.0651 5076  adpahci - ok
22:40:02.0714 5076  [ e109549c90f62fb570b9540c4b148e54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
22:40:02.0729 5076  adpu320 - ok
22:40:02.0745 5076  [ 4b78b431f225fd8624c5655cb1de7b61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
22:40:02.0901 5076  AeLookupSvc - ok
22:40:02.0963 5076  [ db9d6c6b2cd95a9ca414d045b627422e ] AFD            C:\Windows\system32\drivers\afd.sys
22:40:03.0057 5076  AFD - ok
22:40:03.0587 5076  [ 608c14dba7299d8cb6ed035a68a15799 ] agp440          C:\Windows\system32\DRIVERS\agp440.sys
22:40:03.0603 5076  agp440 - ok
22:40:03.0681 5076  [ 94c0972b06c75456ed574dd46417b1d8 ] aksdf          C:\Windows\system32\drivers\aksdf.sys
22:40:03.0759 5076  aksdf - ok
22:40:03.0977 5076  [ 7b0bc062ca6abab23f88ea483b5a538e ] aksfridge      C:\Windows\system32\DRIVERS\aksfridge.sys
22:40:04.0024 5076  aksfridge - ok
22:40:04.0040 5076  [ a56f1b0f967aef8a82d7771e6d166def ] akshasp        C:\Windows\system32\DRIVERS\akshasp.sys
22:40:04.0071 5076  akshasp - ok
22:40:04.0133 5076  [ 67dff8c8f95cb21c9c3380dd4c0387f2 ] akshhl          C:\Windows\system32\DRIVERS\akshhl.sys
22:40:04.0165 5076  akshhl - ok
22:40:04.0211 5076  [ a9a09bc526e614ce9f29bb23c2a76ced ] aksusb          C:\Windows\system32\DRIVERS\aksusb.sys
22:40:04.0243 5076  aksusb - ok
22:40:04.0289 5076  [ 3290d6946b5e30e70414990574883ddb ] ALG            C:\Windows\System32\alg.exe
22:40:04.0352 5076  ALG - ok
22:40:04.0445 5076  [ 5812713a477a3ad7363c7438ca2ee038 ] aliide          C:\Windows\system32\DRIVERS\aliide.sys
22:40:04.0461 5076  aliide - ok
22:40:04.0539 5076  [ 671d9dca48da807780d8409c18ed0ae0 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
22:40:04.0648 5076  AMD External Events Utility - ok
22:40:04.0711 5076  [ 1ff8b4431c353ce385c875f194924c0c ] amdide          C:\Windows\system32\DRIVERS\amdide.sys
22:40:04.0726 5076  amdide - ok
22:40:04.0804 5076  [ 7024f087cff1833a806193ef9d22cda9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
22:40:04.0835 5076  AmdK8 - ok
22:40:05.0007 5076  [ d3e6b2e1394d93fe9db0ba24814b0d8f ] amdkmdag        C:\Windows\system32\DRIVERS\atipmdag.sys
22:40:05.0288 5076  amdkmdag - ok
22:40:05.0350 5076  [ cc4d915d786d3da973b2ea9b95d59a29 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
22:40:05.0397 5076  amdkmdap - ok
22:40:05.0459 5076  [ 1e56388b3fe0d031c44144eb8c4d6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
22:40:05.0506 5076  AmdPPM - ok
22:40:05.0584 5076  [ ec7ebab00a4d8448bab68d1e49b4beb9 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
22:40:05.0600 5076  amdsata - ok
22:40:05.0662 5076  [ f67f933e79241ed32ff46a4f29b5120b ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
22:40:05.0678 5076  amdsbs - ok
22:40:05.0725 5076  [ db27766102c7bf7e95140a2aa81d042e ] amdxata        C:\Windows\system32\drivers\amdxata.sys
22:40:05.0756 5076  amdxata - ok
22:40:05.0834 5076  [ 391887990cdaa83de5c56c3fde966da1 ] AmUStor        C:\Windows\system32\drivers\AmUStor.SYS
22:40:05.0865 5076  AmUStor - ok
22:40:05.0974 5076  [ 466a0d95960dad3222c896d2cea99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
22:40:06.0005 5076  AntiVirSchedulerService - ok
22:40:06.0068 5076  [ a489be6bb0aa1ff406b488b60542314b ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
22:40:06.0083 5076  AntiVirService - ok
22:40:06.0161 5076  [ 676894fa57b671fec5c3f05f8929e03b ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
22:40:06.0177 5076  AntiVirWebService - ok
22:40:06.0255 5076  [ 42fd751b27fa0e9c69bb39f39e409594 ] AppID          C:\Windows\system32\drivers\appid.sys
22:40:06.0380 5076  AppID - ok
22:40:06.0442 5076  [ 0bc381a15355a3982216f7172f545de1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
22:40:06.0536 5076  AppIDSvc - ok
22:40:06.0583 5076  [ d065be66822847b7f127d1f90158376e ] Appinfo        C:\Windows\System32\appinfo.dll
22:40:06.0645 5076  Appinfo - ok
22:40:06.0692 5076  [ c484f8ceb1717c540242531db7845c4e ] arc            C:\Windows\system32\DRIVERS\arc.sys
22:40:06.0723 5076  arc - ok
22:40:06.0723 5076  [ 019af6924aefe7839f61c830227fe79c ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
22:40:06.0754 5076  arcsas - ok
22:40:06.0770 5076  [ 769765ce2cc62867468cea93969b2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
22:40:06.0832 5076  AsyncMac - ok
22:40:06.0848 5076  [ 02062c0b390b7729edc9e69c680a6f3c ] atapi          C:\Windows\system32\DRIVERS\atapi.sys
22:40:06.0863 5076  atapi - ok
22:40:06.0910 5076  [ 637e0753bd6deb8ea5314a5c357ec1a0 ] AtiHdmiService  C:\Windows\system32\drivers\AtiHdmi.sys
22:40:06.0941 5076  AtiHdmiService - ok
22:40:06.0973 5076  [ 07721a77180edd4d39ccb865bf63c7fd ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
22:40:07.0082 5076  AudioEndpointBuilder - ok
22:40:07.0097 5076  [ 07721a77180edd4d39ccb865bf63c7fd ] AudioSrv        C:\Windows\System32\Audiosrv.dll
22:40:07.0144 5076  AudioSrv - ok
22:40:07.0207 5076  [ 26e38b5a58c6c55fafbc563eeddb0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
22:40:07.0222 5076  avgntflt - ok
22:40:07.0253 5076  [ 9d1f00beff84cbbf46d7f052bc7e0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
22:40:07.0269 5076  avipbb - ok
22:40:07.0300 5076  [ 248db59fc86de44d2779f4c7fb1a567d ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
22:40:07.0316 5076  avkmgr - ok
22:40:07.0347 5076  [ b20b5fa5ca050e9926e4d1db81501b32 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
22:40:07.0456 5076  AxInstSV - ok
22:40:07.0519 5076  [ 3e5b191307609f7514148c6832bb0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
22:40:07.0597 5076  b06bdrv - ok
22:40:07.0628 5076  [ b5ace6968304a3900eeb1ebfd9622df2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
22:40:07.0690 5076  b57nd60a - ok
22:40:07.0799 5076  [ fde8c8dc07e75347e4c6b455a0964217 ] BCM43XX        C:\Windows\system32\DRIVERS\bcmwl664.sys
22:40:07.0940 5076  BCM43XX - ok
22:40:08.0033 5076  [ fde360167101b4e45a96f939f388aeb0 ] BDESVC          C:\Windows\System32\bdesvc.dll
22:40:08.0096 5076  BDESVC - ok
22:40:08.0143 5076  [ 16a47ce2decc9b099349a5f840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
22:40:08.0221 5076  Beep - ok
22:40:08.0283 5076  [ 7f0c323fe3da28aa4aa1bda3f575707f ] BITS            C:\Windows\System32\qmgr.dll
22:40:08.0377 5076  BITS - ok
22:40:08.0408 5076  [ 61583ee3c3a17003c4acd0475646b4d3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
22:40:08.0455 5076  blbdrive - ok
22:40:08.0548 5076  [ 73686fe0b2e0469f89fd2075be724704 ] Bonjour Service C:\Program Files (x86)\Bonjour\mDNSResponder.exe
22:40:08.0579 5076  Bonjour Service ( UnsignedFile.Multi.Generic ) - warning
22:40:08.0579 5076  Bonjour Service - detected UnsignedFile.Multi.Generic (1)
22:40:08.0657 5076  [ 19d20159708e152267e53b66677a4995 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
22:40:08.0735 5076  bowser - ok
22:40:08.0782 5076  [ f09eee9edc320b5e1501f749fde686c8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
22:40:08.0829 5076  BrFiltLo - ok
22:40:08.0860 5076  [ b114d3098e9bdb8bea8b053685831be6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
22:40:08.0876 5076  BrFiltUp - ok
22:40:08.0954 5076  [ 6b054c67aaa87843504e8e3c09102009 ] Browser        C:\Windows\System32\browser.dll
22:40:09.0016 5076  Browser - ok
22:40:09.0047 5076  [ 43bea8d483bf1870f018e2d02e06a5bd ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
22:40:09.0110 5076  Brserid - ok
22:40:09.0125 5076  [ a6eca2151b08a09caceca35c07f05b42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
22:40:09.0172 5076  BrSerWdm - ok
22:40:09.0203 5076  [ b79968002c277e869cf38bd22cd61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
22:40:09.0266 5076  BrUsbMdm - ok
22:40:09.0297 5076  [ a87528880231c54e75ea7a44943b38bf ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
22:40:09.0344 5076  BrUsbSer - ok
22:40:09.0422 5076  [ cf98190a94f62e405c8cb255018b2315 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
22:40:09.0469 5076  BthEnum - ok
22:40:09.0484 5076  [ 9da669f11d1f894ab4eb69bf546a42e8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
22:40:09.0531 5076  BTHMODEM - ok
22:40:09.0593 5076  [ 02dd601b708dd0667e1331fa8518e9ff ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
22:40:09.0640 5076  BthPan - ok
22:40:09.0718 5076  [ d59773c7fdd3d795d6fe402eeea8d71e ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
22:40:09.0781 5076  BTHPORT - ok
22:40:09.0843 5076  [ 95f9c2976059462cbbf227f7aab10de9 ] bthserv        C:\Windows\system32\bthserv.dll
22:40:09.0921 5076  bthserv - ok
22:40:09.0952 5076  [ 8504842634dd144c075b6b0c982ccec4 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
22:40:09.0983 5076  BTHUSB - ok
22:40:10.0046 5076  [ 380b798d30c56ede4af58619d0e86ccb ] btwampfl        C:\Windows\system32\drivers\btwampfl.sys
22:40:10.0077 5076  btwampfl - ok
22:40:10.0139 5076  [ ba5622f5544c6c445dff1a05acc8b19d ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys
22:40:10.0155 5076  btwaudio - ok
22:40:10.0202 5076  [ a11905d0f4bd34771f195217b6aa5ae0 ] btwavdt        C:\Windows\system32\DRIVERS\btwavdt.sys
22:40:10.0217 5076  btwavdt - ok
22:40:10.0295 5076  [ 3930e53ee0bed9dff9afa09f505d0cae ] btwdins        C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
22:40:10.0342 5076  btwdins - ok
22:40:10.0373 5076  [ 07096d2bc22ccb6cea5a532df0be8a75 ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys
22:40:10.0389 5076  btwl2cap - ok
22:40:10.0405 5076  [ bd776f32d64ec615be4563dc2747224e ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys
22:40:10.0420 5076  btwrchid - ok
22:40:10.0451 5076  [ b8bd2bb284668c84865658c77574381a ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
22:40:10.0576 5076  cdfs - ok
22:40:10.0623 5076  [ 83d2d75e1efb81b3450c18131443f7db ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
22:40:10.0701 5076  cdrom - ok
22:40:10.0779 5076  [ 312e2f82af11e79906898ac3e3d58a1f ] CertPropSvc    C:\Windows\System32\certprop.dll
22:40:10.0841 5076  CertPropSvc - ok
22:40:10.0888 5076  [ d7cd5c4e1b71fa62050515314cfb52cf ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
22:40:10.0951 5076  circlass - ok
22:40:10.0982 5076  [ fe1ec06f2253f691fe36217c592a0206 ] CLFS            C:\Windows\system32\CLFS.sys
22:40:11.0013 5076  CLFS - ok
22:40:11.0107 5076  [ d88040f816fda31c3b466f0fa0918f29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:40:11.0122 5076  clr_optimization_v2.0.50727_32 - ok
22:40:11.0169 5076  [ d1ceea2b47cb998321c579651ce3e4f8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
22:40:11.0185 5076  clr_optimization_v2.0.50727_64 - ok
22:40:11.0263 5076  [ c5a75eb48e2344abdc162bda79e16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:40:11.0294 5076  clr_optimization_v4.0.30319_32 - ok
22:40:11.0356 5076  [ c6f9af94dcd58122a4d7e89db6bed29d ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
22:40:11.0372 5076  clr_optimization_v4.0.30319_64 - ok
22:40:11.0387 5076  [ 0840155d0bddf1190f84a663c284bd33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
22:40:11.0434 5076  CmBatt - ok
22:40:11.0481 5076  [ e19d3f095812725d88f9001985b94edd ] cmdide          C:\Windows\system32\DRIVERS\cmdide.sys
22:40:11.0512 5076  cmdide - ok
22:40:11.0575 5076  [ ca7720b73446fddec5c69519c1174c98 ] CNG            C:\Windows\system32\Drivers\cng.sys
22:40:11.0637 5076  CNG - ok
22:40:11.0668 5076  [ 102de219c3f61415f964c88e9085ad14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
22:40:11.0684 5076  Compbatt - ok
22:40:11.0699 5076  [ f26b3a86f6fa87ca360b879581ab4123 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
22:40:11.0746 5076  CompositeBus - ok
22:40:11.0777 5076  COMSysApp - ok
22:40:11.0793 5076  [ 1c827878a998c18847245fe1f34ee597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
22:40:11.0809 5076  crcdisk - ok
22:40:11.0887 5076  [ f02786b66375292e58c8777082d4396d ] CryptSvc        C:\Windows\system32\cryptsvc.dll
22:40:11.0949 5076  CryptSvc - ok
22:40:11.0996 5076  [ 7266972e86890e2b30c0c322e906b027 ] DcomLaunch      C:\Windows\system32\rpcss.dll
22:40:12.0089 5076  DcomLaunch - ok
22:40:12.0136 5076  [ 3cec7631a84943677aa8fa8ee5b6b43d ] defragsvc      C:\Windows\System32\defragsvc.dll
22:40:12.0199 5076  defragsvc - ok
22:40:12.0277 5076  [ 9c253ce7311ca60fc11c774692a13208 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
22:40:12.0308 5076  DfsC - ok
22:40:12.0370 5076  [ ce3b9562d997f69b330d181a8875960f ] Dhcp            C:\Windows\system32\dhcpcore.dll
22:40:12.0479 5076  Dhcp - ok
22:40:12.0511 5076  [ 13096b05847ec78f0977f2c0f79e9ab3 ] discache        C:\Windows\system32\drivers\discache.sys
22:40:12.0604 5076  discache - ok
22:40:12.0651 5076  [ 9819eee8b5ea3784ec4af3b137a5244c ] Disk            C:\Windows\system32\DRIVERS\disk.sys
22:40:12.0667 5076  Disk - ok
22:40:12.0729 5076  [ 85cf424c74a1d5ec33533e1dbff9920a ] Dnscache        C:\Windows\System32\dnsrslvr.dll
22:40:12.0807 5076  Dnscache - ok
22:40:12.0838 5076  [ 14452acdb09b70964c8c21bf80a13acb ] dot3svc        C:\Windows\System32\dot3svc.dll
22:40:12.0916 5076  dot3svc - ok
22:40:12.0947 5076  [ 8c2ba6bea949ee6e68385f5692bafb94 ] DPS            C:\Windows\system32\dps.dll
22:40:13.0041 5076  DPS - ok
22:40:13.0088 5076  [ 9b19f34400d24df84c858a421c205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
22:40:13.0119 5076  drmkaud - ok
22:40:13.0181 5076  [ 61e894fe1e9cc720c909e6e343351794 ] DsiWMIService  C:\Program Files (x86)\Launch Manager\dsiwmis.exe
22:40:13.0213 5076  DsiWMIService - ok
22:40:13.0291 5076  [ 24ce1ecf9d0ae0301775b07f5fea175b ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
22:40:13.0353 5076  DXGKrnl - ok
22:40:13.0369 5076  [ e2dda8726da9cb5b2c4000c9018a9633 ] EapHost        C:\Windows\System32\eapsvc.dll
22:40:13.0431 5076  EapHost - ok
22:40:13.0540 5076  [ dc5d737f51be844d8c82c695eb17372f ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
22:40:13.0696 5076  ebdrv - ok
22:40:13.0759 5076  [ 156f6159457d0aa7e59b62681b56eb90 ] EFS            C:\Windows\System32\lsass.exe
22:40:13.0821 5076  EFS - ok
22:40:13.0930 5076  [ 47c071994c3f649f23d9cd075ac9304a ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
22:40:14.0008 5076  ehRecvr - ok
22:40:14.0039 5076  [ 4705e8ef9934482c5bb488ce28afc681 ] ehSched        C:\Windows\ehome\ehsched.exe
22:40:14.0071 5076  ehSched - ok
22:40:14.0133 5076  [ 0e5da5369a0fcaea12456dd852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
22:40:14.0180 5076  elxstor - ok
22:40:14.0273 5076  [ 064f001bf07333f980ffb565dcf6dd3d ] ePowerSvc      C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
22:40:14.0320 5076  ePowerSvc - ok
22:40:14.0351 5076  [ 34a3c54752046e79a126e15c51db409b ] ErrDev          C:\Windows\system32\DRIVERS\errdev.sys
22:40:14.0398 5076  ErrDev - ok
22:40:14.0461 5076  [ 4166f82be4d24938977dd1746be9b8a0 ] EventSystem    C:\Windows\system32\es.dll
22:40:14.0554 5076  EventSystem - ok
22:40:14.0585 5076  [ a510c654ec00c1e9bdd91eeb3a59823b ] exfat          C:\Windows\system32\drivers\exfat.sys
22:40:14.0632 5076  exfat - ok
22:40:14.0663 5076  [ 0adc83218b66a6db380c330836f3e36d ] fastfat        C:\Windows\system32\drivers\fastfat.sys
22:40:14.0741 5076  fastfat - ok
22:40:14.0788 5076  [ d607b2f1bee3992aa6c2c92c0a2f0855 ] Fax            C:\Windows\system32\fxssvc.exe
22:40:14.0866 5076  Fax - ok
22:40:14.0897 5076  [ d765d19cd8ef61f650c384f62fac00ab ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
22:40:14.0944 5076  fdc - ok
22:40:14.0975 5076  [ 0438cab2e03f4fb61455a7956026fe86 ] fdPHost        C:\Windows\system32\fdPHost.dll
22:40:15.0053 5076  fdPHost - ok
22:40:15.0085 5076  [ 802496cb59a30349f9a6dd22d6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
22:40:15.0116 5076  FDResPub - ok
22:40:15.0147 5076  [ 655661be46b5f5f3fd454e2c3095b930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
22:40:15.0163 5076  FileInfo - ok
22:40:15.0194 5076  [ 5f671ab5bc87eea04ec38a6cd5962a47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
22:40:15.0272 5076  Filetrace - ok
22:40:15.0397 5076  [ 227846995afeefa70d328bf5334a86a5 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
22:40:15.0443 5076  FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
22:40:15.0443 5076  FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
22:40:15.0475 5076  [ c172a0f53008eaeb8ea33fe10e177af5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
22:40:15.0490 5076  flpydisk - ok
22:40:15.0537 5076  [ f7866af72abbaf84b1fa5aa195378c59 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
22:40:15.0568 5076  FltMgr - ok
22:40:15.0631 5076  [ bc00505cfda789ed3be95d2ff38c4875 ] FontCache      C:\Windows\system32\FntCache.dll
22:40:15.0740 5076  FontCache - ok
22:40:15.0802 5076  [ 8d89e3131c27fdd6932189cb785e1b7a ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
22:40:15.0818 5076  FontCache3.0.0.0 - ok
22:40:15.0833 5076  [ d43703496149971890703b4b1b723eac ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
22:40:15.0865 5076  FsDepends - ok
22:40:15.0911 5076  [ d3e3f93d67821a2db2b3d9fac2dc2064 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
22:40:15.0927 5076  Fs_Rec - ok
22:40:15.0974 5076  [ ae87ba80d0ec3b57126ed2cdc15b24ed ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
22:40:16.0005 5076  fvevol - ok
22:40:16.0052 5076  [ 8c778d335c9d272cfd3298ab02abe3b6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
22:40:16.0067 5076  gagp30kx - ok
22:40:16.0114 5076  [ fe5ab4525bc2ec68b9119a6e5d40128b ] gpsvc          C:\Windows\System32\gpsvc.dll
22:40:16.0177 5076  gpsvc - ok
22:40:16.0255 5076  [ 0191dee9b9eb7902af2cf4f67301095d ] GREGService    C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
22:40:16.0270 5076  GREGService - ok
22:40:16.0364 5076  [ f02a533f517eb38333cb12a9e8963773 ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
22:40:16.0379 5076  gupdate - ok
22:40:16.0411 5076  [ f02a533f517eb38333cb12a9e8963773 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
22:40:16.0426 5076  gupdatem - ok
22:40:16.0473 5076  [ 78fad9117e4527f2ca82259da10f40bd ] Hardlock        C:\Windows\system32\drivers\hardlock.sys
22:40:16.0520 5076  Hardlock - ok
22:40:16.0535 5076  hasplms - ok
22:40:16.0567 5076  [ f2523ef6460fc42405b12248338ab2f0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
22:40:16.0629 5076  hcw85cir - ok
22:40:16.0676 5076  [ 6410f6f415b2a5a9037224c41da8bf12 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
22:40:16.0723 5076  HdAudAddService - ok
22:40:16.0754 5076  [ 0a49913402747a0b67de940fb42cbdbb ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
22:40:16.0801 5076  HDAudBus - ok
22:40:16.0847 5076  [ b6ac71aaa2b10848f57fc49d55a651af ] HECIx64        C:\Windows\system32\DRIVERS\HECIx64.sys
22:40:16.0863 5076  HECIx64 - ok
22:40:16.0894 5076  [ 78e86380454a7b10a5eb255dc44a355f ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
22:40:16.0941 5076  HidBatt - ok
22:40:16.0988 5076  [ 7fd2a313f7afe5c4dab14798c48dd104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
22:40:17.0050 5076  HidBth - ok
22:40:17.0081 5076  [ 0a77d29f311b88cfae3b13f9c1a73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
22:40:17.0144 5076  HidIr - ok
22:40:17.0175 5076  [ bd9eb3958f213f96b97b1d897dee006d ] hidserv        C:\Windows\system32\hidserv.dll
22:40:17.0269 5076  hidserv - ok
22:40:17.0315 5076  [ b3bf6b5b50006def50b66306d99fcf6f ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
22:40:17.0362 5076  HidUsb - ok
22:40:17.0409 5076  [ efa58ede58dd74388ffd04cb32681518 ] hkmsvc          C:\Windows\system32\kmsvc.dll
22:40:17.0487 5076  hkmsvc - ok
22:40:17.0534 5076  [ 046b2673767ca626e2cfb7fdf735e9e8 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
22:40:17.0596 5076  HomeGroupListener - ok
22:40:17.0627 5076  [ 06a7422224d9865a5613710a089987df ] HomeGroupProvider C:\Windows\system32\provsvc.dll
22:40:17.0659 5076  HomeGroupProvider - ok
22:40:17.0737 5076  HOSTS Anti-PUPs - ok
22:40:17.0783 5076  [ 0886d440058f203eba0e1825e4355914 ] HpSAMD          C:\Windows\system32\DRIVERS\HpSAMD.sys
22:40:17.0799 5076  HpSAMD - ok
22:40:17.0846 5076  [ cee049cac4efa7f4e1e4ad014414a5d4 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
22:40:17.0924 5076  HTTP - ok
22:40:17.0939 5076  [ f17766a19145f111856378df337a5d79 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
22:40:17.0939 5076  hwpolicy - ok
22:40:17.0971 5076  [ fa55c73d4affa7ee23ac4be53b4592d3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
22:40:17.0986 5076  i8042prt - ok
22:40:18.0002 5076  [ abbf174cb394f5c437410a788b7e404a ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
22:40:18.0033 5076  iaStor - ok
22:40:18.0127 5076  [ 31a0e93cdf29007d6c6fffb632f375ed ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
22:40:18.0142 5076  IAStorDataMgrSvc - ok
22:40:18.0205 5076  [ b75e45c564e944a2657167d197ab29da ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
22:40:18.0267 5076  iaStorV - ok
22:40:18.0376 5076  [ 1cf03c69b49acb70c722df92755c0c8c ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
22:40:18.0376 5076  IDriverT ( UnsignedFile.Multi.Generic ) - warning
22:40:18.0376 5076  IDriverT - detected UnsignedFile.Multi.Generic (1)
22:40:18.0439 5076  [ 2f2be70d3e02b6fa877921ab9516d43c ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
22:40:18.0501 5076  idsvc - ok
22:40:18.0548 5076  [ 5c18831c61933628f5bb0ea2675b9d21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
22:40:18.0563 5076  iirsp - ok
22:40:18.0610 5076  [ c5b4683680df085b57bc53e5ef34861f ] IKEEXT          C:\Windows\System32\ikeext.dll
22:40:18.0719 5076  IKEEXT - ok
22:40:18.0766 5076  [ 36fdf367a1dabff903e2214023d71368 ] Impcd          C:\Windows\system32\DRIVERS\Impcd.sys
22:40:18.0797 5076  Impcd - ok
22:40:18.0891 5076  [ 06b774e74f7e2b8ae903a70c45a03d61 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
22:40:19.0000 5076  IntcAzAudAddService - ok
22:40:19.0031 5076  [ f00f20e70c6ec3aa366910083a0518aa ] intelide        C:\Windows\system32\DRIVERS\intelide.sys
22:40:19.0031 5076  intelide - ok
22:40:19.0265 5076  [ 09ce164afa8483e41808784d7fca154e ] intelkmd        C:\Windows\system32\DRIVERS\igdpmd64.sys
22:40:19.0640 5076  intelkmd - ok
22:40:19.0671 5076  [ ada036632c664caa754079041cf1f8c1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
22:40:19.0702 5076  intelppm - ok
22:40:19.0749 5076  [ 098a91c54546a3b878dad6a7e90a455b ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
22:40:19.0827 5076  IPBusEnum - ok
22:40:19.0858 5076  [ 722dd294df62483cecaae6e094b4d695 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:40:19.0921 5076  IpFilterDriver - ok
22:40:19.0936 5076  [ e2b4a4494db7cb9b89b55ca268c337c5 ] IPMIDRV        C:\Windows\system32\DRIVERS\IPMIDrv.sys
22:40:19.0983 5076  IPMIDRV - ok
22:40:20.0045 5076  [ af9b39a7e7b6caa203b3862582e9f2d0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
22:40:20.0139 5076  IPNAT - ok
22:40:20.0155 5076  [ 3abf5e7213eb28966d55d58b515d5ce9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
22:40:20.0186 5076  IRENUM - ok
22:40:20.0201 5076  [ 2f7b28dc3e1183e5eb418df55c204f38 ] isapnp          C:\Windows\system32\DRIVERS\isapnp.sys
22:40:20.0201 5076  isapnp - ok
22:40:20.0217 5076  [ fa4d2557de56d45b0a346f93564be6e1 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
22:40:20.0248 5076  iScsiPrt - ok
22:40:20.0264 5076  [ bc02336f1cba7dcc7d1213bb588a68a5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
22:40:20.0295 5076  kbdclass - ok
22:40:20.0311 5076  [ 6def98f8541e1b5dceb2c822a11f7323 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
22:40:20.0357 5076  kbdhid - ok
22:40:20.0389 5076  [ 156f6159457d0aa7e59b62681b56eb90 ] KeyIso          C:\Windows\system32\lsass.exe
22:40:20.0404 5076  KeyIso - ok
22:40:20.0467 5076  [ 07071c1e3cd8f0f9114aac8b072ca1e5 ] KMWDFILTER      C:\Windows\system32\DRIVERS\KMWDFILTER.sys
22:40:20.0482 5076  KMWDFILTER - ok
22:40:20.0529 5076  [ 4f4b5fde429416877de7143044582eb5 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
22:40:20.0545 5076  KSecDD - ok
22:40:20.0560 5076  [ 6f40465a44ecdc1731befafec5bdd03c ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
22:40:20.0576 5076  KSecPkg - ok
22:40:20.0607 5076  [ 6869281e78cb31a43e969f06b57347c4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
22:40:20.0701 5076  ksthunk - ok
22:40:20.0747 5076  [ 6ab66e16aa859232f64deb66887a8c9c ] KtmRm          C:\Windows\system32\msdtckrm.dll
22:40:20.0841 5076  KtmRm - ok
22:40:20.0903 5076  [ 39918db0efcf045a1ce6fabbf339f975 ] L1C            C:\Windows\system32\DRIVERS\L1C62x64.sys
22:40:20.0919 5076  L1C - ok
22:40:20.0997 5076  [ 81f1d04d4d0e433099365127375fd501 ] LanmanServer    C:\Windows\system32\srvsvc.dll
22:40:21.0044 5076  LanmanServer - ok
22:40:21.0075 5076  [ 27026eac8818e8a6c00a1cad2f11d29a ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
22:40:21.0153 5076  LanmanWorkstation - ok
22:40:21.0200 5076  [ 1538831cf8ad2979a04c423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
22:40:21.0293 5076  lltdio - ok
22:40:21.0340 5076  [ c1185803384ab3feed115f79f109427f ] lltdsvc        C:\Windows\System32\lltdsvc.dll
22:40:21.0403 5076  lltdsvc - ok
22:40:21.0449 5076  [ f993a32249b66c9d622ea5592a8b76b8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
22:40:21.0512 5076  lmhosts - ok
22:40:21.0574 5076  [ a1c148801b4af64847aeb9f3ad9594ef ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
22:40:21.0605 5076  LMS ( UnsignedFile.Multi.Generic ) - warning
22:40:21.0605 5076  LMS - detected UnsignedFile.Multi.Generic (1)
22:40:21.0637 5076  [ 1a93e54eb0ece102495a51266dcdb6a6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
22:40:21.0668 5076  LSI_FC - ok
22:40:21.0683 5076  [ 1047184a9fdc8bdbff857175875ee810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
22:40:21.0699 5076  LSI_SAS - ok
22:40:21.0715 5076  [ 30f5c0de1ee8b5bc9306c1f0e4a75f93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
22:40:21.0746 5076  LSI_SAS2 - ok
22:40:21.0746 5076  [ 0504eacaff0d3c8aed161c4b0d369d4a ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
22:40:21.0777 5076  LSI_SCSI - ok
22:40:21.0793 5076  [ 43d0f98e1d56ccddb0d5254cff7b356e ] luafv          C:\Windows\system32\drivers\luafv.sys
22:40:21.0886 5076  luafv - ok
22:40:21.0980 5076  [ 23488767cb18fc3ff39e3af1db3fb02c ] massfilter      C:\Windows\system32\drivers\massfilter.sys
22:40:22.0011 5076  massfilter - ok
22:40:22.0058 5076  [ f84c8f1000bc11e3b7b23cbd3baff111 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
22:40:22.0105 5076  Mcx2Svc - ok
22:40:22.0136 5076  [ a55805f747c6edb6a9080d7c633bd0f4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
22:40:22.0151 5076  megasas - ok
22:40:22.0183 5076  [ baf74ce0072480c3b6b7c13b2a94d6b3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
22:40:22.0214 5076  MegaSR - ok
22:40:22.0229 5076  [ e40e80d0304a73e8d269f7141d77250b ] MMCSS          C:\Windows\system32\mmcss.dll
22:40:22.0323 5076  MMCSS - ok
22:40:22.0354 5076  [ 800ba92f7010378b09f9ed9270f07137 ] Modem          C:\Windows\system32\drivers\modem.sys
22:40:22.0385 5076  Modem - ok
22:40:22.0432 5076  [ b03d591dc7da45ece20b3b467e6aadaa ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
22:40:22.0479 5076  monitor - ok
22:40:22.0510 5076  [ 7d27ea49f3c1f687d357e77a470aea99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
22:40:22.0526 5076  mouclass - ok
22:40:22.0557 5076  [ d3bf052c40b0c4166d9fd86a4288c1e6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
22:40:22.0604 5076  mouhid - ok
22:40:22.0635 5076  [ 791af66c4d0e7c90a3646066386fb571 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
22:40:22.0651 5076  mountmgr - ok
22:40:22.0760 5076  [ 46297fa8e30a6007f14118fc2b942fbc ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
22:40:22.0775 5076  MozillaMaintenance - ok
22:40:22.0807 5076  [ 609d1d87649ecc19796f4d76d4c15cea ] mpio            C:\Windows\system32\DRIVERS\mpio.sys
22:40:22.0838 5076  mpio - ok
22:40:22.0853 5076  [ 6c38c9e45ae0ea2fa5e551f2ed5e978f ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
22:40:22.0916 5076  mpsdrv - ok
22:40:22.0931 5076  [ 30524261bb51d96d6fcbac20c810183c ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
22:40:22.0978 5076  MRxDAV - ok
22:40:23.0025 5076  [ 040d62a9d8ad28922632137acdd984f2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
22:40:23.0041 5076  mrxsmb - ok
22:40:23.0103 5076  [ f0067552f8f9b33d7c59403ab808a3cb ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:40:23.0134 5076  mrxsmb10 - ok
22:40:23.0165 5076  [ 3c142d31de9f2f193218a53fe2632051 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:40:23.0212 5076  mrxsmb20 - ok
22:40:23.0259 5076  [ 5c37497276e3b3a5488b23a326a754b7 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys
22:40:23.0290 5076  msahci - ok
22:40:23.0290 5076  [ 8d27b597229aed79430fb9db3bcbfbd0 ] msdsm          C:\Windows\system32\DRIVERS\msdsm.sys
22:40:23.0321 5076  msdsm - ok
22:40:23.0337 5076  [ de0ece52236cfa3ed2dbfc03f28253a8 ] MSDTC          C:\Windows\System32\msdtc.exe
22:40:23.0384 5076  MSDTC - ok
22:40:23.0431 5076  [ aa3fb40e17ce1388fa1bedab50ea8f96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
22:40:23.0493 5076  Msfs - ok
22:40:23.0509 5076  [ f9d215a46a8b9753f61767fa72a20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
22:40:23.0555 5076  mshidkmdf - ok
22:40:23.0555 5076  [ d916874bbd4f8b07bfb7fa9b3ccae29d ] msisadrv        C:\Windows\system32\DRIVERS\msisadrv.sys
22:40:23.0571 5076  msisadrv - ok
22:40:23.0602 5076  [ 808e98ff49b155c522e6400953177b08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
22:40:23.0633 5076  MSiSCSI - ok
22:40:23.0633 5076  msiserver - ok
22:40:23.0696 5076  [ 49ccf2c4fea34ffad8b1b59d49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
22:40:23.0743 5076  MSKSSRV - ok
22:40:23.0774 5076  [ bdd71ace35a232104ddd349ee70e1ab3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
22:40:23.0852 5076  MSPCLOCK - ok
22:40:23.0883 5076  [ 4ed981241db27c3383d72092b618a1d0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
22:40:23.0961 5076  MSPQM - ok
22:40:23.0992 5076  [ 89cb141aa8616d8c6a4610fa26c60964 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
22:40:24.0023 5076  MsRPC - ok
22:40:24.0039 5076  [ 0eed230e37515a0eaee3c2e1bc97b288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
22:40:24.0055 5076  mssmbios - ok
22:40:24.0086 5076  [ 2e66f9ecb30b4221a318c92ac2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
22:40:24.0164 5076  MSTEE - ok
22:40:24.0195 5076  [ 7ea404308934e675bffde8edf0757bcd ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
22:40:24.0242 5076  MTConfig - ok
22:40:24.0273 5076  [ f9a18612fd3526fe473c1bda678d61c8 ] Mup            C:\Windows\system32\Drivers\mup.sys
22:40:24.0304 5076  Mup - ok
22:40:24.0335 5076  [ 6ffecc25b39dc7652a0cec0ada9db589 ] mwlPSDFilter    C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
22:40:24.0351 5076  mwlPSDFilter - ok
22:40:24.0351 5076  [ 0befe32ca56d6ee89d58175725596a85 ] mwlPSDNServ    C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
22:40:24.0367 5076  mwlPSDNServ - ok
22:40:24.0382 5076  [ d43bc633b8660463e446e28e14a51262 ] mwlPSDVDisk    C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
22:40:24.0398 5076  mwlPSDVDisk - ok
22:40:24.0491 5076  [ 0036634e5c92be109056f7e2380103a9 ] MWLService      C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
22:40:24.0507 5076  MWLService - ok
22:40:24.0538 5076  [ 4987e079a4530fa737a128be54b63b12 ] napagent        C:\Windows\system32\qagentRT.dll
22:40:24.0632 5076  napagent - ok
22:40:24.0694 5076  [ 1ea3749c4114db3e3161156ffffa6b33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
22:40:24.0757 5076  NativeWifiP - ok
22:40:24.0819 5076  [ cad515dbd07d082bb317d9928ce8962c ] NDIS            C:\Windows\system32\drivers\ndis.sys
22:40:24.0897 5076  NDIS - ok
22:40:24.0913 5076  [ 9f9a1f53aad7da4d6fef5bb73ab811ac ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
22:40:24.0991 5076  NdisCap - ok
22:40:25.0053 5076  [ 30639c932d9fef22b31268fe25a1b6e5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
22:40:25.0131 5076  NdisTapi - ok
22:40:25.0178 5076  [ f105ba1e22bf1f2ee8f005d4305e4bec ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
22:40:25.0256 5076  Ndisuio - ok
22:40:25.0287 5076  [ 557dfab9ca1fcb036ac77564c010dad3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
22:40:25.0334 5076  NdisWan - ok
22:40:25.0365 5076  [ 659b74fb74b86228d6338d643cd3e3cf ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
22:40:25.0427 5076  NDProxy - ok
22:40:25.0459 5076  [ 86743d9f5d2b1048062b14b1d84501c4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
22:40:25.0521 5076  NetBIOS - ok
22:40:25.0568 5076  [ 9162b273a44ab9dce5b44362731d062a ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
22:40:25.0646 5076  NetBT - ok
22:40:25.0661 5076  [ 156f6159457d0aa7e59b62681b56eb90 ] Netlogon        C:\Windows\system32\lsass.exe
22:40:25.0677 5076  Netlogon - ok
22:40:25.0724 5076  [ 847d3ae376c0817161a14a82c8922a9e ] Netman          C:\Windows\System32\netman.dll
22:40:25.0786 5076  Netman - ok
22:40:25.0786 5076  [ 5f28111c648f1e24f7dbc87cdeb091b8 ] netprofm        C:\Windows\System32\netprofm.dll
22:40:25.0880 5076  netprofm - ok
22:40:25.0911 5076  [ 3e5a36127e201ddf663176b66828fafe ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:40:25.0927 5076  NetTcpPortSharing - ok
22:40:26.0129 5076  [ 24f64343f14a119308456e1ca7507b26 ] NETw5s64        C:\Windows\system32\DRIVERS\NETw5s64.sys
22:40:26.0395 5076  NETw5s64 - ok
22:40:26.0457 5076  [ 77889813be4d166cdab78ddba990da92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
22:40:26.0473 5076  nfrd960 - ok
22:40:26.0519 5076  [ d9a0ce66046d6efa0c61baa885cba0a8 ] NlaSvc          C:\Windows\System32\nlasvc.dll
22:40:26.0613 5076  NlaSvc - ok
22:40:26.0629 5076  [ 1e4c4ab5c9b8dd13179bbdc75a2a01f7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
22:40:26.0707 5076  Npfs - ok
22:40:26.0738 5076  [ d54bfdf3e0c953f823b3d0bfe4732528 ] nsi            C:\Windows\system32\nsisvc.dll
22:40:26.0847 5076  nsi - ok
22:40:26.0878 5076  [ e7f5ae18af4168178a642a9247c63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
22:40:26.0941 5076  nsiproxy - ok
22:40:27.0034 5076  [ 378e0e0dfea67d98ae6ea53adbbd76bc ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
22:40:27.0143 5076  Ntfs - ok
22:40:27.0206 5076  [ 5b3ce960c62dbe864be9a0bd043a3e30 ] NTI IScheduleSvc C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
22:40:27.0253 5076  NTI IScheduleSvc ( UnsignedFile.Multi.Generic ) - warning
22:40:27.0253 5076  NTI IScheduleSvc - detected UnsignedFile.Multi.Generic (1)
22:40:27.0331 5076  [ 15221dd637d9d0ffc60848ebbf1df538 ] NTIBackupSvc    C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
22:40:27.0346 5076  NTIBackupSvc - ok
22:40:27.0377 5076  [ 64ddd0dee976302f4bd93e5efcc2f013 ] NTIDrvr        C:\Windows\system32\drivers\NTIDrvr.sys
22:40:27.0393 5076  NTIDrvr - ok
22:40:27.0424 5076  [ b5071e15d4c3f5ef5018aff7e85a85e5 ] NTISchedulerSvc C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
22:40:27.0440 5076  NTISchedulerSvc - ok
22:40:27.0471 5076  [ 9899284589f75fa8724ff3d16aed75c1 ] Null            C:\Windows\system32\drivers\Null.sys
22:40:27.0565 5076  Null - ok
22:40:27.0596 5076  [ a4d9c9a608a97f59307c2f2600edc6a4 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
22:40:27.0611 5076  nvraid - ok
22:40:27.0689 5076  [ 6c1d5f70e7a6a3fd1c90d840edc048b9 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
22:40:27.0705 5076  nvstor - ok
22:40:27.0752 5076  [ 270d7cd42d6e3979f6dd0146650f0e05 ] nv_agp          C:\Windows\system32\DRIVERS\nv_agp.sys
22:40:27.0783 5076  nv_agp - ok
22:40:27.0845 5076  [ ba7dac1b8a86d9402c3e04e1fcaa600d ] ODDPwrSvc      C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
22:40:27.0861 5076  ODDPwrSvc - ok
22:40:27.0892 5076  [ 3589478e4b22ce21b41fa1bfc0b8b8a0 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
22:40:27.0939 5076  ohci1394 - ok
22:40:28.0033 5076  [ daf5d6b1696d42140839cd557336efc8 ] OXSDIDRV_x64    C:\Windows\system32\DRIVERS\OXSDIDRV_x64.sys
22:40:28.0048 5076  OXSDIDRV_x64 - ok
22:40:28.0095 5076  [ 3eac4455472cc2c97107b5291e0dcafe ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
22:40:28.0157 5076  p2pimsvc - ok
22:40:28.0204 5076  [ 927463ecb02179f88e4b9a17568c63c3 ] p2psvc          C:\Windows\system32\p2psvc.dll
22:40:28.0235 5076  p2psvc - ok
22:40:28.0267 5076  [ 0086431c29c35be1dbc43f52cc273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
22:40:28.0298 5076  Parport - ok
22:40:28.0360 5076  [ 90061b1acfe8ccaa5345750ffe08d8b8 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
22:40:28.0376 5076  partmgr - ok
22:40:28.0391 5076  [ 3aeaa8b561e63452c655dc0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
22:40:28.0454 5076  PcaSvc - ok
22:40:28.0469 5076  [ f36f6504009f2fb0dfd1b17a116ad74b ] pci            C:\Windows\system32\DRIVERS\pci.sys
22:40:28.0501 5076  pci - ok
22:40:28.0516 5076  [ b5b8b5ef2e5cb34df8dcf8831e3534fa ] pciide          C:\Windows\system32\DRIVERS\pciide.sys
22:40:28.0532 5076  pciide - ok
22:40:28.0532 5076  [ b2e81d4e87ce48589f98cb8c05b01f2f ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
22:40:28.0563 5076  pcmcia - ok
22:40:28.0579 5076  [ d6b9c2e1a11a3a4b26a182ffef18f603 ] pcw            C:\Windows\system32\drivers\pcw.sys
22:40:28.0594 5076  pcw - ok
22:40:28.0610 5076  [ 68769c3356b3be5d1c732c97b9a80d6e ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
22:40:28.0688 5076  PEAUTH - ok
22:40:28.0813 5076  [ e495e408c93141e8fc72dc0c6046ddfa ] PerfHost        C:\Windows\SysWow64\perfhost.exe
22:40:28.0859 5076  PerfHost - ok
22:40:28.0922 5076  [ 557e9a86f65f0de18c9b6751dfe9d3f1 ] pla            C:\Windows\system32\pla.dll
22:40:29.0047 5076  pla - ok
22:40:29.0140 5076  [ 98b1721b8718164293b9701b98c52d77 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
22:40:29.0171 5076  PlugPlay - ok
22:40:29.0187 5076  [ 7195581cec9bb7d12abe54036acc2e38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
22:40:29.0234 5076  PNRPAutoReg - ok
22:40:29.0265 5076  [ 3eac4455472cc2c97107b5291e0dcafe ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
22:40:29.0296 5076  PNRPsvc - ok
22:40:29.0343 5076  [ 166eb40d1f5b47e615de3d0fffe5f243 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
22:40:29.0421 5076  PolicyAgent - ok
22:40:29.0468 5076  [ 6ba9d927dded70bd1a9caded45f8b184 ] Power          C:\Windows\system32\umpo.dll
22:40:29.0515 5076  Power - ok
22:40:29.0546 5076  [ 27cc19e81ba5e3403c48302127bda717 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
22:40:29.0624 5076  PptpMiniport - ok
22:40:29.0655 5076  [ 0d922e23c041efb1c3fac2a6f943c9bf ] Processor      C:\Windows\system32\DRIVERS\processr.sys
22:40:29.0702 5076  Processor - ok
22:40:29.0749 5076  [ 97293447431311c06703368ad0f6c4be ] ProfSvc        C:\Windows\system32\profsvc.dll
22:40:29.0811 5076  ProfSvc - ok
22:40:29.0827 5076  [ 156f6159457d0aa7e59b62681b56eb90 ] ProtectedStorage C:\Windows\system32\lsass.exe
22:40:29.0842 5076  ProtectedStorage - ok
22:40:29.0873 5076  [ ee992183bd8eaefd9973f352e587a299 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
22:40:29.0951 5076  Psched - ok
22:40:30.0029 5076  [ a53a15a11ebfd21077463ee2c7afeef0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
22:40:30.0123 5076  ql2300 - ok
22:40:30.0139 5076  [ 4f6d12b51de1aaeff7dc58c4d75423c8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
22:40:30.0154 5076  ql40xx - ok
22:40:30.0201 5076  [ 906191634e99aea92c4816150bda3732 ] QWAVE          C:\Windows\system32\qwave.dll
22:40:30.0232 5076  QWAVE - ok
22:40:30.0263 5076  [ 76707bb36430888d9ce9d705398adb6c ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
22:40:30.0310 5076  QWAVEdrv - ok
22:40:30.0341 5076  [ 5a0da8ad5762fa2d91678a8a01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
22:40:30.0388 5076  RasAcd - ok
22:40:30.0419 5076  [ 7ecff9b22276b73f43a99a15a6094e90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
22:40:30.0466 5076  RasAgileVpn - ok
22:40:30.0482 5076  [ 8f26510c5383b8dbe976de1cd00fc8c7 ] RasAuto        C:\Windows\System32\rasauto.dll
22:40:30.0529 5076  RasAuto - ok
22:40:30.0560 5076  [ 87a6e852a22991580d6d39adc4790463 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
22:40:30.0638 5076  Rasl2tp - ok
22:40:30.0700 5076  [ 47394ed3d16d053f5906efe5ab51cc83 ] RasMan          C:\Windows\System32\rasmans.dll
22:40:30.0794 5076  RasMan - ok
22:40:30.0825 5076  [ 855c9b1cd4756c5e9a2aa58a15f58c25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
22:40:30.0919 5076  RasPppoe - ok
22:40:30.0950 5076  [ e8b1e447b008d07ff47d016c2b0eeecb ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
22:40:31.0028 5076  RasSstp - ok
22:40:31.0059 5076  [ 3bac8142102c15d59a87757c1d41dce5 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
22:40:31.0153 5076  rdbss - ok
22:40:31.0184 5076  [ 302da2a0539f2cf54d7c6cc30c1f2d8d ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
22:40:31.0215 5076  rdpbus - ok
22:40:31.0246 5076  [ cea6cc257fc9b7715f1c2b4849286d24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
22:40:31.0309 5076  RDPCDD - ok
22:40:31.0309 5076  [ bb5971a4f00659529a5c44831af22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
22:40:31.0387 5076  RDPENCDD - ok
22:40:31.0418 5076  [ 216f3fa57533d98e1f74ded70113177a ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
22:40:31.0449 5076  RDPREFMP - ok
22:40:31.0496 5076  [ 447de7e3dea39d422c1504f245b668b1 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
22:40:31.0558 5076  RDPWD - ok
22:40:31.0589 5076  [ 634b9a2181d98f15941236886164ec8b ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
22:40:31.0621 5076  rdyboost - ok
22:40:31.0652 5076  [ 254fb7a22d74e5511c73a3f6d802f192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
22:40:31.0714 5076  RemoteAccess - ok
22:40:31.0745 5076  [ e4d94f24081440b5fc5aa556c7c62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
22:40:31.0839 5076  RemoteRegistry - ok
22:40:31.0901 5076  [ 3dd798846e2c28102b922c56e71b7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
22:40:31.0948 5076  RFCOMM - ok
22:40:32.0011 5076  [ f12a68ed55053940cadd59ca5e3468dd ] RichVideo      C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
22:40:32.0042 5076  RichVideo ( UnsignedFile.Multi.Generic ) - warning
22:40:32.0042 5076  RichVideo - detected UnsignedFile.Multi.Generic (1)
22:40:32.0073 5076  [ e4dc58cf7b3ea515ae917ff0d402a7bb ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
22:40:32.0151 5076  RpcEptMapper - ok
22:40:32.0182 5076  [ d5ba242d4cf8e384db90e6a8ed850b8c ] RpcLocator      C:\Windows\system32\locator.exe
22:40:32.0198 5076  RpcLocator - ok
22:40:32.0213 5076  [ 7266972e86890e2b30c0c322e906b027 ] RpcSs          C:\Windows\system32\rpcss.dll
22:40:32.0260 5076  RpcSs - ok
22:40:32.0276 5076  [ ddc86e4f8e7456261e637e3552e804ff ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
22:40:32.0369 5076  rspndr - ok
22:40:32.0447 5076  [ 7cb9f0fdd730f4a4ecf6cde15ea12e8a ] RS_Service      C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
22:40:32.0479 5076  RS_Service - ok
22:40:32.0494 5076  [ 156f6159457d0aa7e59b62681b56eb90 ] SamSs          C:\Windows\system32\lsass.exe
22:40:32.0510 5076  SamSs - ok
22:40:32.0525 5076  [ e3bbb89983daf5622c1d50cf49f28227 ] sbp2port        C:\Windows\system32\DRIVERS\sbp2port.sys
22:40:32.0557 5076  sbp2port - ok
22:40:32.0572 5076  [ 9b7395789e3791a3b6d000fe6f8b131e ] SCardSvr        C:\Windows\System32\SCardSvr.dll
22:40:32.0635 5076  SCardSvr - ok
22:40:32.0681 5076  [ c94da20c7e3ba1dca269bc8460d98387 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
22:40:32.0759 5076  scfilter - ok
22:40:32.0837 5076  [ 624d0f5ff99428bb90a5b8a4123e918e ] Schedule        C:\Windows\system32\schedsvc.dll
22:40:32.0947 5076  Schedule - ok
22:40:32.0978 5076  [ 312e2f82af11e79906898ac3e3d58a1f ] SCPolicySvc    C:\Windows\System32\certprop.dll
22:40:33.0025 5076  SCPolicySvc - ok
22:40:33.0071 5076  [ 765a27c3279ce11d14cb9e4f5869fca5 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
22:40:33.0134 5076  SDRSVC - ok
22:40:33.0165 5076  [ 3ea8a16169c26afbeb544e0e48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
22:40:33.0243 5076  secdrv - ok
22:40:33.0274 5076  [ 463b386ebc70f98da5dff85f7e654346 ] seclogon        C:\Windows\system32\seclogon.dll
22:40:33.0337 5076  seclogon - ok
22:40:33.0383 5076  [ c32ab8fa018ef34c0f113bd501436d21 ] SENS            C:\Windows\System32\sens.dll
22:40:33.0446 5076  SENS - ok
22:40:33.0461 5076  [ 0336cffafaab87a11541f1cf1594b2b2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
22:40:33.0524 5076  SensrSvc - ok
22:40:33.0555 5076  [ cb624c0035412af0debec78c41f5ca1b ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
22:40:33.0571 5076  Serenum - ok
22:40:33.0602 5076  [ c1d8e28b2c2adfaec4ba89e9fda69bd6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
22:40:33.0649 5076  Serial - ok
22:40:33.0680 5076  [ 1c545a7d0691cc4a027396535691c3e3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
22:40:33.0711 5076  sermouse - ok
22:40:33.0758 5076  [ c3bc61ce47ff6f4e88ab8a3b429a36af ] SessionEnv      C:\Windows\system32\sessenv.dll
22:40:33.0805 5076  SessionEnv - ok
22:40:33.0836 5076  [ a554811bcd09279536440c964ae35bbf ] sffdisk        C:\Windows\system32\DRIVERS\sffdisk.sys
22:40:33.0883 5076  sffdisk - ok
22:40:33.0914 5076  [ ff414f0baefeba59bc6c04b3db0b87bf ] sffp_mmc        C:\Windows\system32\DRIVERS\sffp_mmc.sys
22:40:33.0961 5076  sffp_mmc - ok
22:40:33.0992 5076  [ 5588b8c6193eb1522490c122eb94dffa ] sffp_sd        C:\Windows\system32\DRIVERS\sffp_sd.sys
22:40:34.0007 5076  sffp_sd - ok
22:40:34.0023 5076  [ a9d601643a1647211a1ee2ec4e433ff4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
22:40:34.0054 5076  sfloppy - ok
22:40:34.0101 5076  [ 0298ac45d0efffb2db4baa7dd186e7bf ] ShellHWDetection C:\Windows\System32\shsvcs.dll
22:40:34.0163 5076  ShellHWDetection - ok
22:40:34.0210 5076  [ 843caf1e5fde1ffd5ff768f23a51e2e1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
22:40:34.0226 5076  SiSRaid2 - ok
22:40:34.0226 5076  [ 6a6c106d42e9ffff8b9fcb4f754f6da4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
22:40:34.0257 5076  SiSRaid4 - ok
22:40:34.0273 5076  [ 548260a7b8654e024dc30bf8a7c5baa4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
22:40:34.0351 5076  Smb - ok
22:40:34.0413 5076  [ 6313f223e817cc09aa41811daa7f541d ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
22:40:34.0460 5076  SNMPTRAP - ok
22:40:34.0569 5076  [ 4945020bc094c322571184a6e8056b3a ] SolidWorks Licensing Service C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
22:40:34.0600 5076  SolidWorks Licensing Service ( UnsignedFile.Multi.Generic ) - warning
22:40:34.0600 5076  SolidWorks Licensing Service - detected UnsignedFile.Multi.Generic (1)
22:40:34.0616 5076  [ b9e31e5cacdfe584f34f730a677803f9 ] spldr          C:\Windows\system32\drivers\spldr.sys
22:40:34.0631 5076  spldr - ok
22:40:34.0709 5076  [ 567977dc43cc13c4c35ed7084c0b84d5 ] Spooler        C:\Windows\System32\spoolsv.exe
22:40:34.0756 5076  Spooler - ok
22:40:34.0850 5076  [ 913d843498553a1bc8f8dbad6358e49f ] sppsvc          C:\Windows\system32\sppsvc.exe
22:40:34.0990 5076  sppsvc - ok
22:40:35.0021 5076  [ 93d7d61317f3d4bc4f4e9f8a96a7de45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
22:40:35.0084 5076  sppuinotify - ok
22:40:35.0146 5076  [ 2408c0366d96bcdf63e8f1c78e4a29c5 ] srv            C:\Windows\system32\DRIVERS\srv.sys
22:40:35.0224 5076  srv - ok
22:40:35.0240 5076  [ 76548f7b818881b47d8d1ae1be9c11f8 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
22:40:35.0287 5076  srv2 - ok
22:40:35.0349 5076  [ 0af6e19d39c70844c5caa8fb0183c36e ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
22:40:35.0380 5076  srvnet - ok
22:40:35.0443 5076  [ 51b52fbd583cde8aa9ba62b8b4298f33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
22:40:35.0536 5076  SSDPSRV - ok
22:40:35.0552 5076  [ ab7aebf58dad8daab7a6c45e6a8885cb ] SstpSvc        C:\Windows\system32\sstpsvc.dll
22:40:35.0599 5076  SstpSvc - ok
22:40:35.0630 5076  [ f3817967ed533d08327dc73bc4d5542a ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
22:40:35.0630 5076  stexstor - ok
22:40:35.0661 5076  [ 52d0e33b681bd0f33fdc08812fee4f7d ] stisvc          C:\Windows\System32\wiaservc.dll
22:40:35.0708 5076  stisvc - ok
22:40:35.0723 5076  [ d01ec09b6711a5f8e7e6564a4d0fbc90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
22:40:35.0739 5076  swenum - ok
22:40:35.0770 5076  [ e08e46fdd841b7184194011ca1955a0b ] swprv          C:\Windows\System32\swprv.dll
22:40:35.0833 5076  swprv - ok
22:40:35.0879 5076  [ ed6d1424e5b0c21a57b28dd8508d6843 ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
22:40:35.0911 5076  SynTP - ok
22:40:35.0957 5076  [ 3c1284516a62078fb68f768de4f1a7be ] SysMain        C:\Windows\system32\sysmain.dll
22:40:36.0082 5076  SysMain - ok
22:40:36.0160 5076  [ 140afc0a32ef1da0f5d14ba79ef179ee ] ta2avs          C:\Windows\system32\Drivers\ta2avs.sys
22:40:36.0191 5076  ta2avs - ok
22:40:36.0269 5076  [ c344ade71831237f77b955bdc187fbcb ] ta2usb_svc      C:\Windows\system32\Drivers\ta2usb.sys
22:40:36.0285 5076  ta2usb_svc - ok
22:40:36.0316 5076  [ 238935c3cf2854886dc7cbb2a0e2cc66 ] TabletInputService C:\Windows\System32\TabSvc.dll
22:40:36.0363 5076  TabletInputService - ok
22:40:36.0394 5076  [ 884264ac597b690c5707c89723bb8e7b ] TapiSrv        C:\Windows\System32\tapisrv.dll
22:40:36.0457 5076  TapiSrv - ok
22:40:36.0472 5076  [ 1be03ac720f4d302ea01d40f588162f6 ] TBS            C:\Windows\System32\tbssvc.dll
22:40:36.0519 5076  TBS - ok
22:40:36.0613 5076  [ 624c5b3aa4c99b3184bb922d9ece3ff0 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
22:40:36.0706 5076  Tcpip - ok
22:40:36.0737 5076  [ 624c5b3aa4c99b3184bb922d9ece3ff0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
22:40:36.0784 5076  TCPIP6 - ok
22:40:36.0815 5076  [ 76d078af6f587b162d50210f761eb9ed ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
22:40:36.0862 5076  tcpipreg - ok
22:40:36.0878 5076  [ 3371d21011695b16333a3934340c4e7c ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
22:40:36.0925 5076  TDPIPE - ok
22:40:36.0987 5076  [ 7518f7bcfd4b308abc9192bacaf6c970 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
22:40:37.0049 5076  TDTCP - ok
22:40:37.0081 5076  [ 079125c4b17b01fcaeebce0bcb290c0f ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
22:40:37.0143 5076  tdx - ok
22:40:37.0190 5076  [ c448651339196c0e869a355171875522 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
22:40:37.0205 5076  TermDD - ok
22:40:37.0237 5076  [ 0f05ec2887bfe197ad82a13287d2f404 ] TermService    C:\Windows\System32\termsrv.dll
22:40:37.0330 5076  TermService - ok
22:40:37.0346 5076  [ f0344071948d1a1fa732231785a0664c ] Themes          C:\Windows\system32\themeservice.dll
22:40:37.0377 5076  Themes - ok
22:40:37.0408 5076  [ e40e80d0304a73e8d269f7141d77250b ] THREADORDER    C:\Windows\system32\mmcss.dll
22:40:37.0455 5076  THREADORDER - ok
22:40:37.0517 5076  TPkd - ok
22:40:37.0549 5076  [ 7e7afd841694f6ac397e99d75cead49d ] TrkWks          C:\Windows\System32\trkwks.dll
22:40:37.0642 5076  TrkWks - ok
22:40:37.0705 5076  [ 840f7fb849f5887a49ba18c13b2da920 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
22:40:37.0767 5076  TrustedInstaller - ok
22:40:37.0798 5076  [ 61b96c26131e37b24e93327a0bd1fb95 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
22:40:37.0876 5076  tssecsrv - ok
22:40:37.0907 5076  [ 3836171a2cdf3af8ef10856db9835a70 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
22:40:37.0985 5076  tunnel - ok
22:40:38.0017 5076  [ b4dd609bd7e282bfc683cec7eaaaad67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
22:40:38.0032 5076  uagp35 - ok
22:40:38.0063 5076  [ 2e22c1fd397a5a9ffef55e9d1fc96c00 ] UBHelper        C:\Windows\system32\drivers\UBHelper.sys
22:40:38.0079 5076  UBHelper - ok
22:40:38.0095 5076  [ d47baead86c65d4f4069d7ce0a4edceb ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
22:40:38.0188 5076  udfs - ok
22:40:38.0282 5076  [ 13bff97e926bf8d9c1230cecc371a0c0 ] UI Assistant Service C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe
22:40:38.0297 5076  UI Assistant Service - ok
22:40:38.0329 5076  [ 3cbdec8d06b9968aba702eba076364a1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
22:40:38.0344 5076  UI0Detect - ok
22:40:38.0391 5076  [ 4bfe1bc28391222894cbf1e7d0e42320 ] uliagpkx        C:\Windows\system32\DRIVERS\uliagpkx.sys
22:40:38.0407 5076  uliagpkx - ok
22:40:38.0438 5076  [ eab6c35e62b1b0db0d1b48b671d3a117 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
22:40:38.0469 5076  umbus - ok
22:40:38.0516 5076  [ b2e8e8cb557b156da5493bbddcc1474d ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
22:40:38.0531 5076  UmPass - ok
22:40:38.0672 5076  [ 41118d920b2b268c0adc36421248cdcf ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
22:40:38.0781 5076  UNS ( UnsignedFile.Multi.Generic ) - warning
22:40:38.0781 5076  UNS - detected UnsignedFile.Multi.Generic (1)
22:40:38.0859 5076  [ f9ec9acd504d823d9b9ca98a4f8d3ca2 ] Updater Service C:\Program Files\Acer\Acer Updater\UpdaterService.exe
22:40:38.0890 5076  Updater Service - ok
22:40:38.0937 5076  [ d47ec6a8e81633dd18d2436b19baf6de ] upnphost        C:\Windows\System32\upnphost.dll
22:40:39.0031 5076  upnphost - ok
22:40:39.0093 5076  [ 537a4e03d7103c12d42dfd8ffdb5bdc9 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
22:40:39.0171 5076  usbccgp - ok
22:40:39.0202 5076  [ af0892a803fdda7492f595368e3b68e7 ] usbcir          C:\Windows\system32\DRIVERS\usbcir.sys
22:40:39.0233 5076  usbcir - ok
22:40:39.0296 5076  [ fbb21ebe49f6d560db37ac25fbc68e66 ] usbehci        C:\Windows\system32\drivers\usbehci.sys
22:40:39.0311 5076  usbehci - ok
22:40:39.0343 5076  [ 6b7a8a99c4a459e73c286a6763ea24cc ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
22:40:39.0358 5076  usbhub - ok
22:40:39.0405 5076  [ 8c88aa7617b4cbc2e4bed61d26b33a27 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
22:40:39.0436 5076  usbohci - ok
22:40:39.0467 5076  [ 73188f58fb384e75c4063d29413cee3d ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
22:40:39.0514 5076  usbprint - ok
22:40:39.0561 5076  [ aaa2513c8aed8b54b189fd0c6b1634c0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
22:40:39.0592 5076  usbscan - ok
22:40:39.0592 5076  [ f39983647bc1f3e6100778ddfe9dce29 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:40:39.0655 5076  USBSTOR - ok
22:40:39.0717 5076  [ 0b5b3b2df3fd1709618acfa50b8392b0 ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
22:40:39.0748 5076  usbuhci - ok
22:40:39.0826 5076  [ 7cb8c573c6e4a2714402cc0a36eab4fe ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
22:40:39.0904 5076  usbvideo - ok
22:40:39.0935 5076  [ edbb23cbcf2cdf727d64ff9b51a6070e ] UxSms          C:\Windows\System32\uxsms.dll
22:40:39.0982 5076  UxSms - ok
22:40:39.0998 5076  [ 156f6159457d0aa7e59b62681b56eb90 ] VaultSvc        C:\Windows\system32\lsass.exe
22:40:40.0013 5076  VaultSvc - ok
22:40:40.0076 5076  [ fd911873c0bb6945fa38c16e9a2b58f9 ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
22:40:40.0107 5076  VClone - ok
22:40:40.0138 5076  [ c5c876ccfc083ff3b128f933823e87bd ] vdrvroot        C:\Windows\system32\DRIVERS\vdrvroot.sys
22:40:40.0154 5076  vdrvroot - ok
22:40:40.0185 5076  [ 44d73e0bbc1d3c8981304ba15135c2f2 ] vds            C:\Windows\System32\vds.exe
22:40:40.0216 5076  vds - ok
22:40:40.0247 5076  [ da4da3f5e02943c2dc8c6ed875de68dd ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
22:40:40.0263 5076  vga - ok
22:40:40.0279 5076  [ 53e92a310193cb3c03bea963de7d9cfc ] VgaSave        C:\Windows\System32\drivers\vga.sys
22:40:40.0357 5076  VgaSave - ok
22:40:40.0388 5076  [ c82e748660f62a242b2dfac1442f22a4 ] vhdmp          C:\Windows\system32\DRIVERS\vhdmp.sys
22:40:40.0403 5076  vhdmp - ok
22:40:40.0419 5076  [ e5689d93ffe4e5d66c0178761240dd54 ] viaide          C:\Windows\system32\DRIVERS\viaide.sys
22:40:40.0419 5076  viaide - ok
22:40:40.0435 5076  [ 2b1a3dae2b4e70dbba822b7a03fbd4a3 ] volmgr          C:\Windows\system32\DRIVERS\volmgr.sys
22:40:40.0450 5076  volmgr - ok
22:40:40.0466 5076  [ 99b0cbb569ca79acaed8c91461d765fb ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
22:40:40.0481 5076  volmgrx - ok
22:40:40.0513 5076  [ 58f82eed8ca24b461441f9c3e4f0bf5c ] volsnap        C:\Windows\system32\DRIVERS\volsnap.sys
22:40:40.0528 5076  volsnap - ok
22:40:40.0559 5076  [ 5e2016ea6ebaca03c04feac5f330d997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
22:40:40.0575 5076  vsmraid - ok
22:40:40.0653 5076  [ 787898bf9fb6d7bd87a36e2d95c899ba ] VSS            C:\Windows\system32\vssvc.exe
22:40:40.0762 5076  VSS - ok
22:40:40.0793 5076  [ 36d4720b72b5c5d9cb2b9c29e9df67a1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
22:40:40.0809 5076  vwifibus - ok
22:40:40.0871 5076  [ 6a3d66263414ff0d6fa754c646612f3f ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
22:40:40.0918 5076  vwififlt - ok
22:40:40.0965 5076  [ 6a638fc4bfddc4d9b186c28c91bd1a01 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
22:40:40.0996 5076  vwifimp - ok
22:40:41.0027 5076  [ 1c9d80cc3849b3788048078c26486e1a ] W32Time        C:\Windows\system32\w32time.dll
22:40:41.0090 5076  W32Time - ok
22:40:41.0105 5076  [ 4e9440f4f152a7b944cb1663d3935a3e ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
22:40:41.0137 5076  WacomPen - ok
22:40:41.0215 5076  [ 47ca49400643effd3f1c9a27e1d69324 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
22:40:41.0277 5076  WANARP - ok
22:40:41.0293 5076  [ 47ca49400643effd3f1c9a27e1d69324 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
22:40:41.0355 5076  Wanarpv6 - ok
22:40:41.0417 5076  [ 5ab1bb85bd8b5089cc5d64200dedae68 ] wbengine        C:\Windows\system32\wbengine.exe
22:40:41.0511 5076  wbengine - ok
22:40:41.0527 5076  [ 3aa101e8edab2db4131333f4325c76a3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
22:40:41.0558 5076  WbioSrvc - ok
22:40:41.0620 5076  [ dd1bae8ebfc653824d29ccf8c9054d68 ] wcncsvc        C:\Windows\System32\wcncsvc.dll
22:40:41.0683 5076  wcncsvc - ok
22:40:41.0698 5076  [ 20f7441334b18cee52027661df4a6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
22:40:41.0729 5076  WcsPlugInService - ok
22:40:41.0745 5076  [ 72889e16ff12ba0f235467d6091b17dc ] Wd              C:\Windows\system32\DRIVERS\wd.sys
22:40:41.0761 5076  Wd - ok
22:40:41.0792 5076  [ 441bd2d7b4f98134c3a4f9fa570fd250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
22:40:41.0823 5076  Wdf01000 - ok
22:40:41.0870 5076  [ bf1fc3f79b863c914687a737c2f3d681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
22:40:41.0917 5076  WdiServiceHost - ok
22:40:41.0917 5076  [ bf1fc3f79b863c914687a737c2f3d681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
22:40:41.0963 5076  WdiSystemHost - ok
22:40:42.0010 5076  [ 733006127f235be7c35354ebee7b9a7b ] WebClient      C:\Windows\System32\webclnt.dll
22:40:42.0088 5076  WebClient - ok
22:40:42.0119 5076  [ c749025a679c5103e575e3b48e092c43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
22:40:42.0182 5076  Wecsvc - ok
22:40:42.0197 5076  [ 7e591867422dc788b9e5bd337a669a08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
22:40:42.0244 5076  wercplsupport - ok
22:40:42.0291 5076  [ 6d137963730144698cbd10f202e9f251 ] WerSvc          C:\Windows\System32\WerSvc.dll
22:40:42.0369 5076  WerSvc - ok
22:40:42.0416 5076  [ 611b23304bf067451a9fdee01fbdd725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
22:40:42.0478 5076  WfpLwf - ok
22:40:42.0494 5076  [ 05ecaec3e4529a7153b3136ceb49f0ec ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
22:40:42.0509 5076  WIMMount - ok
22:40:42.0509 5076  WinHttpAutoProxySvc - ok
22:40:42.0587 5076  [ 19b07e7e8915d701225da41cb3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
22:40:42.0650 5076  Winmgmt - ok
22:40:42.0728 5076  [ 41fbb751936b387f9179e7f03a74fe29 ] WinRM          C:\Windows\system32\WsmSvc.dll
22:40:42.0884 5076  WinRM - ok
22:40:42.0946 5076  [ 4fada86e62f18a1b2f42ba18ae24e6aa ] Wlansvc        C:\Windows\System32\wlansvc.dll
22:40:43.0009 5076  Wlansvc - ok
22:40:43.0024 5076  [ f6ff8944478594d0e414d3f048f0d778 ] WmiAcpi        C:\Windows\system32\DRIVERS\wmiacpi.sys
22:40:43.0040 5076  WmiAcpi - ok
22:40:43.0087 5076  [ 38b84c94c5a8af291adfea478ae54f93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
22:40:43.0149 5076  wmiApSrv - ok
22:40:43.0180 5076  WMPNetworkSvc - ok
22:40:43.0211 5076  [ 96c6e7100d724c69fcf9e7bf590d1dca ] WPCSvc          C:\Windows\System32\wpcsvc.dll
22:40:43.0243 5076  WPCSvc - ok
22:40:43.0258 5076  [ 2e57ddf2880a7e52e76f41c7e96d327b ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
22:40:43.0336 5076  WPDBusEnum - ok
22:40:43.0367 5076  [ 6bcc1d7d2fd2453957c5479a32364e52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
22:40:43.0445 5076  ws2ifsl - ok
22:40:43.0445 5076  WSearch - ok
22:40:43.0555 5076  [ d9ef901dca379cfe914e9fa13b73b4c4 ] wuauserv        C:\Windows\system32\wuaueng.dll
22:40:43.0695 5076  wuauserv - ok
22:40:43.0726 5076  [ 7cadc74271dd6461c452c271b30bd378 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
22:40:43.0789 5076  WudfPf - ok
22:40:43.0804 5076  [ 3b197af0fff08aa66b6b2241ca538d64 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
22:40:43.0898 5076  WUDFRd - ok
22:40:43.0945 5076  [ b551d6637aa0e132c18ac6e504f7b79b ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
22:40:44.0038 5076  wudfsvc - ok
22:40:44.0069 5076  [ 9a3452b3c2a46c073166c5cf49fad1ae ] WwanSvc        C:\Windows\System32\wwansvc.dll
22:40:44.0116 5076  WwanSvc - ok
22:40:44.0194 5076  [ ff5a03a65b68db7e02a12880399d40d4 ] ZTEusbmdm6k    C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys
22:40:44.0241 5076  ZTEusbmdm6k - ok
22:40:44.0272 5076  [ ff5a03a65b68db7e02a12880399d40d4 ] ZTEusbnmea      C:\Windows\system32\DRIVERS\ZTEusbnmea.sys
22:40:44.0288 5076  ZTEusbnmea - ok
22:40:44.0366 5076  [ ff5a03a65b68db7e02a12880399d40d4 ] ZTEusbser6k    C:\Windows\system32\DRIVERS\ZTEusbser6k.sys
22:40:44.0397 5076  ZTEusbser6k - ok
22:40:44.0428 5076  ================ Scan global ===============================
22:40:44.0459 5076  (ba0cd8c393e8c9f83354106093832c7b) C:\Windows\system32\basesrv.dll
22:40:44.0506 5076  (0cb6ebf4b461a6043353c570bd72a1e1) C:\Windows\system32\winsrv.dll
22:40:44.0522 5076  (0cb6ebf4b461a6043353c570bd72a1e1) C:\Windows\system32\winsrv.dll
22:40:44.0537 5076  (d6160f9d869ba3af0b787f971db56368) C:\Windows\system32\sxssrv.dll
22:40:44.0600 5076  (24acb7e5be595468e3b9aa488b9b4fcb) C:\Windows\system32\services.exe
22:40:44.0615 5076  [Global] - ok
22:40:44.0615 5076  ================ Scan MBR ==================================
22:40:44.0631 5076  MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
22:40:45.0115 5076  \Device\Harddisk0\DR0 - ok
22:40:45.0115 5076  ================ Scan VBR ==================================
22:40:45.0146 5076  Boot (0x1200)  (4c9f7de35c874245a6a8b83a8b2fb664) \Device\Harddisk0\DR0\Partition1
22:40:45.0146 5076  \Device\Harddisk0\DR0\Partition1 - ok
22:40:45.0161 5076  Boot (0x1200)  (01880942b2e45cd854870b6e27736731) \Device\Harddisk0\DR0\Partition2
22:40:45.0161 5076  \Device\Harddisk0\DR0\Partition2 - ok
22:40:45.0161 5076  ============================================================
22:40:45.0161 5076  Scan finished
22:40:45.0161 5076  ============================================================
22:40:45.0177 4748  Detected object count: 8
22:40:45.0177 4748  Actual detected object count: 8
22:43:02.0332 4748  Bonjour Service ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0332 4748  Bonjour Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:43:02.0348 4748  FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0348 4748  FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:43:02.0348 4748  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0348 4748  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:43:02.0348 4748  LMS ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0348 4748  LMS ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:43:02.0348 4748  NTI IScheduleSvc ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0348 4748  NTI IScheduleSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:43:02.0348 4748  RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0348 4748  RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:43:02.0348 4748  SolidWorks Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0348 4748  SolidWorks Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:43:02.0348 4748  UNS ( UnsignedFile.Multi.Generic ) - skipped by user
22:43:02.0348 4748  UNS ( UnsignedFile.Multi.Generic ) - User select action: Skip
Grüße
Regina

cosinus 18.08.2012 13:11
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Regina14 21.08.2012 07:54
Hallo Arne,

hier das Ergebnis von Combofix:

Code:
ComboFix 12-08-20.02 - Regina 20.08.2012  22:55:04.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.3767.2374 [GMT 2:00]
ausgeführt von:: c:\users\Regina\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_HOSTS Anti-PUPs
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-07-20 bis 2012-08-20  ))))))))))))))))))))))))))))))
.
.
2012-08-20 21:08 . 2012-08-20 21:08        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-08-16 15:29 . 2012-08-16 15:29        --------        d-----w-        C:\_OTL
2012-08-16 10:36 . 2012-08-16 10:35        821736        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2012-08-16 10:35 . 2012-08-16 10:35        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-08-16 10:35 . 2012-08-16 10:35        --------        d-----w-        c:\program files (x86)\Java
2012-08-16 08:57 . 2012-07-06 19:58        552448        ----a-w-        c:\windows\system32\drivers\bthport.sys
2012-08-10 12:29 . 2012-08-10 12:29        --------        d-----w-        c:\program files (x86)\Hosts_Anti_Adwares_PUPs
2012-08-09 17:12 . 2012-08-09 17:12        --------        d-----w-        c:\users\Regina\AppData\Roaming\Simfy
2012-08-09 17:12 . 2012-08-09 17:12        --------        d-----w-        c:\program files (x86)\simfy
2012-08-07 16:27 . 2012-08-07 18:24        --------        d-----w-        c:\users\Regina\AppData\Local\.elfohilfe
2012-08-06 21:02 . 2012-08-06 21:02        --------        d-----w-        c:\program files (x86)\ESET
2012-08-06 21:00 . 2012-08-06 21:01        --------        d--h--w-        c:\windows\AxInstSV
2012-08-06 08:59 . 2012-08-06 08:59        --------        d-----w-        c:\users\Regina\AppData\Roaming\Malwarebytes
2012-08-06 08:59 . 2012-08-06 08:59        --------        d-----w-        c:\programdata\Malwarebytes
2012-08-06 08:59 . 2012-07-03 11:46        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-08-06 08:59 . 2012-08-06 08:59        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-08-02 10:47 . 2012-08-02 10:47        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-02 10:46 . 2012-08-02 10:46        --------        d-----w-        c:\windows\system32\Macromed
2012-07-31 21:35 . 2012-06-29 10:04        9133488        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CA03D7F1-145A-439A-9834-A3317B1E6C3D}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-16 10:35 . 2012-04-14 20:38        746984        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-08-16 08:52 . 2010-08-23 18:46        62134624        ----a-w-        c:\windows\system32\MRT.exe
2012-08-02 13:24 . 2009-07-13 23:19        328704        ----a-w-        c:\windows\system32\services.exe
2012-08-02 10:47 . 2011-07-01 20:11        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-05 11:02 . 2012-07-12 06:38        95744        ----a-w-        c:\windows\system32\pdfcmon.dll
2012-06-09 05:30 . 2012-07-11 10:46        14165504        ----a-w-        c:\windows\system32\shell32.dll
2012-06-06 05:50 . 2012-07-11 10:46        2003968        ----a-w-        c:\windows\system32\msxml6.dll
2012-06-06 05:50 . 2012-07-11 10:46        1880064        ----a-w-        c:\windows\system32\msxml3.dll
2012-06-06 05:09 . 2012-07-11 10:46        1389568        ----a-w-        c:\windows\SysWow64\msxml6.dll
2012-06-06 05:09 . 2012-07-11 10:46        1236992        ----a-w-        c:\windows\SysWow64\msxml3.dll
2012-06-02 22:19 . 2012-06-25 08:05        38424        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-25 08:05        2428952        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-25 08:05        57880        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-25 08:05        44056        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-25 08:05        701976        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-25 08:05        2622464        ----a-w-        c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-25 08:05        99840        ----a-w-        c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-25 08:05        186752        ----a-w-        c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-25 08:05        36864        ----a-w-        c:\windows\system32\wuapp.exe
2012-06-02 05:38 . 2012-07-11 10:46        95088        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
2012-06-02 05:38 . 2012-07-11 10:46        152432        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 05:37 . 2012-07-11 10:46        459216        ----a-w-        c:\windows\system32\drivers\cng.sys
2012-06-02 05:27 . 2012-07-11 10:46        340992        ----a-w-        c:\windows\system32\schannel.dll
2012-06-02 05:27 . 2012-07-11 10:46        307200        ----a-w-        c:\windows\system32\ncrypt.dll
2012-06-02 04:48 . 2012-07-11 10:46        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2012-06-02 04:48 . 2012-07-11 10:46        225280        ----a-w-        c:\windows\SysWow64\schannel.dll
2012-06-02 04:47 . 2012-07-11 10:46        219136        ----a-w-        c:\windows\SysWow64\ncrypt.dll
2012-06-02 04:42 . 2012-07-11 10:46        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
2012-05-31 10:25 . 2010-06-11 18:37        279656        ------w-        c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-04-17 05:55        120176        ----a-w-        c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Greenshot"="c:\program files (x86)\Greenshot\Greenshot.exe" [2010-07-12 548864]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-03-03 1300560]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-21 98304]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"UIExec"="c:\program files (x86)\1&1 Surf-Stick\UIExec.exe" [2010-09-30 139088]
"HOSTS Anti-Adware_PUPs"="c:\program files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe" [2012-08-10 302961]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-11 136176]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 40448]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-03-05 335400]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-03-01 39464]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-11 136176]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-10-29 11776]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-18 113120]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-03-17 7680512]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432]
R3 OXSDIDRV_x64;Oxford Semi eSATA Filter (x64);c:\windows\system32\DRIVERS\OXSDIDRV_x64.sys [2009-09-28 51760]
R3 ta2avs;Traktor Audio 2 WDM Audio;c:\windows\system32\Drivers\ta2avs.sys [2010-12-15 358480]
R3 ta2usb_svc;Traktor Audio 2;c:\windows\system32\Drivers\ta2usb.sys [2010-12-15 75856]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-19 27760]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 22576]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 20016]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60464]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys [2010-09-27 75648]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-20 202752]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-12 86224]
S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-05-12 465360]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-03-03 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-04-23 820768]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe [2010-09-27 4180576]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-04-17 305520]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-03-08 250368]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640]
S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [2010-04-22 171040]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640]
S2 UI Assistant Service;UI Assistant Service;c:\program files (x86)\1&1 Surf-Stick\AssistantServices.exe [2010-09-30 253264]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-04-21 6406144]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-04-20 188928]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [2010-04-20 10322848]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-12-22 74280]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-11 18:46]
.
2012-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-11 18:46]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-04-17 05:58        137584        ----a-w-        c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ODDPwr"="c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2010-04-22 223264]
"PLFSetI"="c:\windows\PLFSetI.exe" [2010-01-13 206208]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2010-04-23 496160]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-06 2114376]
"CanonSolutionMenu"="c:\program files (x86)\Canon\SolutionMenu\CNSLMAIN.exe" [2008-12-11 722256]
"combofix"="c:\combofix\CF27924.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27360610k416l0443z185t5631j131
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Regina\AppData\Roaming\Mozilla\Firefox\Profiles\p1y5cce8.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-vProt - c:\program files (x86)\AVG Secure Search\vprot.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-HASP HL Device Driver - c:\windows\System32\UNWISE.EXE
AddRemove-HASP License Manager - c:\windows\System32\UNWISE.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Cyberlink\Shared files\RichVideo.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-08-20  23:27:10 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-08-20 21:27
.
Vor Suchlauf: 14 Verzeichnis(se), 122.976.509.952 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 122.295.291.904 Bytes frei
.
- - End Of File - - 0C2F9BE8E351CBBB454DEFB705DD7D64
Danke für die viele Hilfe!
Regina

cosinus 21.08.2012 13:39
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Regina14 22.08.2012 22:36
Hallo Arne,

anbei das Gmer-Ergebniss:

Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-21 23:40:27
Windows 6.1.7600 
Running: otspei38.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\506313b813d1                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\506313b813d1@001963941cd4        0xF2 0x30 0xC5 0x68 ...
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\506313b813d1 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\506313b813d1@001963941cd4            0xF2 0x30 0xC5 0x68 ...

---- EOF - GMER 1.0.15 ----
Dann das Osam Ergebnis:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 23:50:31 on 21.08.2012

OS: Windows 7 Home Premium Edition (Build 7600), 64-bit
Default Browser: Mozilla Corporation Firefox 14.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files (x86)\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"NTIDrvr" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\system32\drivers\NTIDrvr.sys
"Oxford Semi eSATA Filter (x64)" (OXSDIDRV_x64) - ? - C:\Windows\System32\DRIVERS\OXSDIDRV_x64.sys
"TPkd" (TPkd) - ? - C:\Windows\system32\drivers\TPkd.sys  (File not found)
"UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "Catalyst Context Menu extension" - ? -  (File not found | COM-object registry key not found)
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll
{21D928D4-4850-45E3-9982-AD57051ECD42} "EdrawingThumbNailProvider Class" - "Dassault Systèmes SolidWorks Corp." - C:\Program Files (x86)\Common Files\eDrawings2011\edrwthumbnailprovider.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files (x86)\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
"Senden an Bluetooth" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{AE7CD045-E861-484f-8273-0445EE161910} "AcroIEToolbarHelper Class" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Greenshot" - ? - "C:\Program Files (x86)\Greenshot\Greenshot.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"HOSTS Anti-Adware_PUPs" - ? - C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
"IAStorIcon" - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
"LManager" - "Dritek System Inc." - C:\Program Files (x86)\Launch Manager\LManager.exe
"NeroFilterCheck" - ? - C:\Windows\system32\NeroCheck.exe  (File not found)
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
"UIExec" - ? - "C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe"  (File found, but it contains no detailed information)

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"pdfcmon" - "pdfforge GbR" - C:\Windows\system32\pdfcmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##" (Bonjour Service) - "Apple Computer, Inc." - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Acer ePower Service" (ePowerSvc) - "Acer Incorporated" - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
"Acer ODD Power Service" (ODDPwrSvc) - "Acer Incorporated" - C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
"Avira Browser Schutz" (AntiVirWebService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
"Dritek WMI Service" (DsiWMIService) - "Dritek System Inc." - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GREGService" (GREGService) - "Acer Incorporated" - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"MyWinLocker Service" (MWLService) - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - "NewTech Infosystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
"NTI IScheduleSvc" (NTI IScheduleSvc) - "NewTech Infosystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
"Raw Socket Service" (RS_Service) - "Acer Incorporated" - C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
"SolidWorks Licensing Service" (SolidWorks Licensing Service) - "SolidWorks" - C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
"UI Assistant Service" (UI Assistant Service) - ? - C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe  (File found, but it contains no detailed information)
"Updater Service" (Updater Service) - "Acer Group" - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\PROGRA~2\STANDA~1\STANDA~1\STTime.scr  (File found, but it contains no detailed information)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Computer, Inc." - C:\Program Files (x86)\Bonjour\mdnsNSP.dll
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"AVSDA" - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Und dann das Ergebnis vom aswMBR:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-22 21:46:15
-----------------------------
21:46:15.465    OS Version: Windows x64 6.1.7600
21:46:15.465    Number of processors: 4 586 0x2505
21:46:15.465    ComputerName: REGINA-PC  UserName: Regina
21:46:20.130    Initialize success
21:50:15.289    AVAST engine defs: 12082201
21:54:55.922    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:54:55.930    Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 3
21:54:55.947    Disk 0 MBR read successfully
21:54:55.952    Disk 0 MBR scan
21:54:55.995    Disk 0 Windows 7 default MBR code
21:54:56.001    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        13312 MB offset 2048
21:54:56.036    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 27265024
21:54:56.053    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      597066 MB offset 27469824
21:54:56.098    Disk 0 scanning C:\Windows\system32\drivers
21:55:14.004    Service scanning
21:55:58.935    Modules scanning
21:55:58.948    Disk 0 trace - called modules:
21:55:58.992    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
21:55:59.002    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c6a060]
21:55:59.011    3 CLASSPNP.SYS[fffff88001b0c43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004967050]
21:56:01.193    AVAST engine scan C:\Windows
21:56:09.425    AVAST engine scan C:\Windows\system32
22:02:49.132    AVAST engine scan C:\Windows\system32\drivers
22:03:08.665    AVAST engine scan C:\Users\Regina
22:09:16.488    AVAST engine scan C:\ProgramData
22:10:58.109    Scan finished successfully
23:33:43.175    Disk 0 MBR has been saved successfully to "C:\Users\Regina\Desktop\MBR.dat"
23:33:43.183    The log file has been saved successfully to "C:\Users\Regina\Desktop\aswMBR.txt"
Grüße
Regina

cosinus 30.08.2012 13:13
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Regina14 13.09.2012 09:00
Hallo Arne,

ich war auch im Urlaub, bin jetzt aber wieder voll dabei bei unserer Reinigungsaktion.

Hier das Log von Malwarebytes:

Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.11.04

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Regina :: REGINA-PC [Administrator]

11.09.2012 10:24:50
mbam-log-2012-09-11 (10-24-50).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 771229
Laufzeit: 8 Stunde(n), 54 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
und das Log von Superantispyware:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/13/2012 at 08:35 AM

Application Version : 5.5.1016

Core Rules Database Version : 9213
Trace Rules Database Version: 7025

Scan type      : Complete Scan
Total Scan Time : 14:26:36

Operating System Information
Windows 7 Home Premium 64-bit (Build 6.01.7600)
UAC On - Limited User

Memory items scanned      : 711
Memory threats detected  : 0
Registry items scanned    : 66205
Registry threats detected : 0
File items scanned        : 433604
File threats detected    : 203

Adware.Tracking Cookie
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@ad.yieldmanager[2].txt [ /ad.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@ad.yieldmanager[3].txt [ /ad.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@adx.chip[2].txt [ /adx.chip ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@content.yieldmanager[1].txt [ /content.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@content.yieldmanager[2].txt [ /content.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@doubleclick[1].txt [ /doubleclick ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@statse.webtrendslive[2].txt [ /statse.webtrendslive ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2THH3HMJ.txt [ /zanox-affiliate.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\BWBCIIHC.txt [ /mediaplex.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\DIKA4F21.txt [ /invitemedia.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2J38VZBL.txt [ /ad.zanox.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\WDGQH8JQ.txt [ /adtech.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\1JZWDBJV.txt [ /atdmt.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\8RMS8E32.txt [ /unitymedia.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\O3BRVS1D.txt [ /imrworldwide.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\9EUU6BR4.txt [ /adfarm1.adition.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\5WMSB4T9.txt [ /fastclick.net ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\AJLSQGI1.txt [ /doubleclick.net ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2SFKF6QM.txt [ /tracking.quisma.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\IARA8NM7.txt [ /dyntracker.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\OKDICOS2.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2WQIS4Q9.txt [ /www.zanox-affiliate.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\LXQQ2KEP.txt [ /zanox.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\5COVWYXX.txt [ /smartadserver.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\ZUQ7RL93.txt [ /ads.creative-serving.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\BA2UD6FV.txt [ /apmebf.com ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@de.sitestat[1].txt [ Cookie:regina@de.sitestat.com/idgcom-de/pcwelt/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z939EPJ2.txt [ Cookie:regina@zanox-affiliate.de/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\12NVFX3B.txt [ Cookie:regina@tribalfusion.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@spylog[1].txt [ Cookie:regina@spylog.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@stats.duesseldorf[2].txt [ Cookie:regina@stats.duesseldorf.de/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\H0SIWKRB.txt [ Cookie:regina@amazon-adsystem.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\0GM0DYBM.txt [ Cookie:regina@atdmt.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\SA6NNK35.txt [ Cookie:regina@adfarm1.adition.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@tns-counter[1].txt [ Cookie:regina@tns-counter.ru/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\WSH9WFET.txt [ Cookie:regina@dyntracker.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\NZWFSG1Z.txt [ Cookie:regina@ad2.adfarm1.adition.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\XVXITTL3.txt [ Cookie:regina@zanox.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@yadro[2].txt [ Cookie:regina@yadro.ru/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\NJG9OWDX.txt [ Cookie:regina@apmebf.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@openstat[2].txt [ Cookie:regina@openstat.net/ ]
        C:\USERS\REGINA\Cookies\2THH3HMJ.txt [ Cookie:regina@zanox-affiliate.de/ ]
        C:\USERS\REGINA\Cookies\DIKA4F21.txt [ Cookie:regina@invitemedia.com/ ]
        C:\USERS\REGINA\Cookies\WDGQH8JQ.txt [ Cookie:regina@adtech.de/ ]
        C:\USERS\REGINA\Cookies\1JZWDBJV.txt [ Cookie:regina@atdmt.com/ ]
        C:\USERS\REGINA\Cookies\8RMS8E32.txt [ Cookie:regina@unitymedia.de/ ]
        C:\USERS\REGINA\Cookies\O3BRVS1D.txt [ Cookie:regina@imrworldwide.com/cgi-bin ]
        C:\USERS\REGINA\Cookies\9EUU6BR4.txt [ Cookie:regina@adfarm1.adition.com/ ]
        C:\USERS\REGINA\Cookies\5WMSB4T9.txt [ Cookie:regina@fastclick.net/ ]
        C:\USERS\REGINA\Cookies\2SFKF6QM.txt [ Cookie:regina@tracking.quisma.com/ ]
        C:\USERS\REGINA\Cookies\IARA8NM7.txt [ Cookie:regina@dyntracker.com/ ]
        C:\USERS\REGINA\Cookies\OKDICOS2.txt [ Cookie:regina@ad1.adfarm1.adition.com/ ]
        C:\USERS\REGINA\Cookies\2WQIS4Q9.txt [ Cookie:regina@www.zanox-affiliate.de/ ]
        C:\USERS\REGINA\Cookies\LXQQ2KEP.txt [ Cookie:regina@zanox.com/ ]
        C:\USERS\REGINA\Cookies\5COVWYXX.txt [ Cookie:regina@smartadserver.com/ ]
        C:\USERS\REGINA\Cookies\BA2UD6FV.txt [ Cookie:regina@apmebf.com/ ]
        C:\USERS\REGINA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\REGINA@MEDIALAND[1].TXT [ /MEDIALAND ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .opodo.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .deutschepostag.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .philips.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stat.dealtime.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .conrad.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wfkokkajmho.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wjk4eodjcap.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stats.viessmann.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.count24.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.count24.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.count24.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nedstat.hostelbookers.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nedstat.hostelbookers.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wgkoeocjggp.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .decofinder.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .decofinder.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .decofinder.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nl.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nl.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nl.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .spicesofindia.co.uk [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .spicesofindia.co.uk [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .questioncopyright.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .dmtracker.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .dupont.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aekoohajkap.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wjk4okdpwdq.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .hearstdigital.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .travel.mediamatic.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .travel.mediamatic.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .travel.mediamatic.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .estat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracker.roitesting.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        s03.flagcounter.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mymediawelt.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mymediawelt.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mymediawelt.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .baurechtsexperte.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .avgtechnologies.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        track.zalando.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .brownshoe.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stat.vattenfall.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stat.vattenfall.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        vatrack.hinet.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .shinystat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .media.gira.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .media.gira.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracking.klicktel.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.modepilot.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .modepilot.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .modepilot.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracking.qiez.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        insight.torbit.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Frauder
        C:\PROGRAM FILES (X86)\1&1 SURF-STICK\COMPONENT\BIUSBSOUND.DLL
Mit den Funden von Superantispyware hab ich noch nichts gemacht.

Grüße und Danke!
Regina

cosinus 13.09.2012 16:25
Wie bitte hast du sasw gestartet? Einfach per Doppelklick?

Regina14 13.09.2012 16:33
Hallo Arne,

ich mache immer alles so wie es in euren Anleitungen steht. Ich habe also

"Benutzer mit Windows Vista und Windows 7 starten das Tool bitte wieder per Rechtsklick => als Administrator ausführen!"

gemacht. Allerdings war diesmal das Programm zum ersten Mal anders als bei Euch beschrieben, da man sich zwischendrin (während der Installation) für eine kostenlose Testversion entscheiden musste.

Grüße
Regina

Hallo Arne,

entschuldige, mir ist gerade eingefallen, dass ich einmal den Rechner neu starten musste und beim zweiten Mal hab ich das wohl dann doch per Doppelklick gemacht. Mist. Soll ich noch mal scannen mit dem als Administrator ausführen?

Regina

cosinus 13.09.2012 22:49
Naja, mach das eben nochmal :D

Regina14 14.09.2012 17:14
So, habs nochmal gemacht.
Hier ist das Ergebnis:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/14/2012 at 06:07 PM

Application Version : 5.5.1016

Core Rules Database Version : 9226
Trace Rules Database Version: 7038

Scan type      : Complete Scan
Total Scan Time : 08:13:36

Operating System Information
Windows 7 Home Premium 64-bit (Build 6.01.7600)
UAC On - Limited User

Memory items scanned      : 766
Memory threats detected  : 0
Registry items scanned    : 66209
Registry threats detected : 0
File items scanned        : 436615
File threats detected    : 203

Adware.Tracking Cookie
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@ad.yieldmanager[2].txt [ /ad.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@ad.yieldmanager[3].txt [ /ad.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@adx.chip[2].txt [ /adx.chip ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@content.yieldmanager[1].txt [ /content.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@content.yieldmanager[2].txt [ /content.yieldmanager ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@doubleclick[1].txt [ /doubleclick ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\regina@statse.webtrendslive[2].txt [ /statse.webtrendslive ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2THH3HMJ.txt [ /zanox-affiliate.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\YS9QWIMD.txt [ /mediaplex.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\DIKA4F21.txt [ /invitemedia.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2J38VZBL.txt [ /ad.zanox.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\WDGQH8JQ.txt [ /adtech.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\1JZWDBJV.txt [ /atdmt.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\8RMS8E32.txt [ /unitymedia.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\O3BRVS1D.txt [ /imrworldwide.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\9EUU6BR4.txt [ /adfarm1.adition.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\WOW05OE2.txt [ /fastclick.net ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\AJLSQGI1.txt [ /doubleclick.net ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2SFKF6QM.txt [ /tracking.quisma.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\IARA8NM7.txt [ /dyntracker.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\OKDICOS2.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\2WQIS4Q9.txt [ /www.zanox-affiliate.de ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\LXQQ2KEP.txt [ /zanox.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\5COVWYXX.txt [ /smartadserver.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\ZUQ7RL93.txt [ /ads.creative-serving.com ]
        C:\Users\Regina\AppData\Roaming\Microsoft\Windows\Cookies\BA2UD6FV.txt [ /apmebf.com ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@de.sitestat[1].txt [ Cookie:regina@de.sitestat.com/idgcom-de/pcwelt/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z939EPJ2.txt [ Cookie:regina@zanox-affiliate.de/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\12NVFX3B.txt [ Cookie:regina@tribalfusion.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@spylog[1].txt [ Cookie:regina@spylog.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@stats.duesseldorf[2].txt [ Cookie:regina@stats.duesseldorf.de/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\H0SIWKRB.txt [ Cookie:regina@amazon-adsystem.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\0GM0DYBM.txt [ Cookie:regina@atdmt.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\SA6NNK35.txt [ Cookie:regina@adfarm1.adition.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@tns-counter[1].txt [ Cookie:regina@tns-counter.ru/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\WSH9WFET.txt [ Cookie:regina@dyntracker.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\NZWFSG1Z.txt [ Cookie:regina@ad2.adfarm1.adition.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\XVXITTL3.txt [ Cookie:regina@zanox.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@yadro[2].txt [ Cookie:regina@yadro.ru/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\NJG9OWDX.txt [ Cookie:regina@apmebf.com/ ]
        C:\USERS\REGINA\AppData\Roaming\Microsoft\Windows\Cookies\Low\regina@openstat[2].txt [ Cookie:regina@openstat.net/ ]
        C:\USERS\REGINA\Cookies\2THH3HMJ.txt [ Cookie:regina@zanox-affiliate.de/ ]
        C:\USERS\REGINA\Cookies\DIKA4F21.txt [ Cookie:regina@invitemedia.com/ ]
        C:\USERS\REGINA\Cookies\WDGQH8JQ.txt [ Cookie:regina@adtech.de/ ]
        C:\USERS\REGINA\Cookies\1JZWDBJV.txt [ Cookie:regina@atdmt.com/ ]
        C:\USERS\REGINA\Cookies\8RMS8E32.txt [ Cookie:regina@unitymedia.de/ ]
        C:\USERS\REGINA\Cookies\O3BRVS1D.txt [ Cookie:regina@imrworldwide.com/cgi-bin ]
        C:\USERS\REGINA\Cookies\9EUU6BR4.txt [ Cookie:regina@adfarm1.adition.com/ ]
        C:\USERS\REGINA\Cookies\WOW05OE2.txt [ Cookie:regina@fastclick.net/ ]
        C:\USERS\REGINA\Cookies\2SFKF6QM.txt [ Cookie:regina@tracking.quisma.com/ ]
        C:\USERS\REGINA\Cookies\IARA8NM7.txt [ Cookie:regina@dyntracker.com/ ]
        C:\USERS\REGINA\Cookies\OKDICOS2.txt [ Cookie:regina@ad1.adfarm1.adition.com/ ]
        C:\USERS\REGINA\Cookies\2WQIS4Q9.txt [ Cookie:regina@www.zanox-affiliate.de/ ]
        C:\USERS\REGINA\Cookies\LXQQ2KEP.txt [ Cookie:regina@zanox.com/ ]
        C:\USERS\REGINA\Cookies\5COVWYXX.txt [ Cookie:regina@smartadserver.com/ ]
        C:\USERS\REGINA\Cookies\BA2UD6FV.txt [ Cookie:regina@apmebf.com/ ]
        C:\USERS\REGINA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\REGINA@MEDIALAND[1].TXT [ /MEDIALAND ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .opodo.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .deutschepostag.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        track.webtrekk.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .philips.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stat.dealtime.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .conrad.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wfkokkajmho.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wjk4eodjcap.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stats.viessmann.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.count24.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.count24.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.count24.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nedstat.hostelbookers.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nedstat.hostelbookers.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wgkoeocjggp.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .decofinder.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .decofinder.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .decofinder.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nl.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nl.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        nl.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .spicesofindia.co.uk [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .spicesofindia.co.uk [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .questioncopyright.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .dmtracker.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .dupont.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .nextag.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6aekoohajkap.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .e-2dj6wjk4okdpwdq.stats.esomniture.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .hearstdigital.122.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .travel.mediamatic.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .travel.mediamatic.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .travel.mediamatic.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .estat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracker.roitesting.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .unister-adservices.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        s03.flagcounter.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mymediawelt.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mymediawelt.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .mymediawelt.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .baurechtsexperte.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .avgtechnologies.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .liveperson.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        track.zalando.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .brownshoe.112.2o7.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stat.vattenfall.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        stat.vattenfall.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        vatrack.hinet.net [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .shinystat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .media.gira.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .media.gira.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracking.klicktel.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracking.quisma.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.modepilot.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .modepilot.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .modepilot.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        tracking.qiez.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        insight.torbit.com [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\REGINA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\P1Y5CCE8.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-Frauder
        C:\PROGRAM FILES (X86)\1&1 SURF-STICK\COMPONENT\BIUSBSOUND.DLL
Grüße
Regina

cosinus 14.09.2012 22:17
Er zeigt aber immer noch limited user an :( egal

Sieht ok aus, da wurden nur Cookies gefunden, der angebliche Fund bei 1&1 ist ein Fehalarm.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Regina14 26.09.2012 13:40
Hallo Arne,

erstmal ganz großen herzlichen Dank für die Betreuung!!!
Da ich ja selbstständig arbeite und diesen einen Rechner dringend brauche, hab ich durch deine Hilfe immer weiter arbeiten können ohne Ausfallzeit.:dankeschoen:

Der Rechner läuft wie vorher, Antivir meldet nichts mehr.:singsing:

Cookies hab ich so eingestellt, dass die immer nach dem Schliessen von Firefox gelöscht werden.

Jetzt hab ich noch eine Frage: Ich benutze ja Antivir, das nervt, dass der immer sagt, dass der Rechner nicht sicher ist, weil der (kostenpflichtige) Browser Schutz aus ist. Funktioniert das trotzdem oder sollte ich da umsatteln auf ein anderes Program?

Die Programme Superantispyware, Adw Cleaner (HOSTS), CCCleaner, Malewarebytes sind noch installiert. Soll ich die alle entfernen?
Ist es sinvoll die hin und wieder mal laufen zu lassen? Wenn ja welches?
Gib mir gerne einen Link zu algemeinen Empfehlungen von Euch wie man seinen PC am besten schön sauber hält, damit ich nicht in einem Monat wieder da bin, falls es sowas gibt.

Hast Du noch eine Empfehlung: Wie lange soll ich warten bis ich wieder irgendein Kennwort eingebe?

Beste Grüße
Regina

cosinus 26.09.2012 16:06
Ich würde an deiner Stelle einen Umstieg machen - weg von Avira und stattdessen sowas wie Avast oder MSE nutzen

Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:10 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129