Trojaner-Board - Malware - Avira abgeschaltet

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Malware - Avira abgeschaltet (https://www.trojaner-board.de/121236-malware-avira-abgeschaltet.html)

Malware - Avira abgeschaltet

Hallo!

Habe hier den Laptop meiner Schwester. Sie war auf einer Internet Seite, als sie die Meldung von Avira bekam, das Malware gefunden wurde. Diese Meldung hat sie wohl weggeklickt und die Seite verlassen. Danach bemerkte sie, wie sich das "Schirrmchen" von Avira veränderte. Der WEbGuard war seitdem nicht mehr aktiv und lässt sich auch nicht mehr manuell aktivieren.

Habe nun das Gefühl, dass System ist verseucht. Die Anleitung zum Threaderstellen habe ich befolgt, hier die Log-Files:

OTL:
OTL logfile created on: 04.08.2012 14:54:43 - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,99 Gb Total Physical Memory | 1,96 Gb Available Physical Memory | 65,51% Memory free
6,18 Gb Paging File | 5,21 Gb Available in Paging File | 84,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 67,47 Gb Free Space | 46,82% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 132,13 Gb Free Space | 91,76% Space Free | Partition Type: NTFS

Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.08.04 14:53:03 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2012.02.22 04:03:35 | 000,222,720 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\ielowutil.exe
PRC - [2011.06.29 15:39:52 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.27 13:09:54 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2010.11.04 15:11:52 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.06.03 02:50:58 | 001,144,104 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
PRC - [2010.04.20 14:31:56 | 000,300,912 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\SUPBackGround.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.02.26 19:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2009.02.23 11:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
PRC - [2008.12.19 13:17:24 | 000,333,088 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
PRC - [2008.10.08 02:19:12 | 000,565,248 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2008.10.06 11:07:26 | 000,679,936 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2008.08.26 09:59:54 | 000,045,056 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
PRC - [2008.08.07 04:55:38 | 000,352,256 | ---- | M] (SAMSUNG Electronics co., LTD.) -- C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe
PRC - [2008.07.10 13:42:14 | 000,819,200 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe
PRC - [2008.07.10 13:12:40 | 000,466,944 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe
PRC - [2008.04.17 04:50:00 | 006,111,232 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.02.12 06:19:52 | 001,624,616 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2008.02.12 06:19:52 | 000,723,496 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.16 10:37:38 | 000,031,248 | ---- | M] (Syntek America Inc.) -- C:\Windows\System32\StkCSrv.exe

========== Modules (No Company Name) ==========

MOD - [2010.06.03 02:51:08 | 000,095,528 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010.06.03 02:50:58 | 001,144,104 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe
MOD - [2010.04.20 14:31:56 | 000,300,912 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\SUPBackGround.exe
MOD - [2010.02.03 14:19:20 | 000,155,648 | ---- | M] () -- C:\Programme\Samsung\Samsung Update Plus\HMXML.dll
MOD - [2006.08.12 12:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\Samsung Magic Doctor\HookDllPS2.dll
MOD - [2006.08.12 05:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\EasySpeedUpManager\HookDllPS2.dll
MOD - [2006.08.12 05:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012.08.03 22:45:17 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.03 18:46:41 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.05.03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.06.29 15:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Programme\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2011.06.29 15:39:52 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.27 13:09:54 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.12.10 19:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2010.12.10 19:29:30 | 029,293,408 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ)
SRV - [2010.12.10 19:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2010.12.10 19:29:30 | 000,044,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2009.02.26 19:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2009.02.23 11:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2008.07.10 13:42:14 | 000,819,200 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008.07.10 13:12:40 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008.05.13 01:47:20 | 000,077,480 | ---- | M] () [Auto | Stopped] -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.16 10:37:38 | 000,031,248 | ---- | M] (Syntek America Inc.) [Auto | Running] -- C:\Windows\System32\StkCSrv.exe -- (StkSSrv)
SRV - [2006.10.26 07:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.08.04 04:43:36 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011.06.29 15:39:55 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.06.29 15:39:55 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.06.13 14:31:50 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009.12.17 17:02:20 | 001,203,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.11.07 02:19:36 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)
DRV - [2008.08.05 20:29:26 | 000,044,576 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2008.07.26 21:24:00 | 007,548,000 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.05.08 11:51:18 | 000,226,328 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\iaNvStor.sys -- (iaNvStor) Intel(R)
DRV - [2008.03.28 12:19:54 | 001,363,088 | ---- | M] (Syntek) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\StkCMini.sys -- (StkCMini)
DRV - [2008.01.21 04:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006.11.28 09:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.02 09:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKLM\..\URLSearchHook: - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {6552C7DD-90A4-4387-B795-F8F96747DE19}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.6&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Teresa Sonntag\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.03 22:45:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.01 20:49:36 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.03 22:45:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.01 20:49:36 | 000,000,000 | ---D | M]

[2010.06.13 14:00:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.08.04 13:11:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\5um2nqxm.default\extensions
[2010.09.03 14:54:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.08.03 10:18:45 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.06.27 18:52:40 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.06.15 15:22:12 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.06.15 15:22:13 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\***AppData\Roaming\mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2011.04.17 12:37:42 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\5um2nqxm.default\extensions\engine@conduit.com
[2010.06.16 12:15:44 | 000,000,873 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\conduit.xml
[2010.06.13 14:32:13 | 000,002,059 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\daemon-search.xml
[2012.08.03 18:04:01 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-1.xml
[2011.08.19 16:05:32 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-10.xml
[2011.11.09 20:22:36 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-11.xml
[2011.11.21 18:44:46 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-12.xml
[2010.12.16 10:39:47 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-2.xml
[2011.03.04 14:59:51 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-3.xml
[2011.03.08 15:30:27 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-4.xml
[2011.03.25 15:26:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-5.xml
[2011.04.30 18:42:36 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-6.xml
[2011.05.06 14:27:08 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-7.xml
[2011.05.13 14:05:39 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-8.xml
[2011.06.25 10:56:21 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin-9.xml
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\***AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\icqplugin.xml
[2012.02.21 20:42:57 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.05.31 20:04:33 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.08.03 22:45:18 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.03.15 16:10:19 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.15 16:10:19 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.03.15 16:10:19 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.15 16:10:19 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.03.15 16:10:19 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.15 16:10:19 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Facebook Update] C:\Users\Teresa Sonntag\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [Sony Ericsson PC Companion] C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Teresa Sonntag\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5E823EC7-DD26-4E07-9242-9376925A4DD7}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{3a23b1f3-76e8-11df-8fa1-00234eeb1283}\Shell - "" = AutoRun
O33 - MountPoints2\{3a23b1f3-76e8-11df-8fa1-00234eeb1283}\Shell\AutoRun\command - "" = G:\SETUP.EXE
O33 - MountPoints2\{3a23b1f3-76e8-11df-8fa1-00234eeb1283}\Shell\configure\command - "" = G:\SETUP.EXE
O33 - MountPoints2\{3a23b1f3-76e8-11df-8fa1-00234eeb1283}\Shell\install\command - "" = G:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.08.04 14:53:01 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.08.04 14:40:28 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Trojaner Board
[2012.08.04 04:40:52 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.08.04 04:40:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.08.04 04:40:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.04 04:40:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.04 04:40:39 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.04 04:40:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.03 18:07:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.08.03 18:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.08.03 18:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2012.08.03 10:55:14 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Avira
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.08.04 14:57:01 | 000,001,174 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4052529140-588982613-92189222-1003UA.job
[2012.08.04 14:54:14 | 000,174,086 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.08.04 14:53:03 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.08.04 14:49:40 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.04 14:45:56 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.04 14:45:56 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.04 14:45:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.04 14:45:32 | 3215,577,088 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.04 14:44:36 | 000,002,140 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.08.04 14:44:20 | 000,000,020 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.08.04 04:43:36 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.08.03 20:57:00 | 000,001,152 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4052529140-588982613-92189222-1003Core.job
[2012.07.18 06:37:48 | 000,397,480 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.15 09:17:59 | 000,689,472 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.15 09:17:59 | 000,645,858 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.15 09:17:59 | 000,122,686 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.15 09:17:58 | 000,151,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.14 22:06:47 | 000,007,088 | ---- | M] () -- C:\Users\***\Opis Lied.odt
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.08.04 14:43:42 | 000,000,020 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.07.14 22:06:47 | 000,007,088 | ---- | C] () -- C:\Users\***\Opis Lied.odt
[2012.04.30 17:32:21 | 000,000,164 | ---- | C] () -- C:\ProgramData\{5CAFA1B7-9EEF-4cc7-B9F7-9DDB3DAA679E}
[2012.04.30 17:32:21 | 000,000,092 | ---- | C] () -- C:\ProgramData\{701ACAF9-F102-47c2-8907-36246F4DFB51}
[2012.04.21 11:55:09 | 000,031,007 | ---- | C] () -- C:\Users\***\AppData\Roaming\UserTile.png
[2012.01.07 15:43:52 | 000,056,832 | ---- | C] () -- C:\Windows\System32\Iyvu9_32.dll
[2012.01.07 15:22:47 | 000,000,012 | ---- | C] () -- C:\Windows\Ulead32.ini

========== LOP Check ==========

[2012.06.27 18:50:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Audacity
[2010.06.13 14:47:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2012.04.30 17:31:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Degener
[2010.06.15 15:22:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.05.20 20:52:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2012.03.31 18:31:55 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Search
[2010.11.09 18:34:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\smiledaten
[2012.01.07 15:46:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ulead Systems
[2012.08.03 20:57:00 | 000,001,152 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4052529140-588982613-92189222-1003Core.job
[2012.08.04 14:57:01 | 000,001,174 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4052529140-588982613-92189222-1003UA.job
[2012.08.04 14:44:37 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

EXTRAS:

OTL Extras logfile created on: 04.08.2012 14:54:43 - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,99 Gb Total Physical Memory | 1,96 Gb Available Physical Memory | 65,51% Memory free
6,18 Gb Paging File | 5,21 Gb Available in Paging File | 84,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 67,47 Gb Free Space | 46,82% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 132,13 Gb Free Space | 91,76% Space Free | Partition Type: NTFS

Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07D12E98-6790-417D-8D01-91F14AA0165E}" = lport=138 | protocol=17 | dir=in | app=system |
"{0CAF1993-0752-4BDA-92F9-1F9F282E996D}" = rport=137 | protocol=17 | dir=out | app=system |
"{1E57B702-C5BF-4333-8514-338452C4F7AD}" = lport=137 | protocol=17 | dir=in | app=system |
"{46F3AA34-628B-48B4-9868-7DE8E3B36840}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5F1CEA2F-3A43-41BF-BA21-E921F1FF5588}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{62F435A4-80CC-4A33-AF50-9CE0D2A6BE23}" = rport=139 | protocol=6 | dir=out | app=system |
"{6A37D125-7874-4E0E-A73C-5C5C3E81121C}" = rport=138 | protocol=17 | dir=out | app=system |
"{A16DBCBB-C900-4EAD-B784-813BE3179E6D}" = lport=139 | protocol=6 | dir=in | app=system |
"{D5439D30-1E0A-4BEF-9ABB-102ECD4B3BE1}" = rport=445 | protocol=6 | dir=out | app=system |
"{F37FA39F-FC40-4B32-8B9D-1550D3F66C04}" = lport=445 | protocol=6 | dir=in | app=system |
"{FC29DAE6-E454-4EBB-9CBD-685D0E8B4B2C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{072111B0-0B28-4EC4-97A4-689D773E70FC}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{09294180-4F20-4BAB-B30C-1606106AF66F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{2D63AF93-9193-42FC-9A7C-727C61598261}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{2DD2AD2C-96D9-48E1-B55A-83A3876124FE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{31901127-C849-4390-B669-F9E147729F90}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{45F3A636-7F70-4B8C-AB56-FD759E751BB7}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{503AED27-7392-4FC4-8CA0-7FEC04B2348F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{5CA34762-C8B8-4B1F-A61A-6DBFB1D26D56}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{6B461535-4008-47B8-9EB2-90AFC2737FF1}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{78E6AF94-FB59-4E0F-AFE3-71217EBA3730}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{9411ACE0-FC38-40AE-A707-B5F69DC687D8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A857208F-FA66-4CDF-AFAA-C09F0B89441D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D022B504-12AD-4D9D-95D8-A2E4BE57B336}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E2DBC3B4-2EA9-4C89-AF29-341CDA8AC10B}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{F6FFD02A-3C6C-462F-AB4F-E5CF80806D28}" = dir=in | app=c:\users\teresa sonntag\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{F8874BB3-8376-4134-8E36-58D34C30F8F9}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{FC9A31BF-59B3-413E-ADD8-ECB454029378}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"TCP Query User{198AEDA0-1714-4950-9D72-76ED9AEDA889}D:\teresas laptop\css\hl2.exe" = protocol=6 | dir=in | app=d:\teresas laptop\css\hl2.exe |
"UDP Query User{1E8EBFEF-4A5B-4045-BE06-24E9A10D21B7}D:\teresas laptop\css\hl2.exe" = protocol=17 | dir=in | app=d:\teresas laptop\css\hl2.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software 1.12.37.1
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6300
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{090962E2-4BE8-4A8A-86B0-7A5ED31C1273}" = USB2.0 UVC WebCam
"{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AA56BFBE-E1D1-435D-A805-52A7F788D057}_is1" = CLICK & LEARN DiDi 360° 3.1
"{AC76BA86-7AD7-1031-7B44-A83000000003}" = Adobe Reader 8.3.1 - Deutsch
"{AED53CDF-1046-4C6B-B5E2-C195125ECDA0}" = Intel(R) PROSet/Wireless WiFi-Software
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility
"{DA932D71-E52A-43D5-009E-395A1AEC1474}" = Die Sims™ Lebensgeschichten
"{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 2.02.002
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Audacity_is1" = Audacity 2.0
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Setup.divx.com" = DivX-Setup
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Indeo® software" = Indeo® software
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}" = Play Camera
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"USB2.0 UVC 1.3M WebCam" = USB2.0 UVC 1.3M WebCam
"VLC media player" = VLC media player 1.1.7
"WinLiveSuite_Wave3" = Windows Live Essentials

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 07.01.2012 10:24:15 | Computer Name = *** | Source = WinMgmt | ID = 10
Description =

Error - 07.01.2012 11:37:17 | Computer Name = *** | Source = WinMgmt | ID = 10
Description =

Error - 07.01.2012 11:39:34 | Computer Name = *** | Source = WinMgmt | ID = 10
Description =

Error - 07.01.2012 11:42:27 | Computer Name = *** | Source = ESENT | ID = 215
Description = WinMail (4076) WindowsMail0: Die Sicherung wurde abgebrochen, weil
sie vom Client angehalten wurde, oder weil die Verbindung mit dem Client unterbrochen
wurde.

Error - 14.01.2012 23:09:01 | Computer Name = *** | Source = WinMgmt | ID = 10
Description =

Error - 30.01.2012 22:22:42 | Computer Name = *** | Source = WinMgmt | ID = 10
Description =

Error - 01.02.2012 11:41:25 | Computer Name = *** | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei C:\Users\Teresa
Sonntag\AppData\Local\Mozilla\Firefox\Profiles\5um2nqxm.default\Cache\9\6F\E05D9d01.

[ACCESS_VIOLATION Exception!! EIP = 0x25b3952] Bitte Avira informieren und die
obige Datei übersenden!

Error - 01.02.2012 11:43:15 | Computer Name = *** | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei C:\Users\Teresa
Sonntag\AppData\Local\Mozilla\Firefox\Profiles\5um2nqxm.default\Cache\2\8B\D7F5Ed01.

[ACCESS_VIOLATION Exception!! EIP = 0x25b3952] Bitte Avira informieren und die
obige Datei übersenden!

Error - 02.02.2012 13:43:44 | Computer Name = *** | Source = WinMgmt | ID = 10
Description =

Error - 09.02.2012 09:40:09 | Computer Name = *** | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 04.08.2012 07:13:32 | Computer Name = *** | Source = BROWSER | ID = 8032
Description =

Error - 04.08.2012 08:36:28 | Computer Name = *** | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 04.08.2012 um 13:47:39 unerwartet heruntergefahren.

Error - 04.08.2012 08:36:58 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description =

Error - 04.08.2012 08:37:11 | Computer Name = *** | Source = netbt | ID = 4319
Description = Ein doppelter Name wurde im TCP-Netzwerk entdeckt. Die IP-Adresse
des Computers, der die Meldung gesendet hat, steht in den Daten. Verwenden Sie NBTSTAT
-n an der Eingabeaufforderung, um den doppelten Namen zu bestimmen.

Error - 04.08.2012 08:37:12 | Computer Name = *** | Source = bowser | ID = 8003
Description =

Error - 04.08.2012 08:42:49 | Computer Name = *** | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =

Error - 04.08.2012 08:47:11 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description =

Error - 04.08.2012 08:47:11 | Computer Name = *** | Source = Service Control Manager | ID = 7009
Description =

Error - 04.08.2012 08:47:11 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description =

Error - 04.08.2012 08:53:40 | Computer Name = *** | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =

< End of report >

Gmer:

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-04 16:08:21
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2SS0
Running: 2w6gcpwt.exe; Driver: C:\Users\TERESA~1\AppData\Local\Temp\fwrdypob.sys

---- System - GMER 1.0.15 ----

SSDT 807C9736 ZwCreateSection
SSDT 807C973B ZwSetContextThread
SSDT 807C96D7 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!KeInsertQueue + 405 8206DA3C 4 Bytes [36, 97, 7C, 80]
.text ntoskrnl.exe!KeInsertQueue + 75D 8206DD94 4 Bytes [3B, 97, 7C, 80]
.text ntoskrnl.exe!KeInsertQueue + 811 8206DE48 4 Bytes [D7, 96, 7C, 80] {XLATB ; XCHG ESI, EAX; JL 0xffffffffffffff84}
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8E80A340, 0x3EE687, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001fe1f5dc87
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001fe1f5f0f0
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00234eeb1283
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00234eeb1283@00196310fd15 0x4F 0x73 0x2A 0x76 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x83 0xDF 0x2C 0x38 ...
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001fe1f5dc87 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001fe1f5f0f0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00234eeb1283 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00234eeb1283@00196310fd15 0x4F 0x73 0x2A 0x76 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x83 0xDF 0x2C 0x38 ...

---- EOF - GMER 1.0.15 ----

Danke schomal!

Gruß

Zitat:

, als sie die Meldung von Avira bekam, das Malware gefunden wurde.

Schön und wo sind die Logs dazu? :confused:

Solche Angaben reichen nicht, bitte poste die vollständigen Angaben/Logs der Virenscanner.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Pardon!

Code:

In der Datei 'C:\Users\Teresa Sonntag\AppData\Local\Temp\plugtmp-87\plugin-ap2.php'

wurde ein Virus oder unerwünschtes Programm 'EXP/Pidief.eaw' [exploit] gefunden.

Ausgeführte Aktion: Zugriff erlauben

Code:

Die Datei 'C:\Users\Teresa Sonntag\AppData\Local\Temp\plugtmp-87\plugin-ap2.php'

enthielt einen Virus oder unerwünschtes Programm 'EXP/Pidief.eaw' [exploit].

Durchgeführte Aktion(en):

Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54273d8a.qua' verschoben!

Code:



Avira AntiVir Personal

Erstellungsdatum der Reportdatei: Freitag, 3. August 2012  10:54
 

Es wird nach 4055095 Virenstämmen gesucht.
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira AntiVir Personal - Free Antivirus

Seriennummer   : 0000149996-ADJIE-0000001

Plattform      : Windows Vista

Windowsversion : (Service Pack 2)  [6.0.6002]

Boot Modus     : Normal gebootet

Benutzername   : SYSTEM

Computername   : ***
 

Versionsinformationen:

BUILD.DAT      : 10.2.0.707     36070 Bytes  25.01.2012 12:53:00

AVSCAN.EXE     : 10.3.0.7      484008 Bytes  29.06.2011 13:39:52

AVSCAN.DLL     : 10.0.5.0       57192 Bytes  29.06.2011 13:39:52

LUKE.DLL       : 10.3.0.5       45416 Bytes  29.06.2011 13:39:52

LUKERES.DLL    : 10.0.0.0       13672 Bytes  14.01.2010 10:59:47

AVSCPLR.DLL    : 10.3.0.7      119656 Bytes  29.06.2011 13:39:55

AVREG.DLL      : 10.3.0.9       88833 Bytes  12.07.2011 16:32:01

VBASE000.VDF   : 7.10.0.0    19875328 Bytes  06.11.2009 08:05:36

VBASE001.VDF   : 7.11.0.0    13342208 Bytes  14.12.2010 14:29:20

VBASE002.VDF   : 7.11.19.170 14374912 Bytes  20.12.2011 13:17:23

VBASE003.VDF   : 7.11.21.238  4472832 Bytes  01.02.2012 15:42:30

VBASE004.VDF   : 7.11.26.44   4329472 Bytes  28.03.2012 10:39:52

VBASE005.VDF   : 7.11.34.116  4034048 Bytes  29.06.2012 14:48:56

VBASE006.VDF   : 7.11.34.117     2048 Bytes  29.06.2012 14:48:56

VBASE007.VDF   : 7.11.34.118     2048 Bytes  29.06.2012 14:48:56

VBASE008.VDF   : 7.11.34.119     2048 Bytes  29.06.2012 14:48:56

VBASE009.VDF   : 7.11.34.120     2048 Bytes  29.06.2012 14:48:56

VBASE010.VDF   : 7.11.34.121     2048 Bytes  29.06.2012 14:48:56

VBASE011.VDF   : 7.11.34.122     2048 Bytes  29.06.2012 14:48:56

VBASE012.VDF   : 7.11.34.123     2048 Bytes  29.06.2012 14:48:56

VBASE013.VDF   : 7.11.34.124     2048 Bytes  29.06.2012 14:48:57

VBASE014.VDF   : 7.11.38.18   2554880 Bytes  30.07.2012 08:12:16

VBASE015.VDF   : 7.11.38.70    556032 Bytes  31.07.2012 08:12:28

VBASE016.VDF   : 7.11.38.143   171008 Bytes  02.08.2012 08:12:29

VBASE017.VDF   : 7.11.38.144     2048 Bytes  02.08.2012 08:12:29

VBASE018.VDF   : 7.11.38.145     2048 Bytes  02.08.2012 08:12:29

VBASE019.VDF   : 7.11.38.146     2048 Bytes  02.08.2012 08:12:29

VBASE020.VDF   : 7.11.38.147     2048 Bytes  02.08.2012 08:12:30

VBASE021.VDF   : 7.11.38.148     2048 Bytes  02.08.2012 08:12:30

VBASE022.VDF   : 7.11.38.149     2048 Bytes  02.08.2012 08:12:30

VBASE023.VDF   : 7.11.38.150     2048 Bytes  02.08.2012 08:12:30

VBASE024.VDF   : 7.11.38.151     2048 Bytes  02.08.2012 08:12:31

VBASE025.VDF   : 7.11.38.152     2048 Bytes  02.08.2012 08:12:31

VBASE026.VDF   : 7.11.38.153     2048 Bytes  02.08.2012 08:12:31

VBASE027.VDF   : 7.11.38.154     2048 Bytes  02.08.2012 08:12:31

VBASE028.VDF   : 7.11.38.155     2048 Bytes  02.08.2012 08:12:31

VBASE029.VDF   : 7.11.38.156     2048 Bytes  02.08.2012 08:12:31

VBASE030.VDF   : 7.11.38.157     2048 Bytes  02.08.2012 08:12:31

VBASE031.VDF   : 7.11.38.182    66048 Bytes  03.08.2012 08:12:32

Engineversion  : 8.2.10.126

AEVDF.DLL      : 8.1.2.10      102772 Bytes  10.07.2012 17:43:26

AESCRIPT.DLL   : 8.1.4.38      455033 Bytes  03.08.2012 08:12:46

AESCN.DLL      : 8.1.8.2       131444 Bytes  27.01.2012 10:07:48

AESBX.DLL      : 8.2.5.12      606578 Bytes  14.06.2012 16:54:07

AERDL.DLL      : 8.1.9.15      639348 Bytes  09.09.2011 15:48:04

AEPACK.DLL     : 8.3.0.18      807287 Bytes  03.08.2012 08:12:45

AEOFFICE.DLL   : 8.1.2.42      201083 Bytes  24.07.2012 15:02:45

AEHEUR.DLL     : 8.1.4.84     5112182 Bytes  03.08.2012 08:12:41

AEHELP.DLL     : 8.1.23.2      258422 Bytes  28.06.2012 16:58:45

AEGEN.DLL      : 8.1.5.34      434548 Bytes  24.07.2012 15:02:34

AEEXP.DLL      : 8.1.0.74       86387 Bytes  03.08.2012 08:12:46

AEEMU.DLL      : 8.1.3.2       393587 Bytes  10.07.2012 17:43:26

AECORE.DLL     : 8.1.27.2      201078 Bytes  10.07.2012 17:43:26

AEBB.DLL       : 8.1.1.0        53618 Bytes  13.06.2010 12:01:12

AVWINLL.DLL    : 10.0.0.0       19304 Bytes  14.01.2010 10:59:10

AVPREF.DLL     : 10.0.3.2       44904 Bytes  29.06.2011 13:39:52

AVREP.DLL      : 10.0.0.10     174120 Bytes  18.05.2011 11:46:27

AVARKT.DLL     : 10.0.26.1     255336 Bytes  29.06.2011 13:39:51

AVEVTLOG.DLL   : 10.0.0.9      203112 Bytes  29.06.2011 13:39:52

SQLITE3.DLL    : 3.6.19.0      355688 Bytes  28.01.2010 11:57:53

AVSMTP.DLL     : 10.0.0.17      63848 Bytes  16.03.2010 14:38:54

NETNT.DLL      : 10.0.0.0       11624 Bytes  19.02.2010 13:40:55

RCIMAGE.DLL    : 10.0.0.35    2589544 Bytes  29.06.2011 13:39:51

RCTEXT.DLL     : 10.0.64.0      98664 Bytes  29.06.2011 13:39:51
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: avguard_async_scan

Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_5100e696\guard_slideup.avp

Protokollierung.......................: standard

Primäre Aktion........................: reparieren

Sekundäre Aktion......................: quarantäne

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: aus

Durchsuche aktive Programme...........: ein

Durchsuche Registrierung..............: aus

Suche nach Rootkits...................: aus

Integritätsprüfung von Systemdateien..: aus

Datei Suchmodus.......................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: 20

Archiv Smart Extensions...............: ein

Makrovirenheuristik...................: ein

Dateiheuristik........................: vollständig
 

Beginn des Suchlaufs: Freitag, 3. August 2012  10:54
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchFilterHost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'AcroRd32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchProtocolHost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'OUTLOOK.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchIndexer.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'FlashPlayerPlugin_11_3_300_265.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'FlashPlayerPlugin_11_3_300_265.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'plugin-container.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPHelper.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnetwk.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'StkCSrv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sqlwriter.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sqlbrowser.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BtStackServer.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RegSrvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ICQ Service.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'GuardICQ.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehmsas.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'EvtEng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SPUVolumeWatcher.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BTTray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmpnscfg.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ICQ.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'ehtray.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sidebar.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'GuardICQ.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'GrooveMonitor.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SynTPEnh.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'BcmSqlStartupSvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'EasyBatteryMgr3.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'MagicDoctorKbdHk.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'EasySpeedUpManager.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'dmhkcore.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'SLsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'nvvsvc.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsm.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'services.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '1' Modul(e) wurden durchsucht

Durchsuche Prozess 'smss.exe' - '1' Modul(e) wurden durchsucht
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\Users\***\AppData\Local\Temp\plugtmp-87\plugin-ap2.php'

C:\Users\***\AppData\Local\Temp\plugtmp-87\plugin-ap2.php

  [0] Archivtyp: PDF

  --> pdf_form_1.avp

      [FUND]      Enthält Erkennungsmuster des Exploits EXP/Pidief.ean

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54273d8a.qua' verschoben!
 
 

Ende des Suchlaufs: Freitag, 3. August 2012  10:54

Benötigte Zeit: 00:09 Minute(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

      0 Verzeichnisse wurden überprüft

     77 Dateien wurden geprüft

      2 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      0 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

      1 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      0 Dateien konnten nicht durchsucht werden

     75 Dateien ohne Befall

      0 Archive wurden durchsucht

      0 Warnungen

      1 Hinweise

Gruß

Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

hier steht das Log

Hallo!

Habe Malware-Bytes durchlaufen lassen. Es hat sich zwei mal aufgehangen. Einmal nach etwa 47 min., das andere mal nach 53 min. Der Bildschirm ist für eine Zeit eingefroren und dann kam ein schwarzer Bildschirm mit einem Dialogfeld:

Code:

Überschrift: "Fehler beim Erstellen des Sicherheitsoptionen-Dialogfeld"
 

Text: "Fehler-Sicherheitsoptionen"

Grüße

Probier es im abgesicherten Modus mit Netzwerktreibern aus

Im abgesicherten Modus hat es geklappt.

Code:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org
 

Datenbank Version: v2012.08.08.07
 

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)

Internet Explorer 9.0.8112.16421

Teresa Sonntag :: TERESASONNTA-PC [Administrator]
 

09.08.2012 14:39:36

mbam-log-2012-08-09 (14-39-36).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 335100

Laufzeit: 1 Stunde(n), 1 Minute(n), 53 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

Code:

ESETSmartInstaller@High as downloader log:

all ok

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=e0bd10241922a34b95b86f1ecc49c559

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-08-09 03:40:04

# local_time=2012-08-09 05:40:04 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=1797 16775166 100 94 79185 81059053 77084 0

# compatibility_mode=5892 16776638 100 95 18575546 182054925 0 0

# compatibility_mode=8192 67108863 100 0 78743 78743 0 0

# scanned=161563

# found=0

# cleaned=0

# scan_time=4607

Vielen Dank!

Gruß

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Es gibt keine weiteren Logs, da der Rechner im nicht abgesicherten Modus beim Scannen jedes Mal abstürzte.

Gruß

adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Code:

# AdwCleaner v1.800 - Logfile created 08/13/2012 at 20:01:32

# Updated 01/08/2012 by Xplode

# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

# User : *** - ***

# Running from : C:\Users\***\Desktop\adwcleaner.exe

# Option [Search]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Found : C:\Users\***\AppData\Local\Conduit

Folder Found : C:\Users\***\AppData\LocalLow\Conduit

Folder Found : C:\Users\***\AppData\LocalLow\ConduitEngine

Folder Found : C:\Users\***\AppData\LocalLow\DVDVideoSoftTB

Folder Found : C:\Users\***\AppData\LocalLow\PriceGong

Folder Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\Conduit

Folder Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\ConduitEngine

Folder Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\CT2269050

Folder Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\CT2269050

Folder Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

Folder Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}

Folder Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\extensions\engine@conduit.com

Folder Found : C:\Program Files\Conduit

Folder Found : C:\Program Files\ConduitEngine

Folder Found : C:\Program Files\DAEMON Tools Toolbar

Folder Found : C:\Program Files\DVDVideoSoftTB

File Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\Conduit.xml

File Found : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\daemon-search.xml

File Found : C:\Windows\system32\conduitEngine.tmp
 

***** [Registry] *****

[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2269050

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\conduitEngine

Key Found : HKCU\Software\AppDataLow\Software\PriceGong

Key Found : HKCU\Software\AppDataLow\Toolbar

Key Found : HKLM\SOFTWARE\ASKInstaller

Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Found : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj

Key Found : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj.1

Key Found : HKLM\SOFTWARE\Conduit

Key Found : HKLM\SOFTWARE\conduitEngine

Key Found : HKLM\SOFTWARE\conduitEngine

Key Found : HKLM\SOFTWARE\DT Soft

Key Found : HKLM\SOFTWARE\DVDVideoSoftTB

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine 

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
 

***** [Registre - GUID] *****
 

Key Found : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C904CFF-5709-4AD1-867E-4F226D302BEB}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{B56F2FDE-5DE3-4CE0-A702-6FA887D99BE3}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AD4E2463-C238-4F44-80B4-A21EC55125AE}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{932E4585-ECC6-4BE5-90CB-505EE8A66AE7}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{46746DB5-B681-4DA5-AA0E-B5E38A0CC63F}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B56F2FDE-5DE3-4CE0-A702-6FA887D99BE3}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v14.0.1 (de)
 

Profile name : default 

File : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\prefs.js
 

Found : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Found : user_pref("CT2269050.CTID", "CT2269050");

Found : user_pref("CT2269050.CurrentServerDate", "19-10-2010");

Found : user_pref("CT2269050.DialogsAlignMode", "LTR");

Found : user_pref("CT2269050.DownloadReferralCookieData", "");

Found : user_pref("CT2269050.EMailNotifierPollDate", "Tue Oct 19 2010 23:06:14 GMT+0200");

Found : user_pref("CT2269050.FirstServerDate", "16-6-2010");

Found : user_pref("CT2269050.FirstTime", true);

Found : user_pref("CT2269050.FirstTimeFF3", true);

Found : user_pref("CT2269050.FirstTimeSettingsDone", true);

Found : user_pref("CT2269050.FixPageNotFoundErrors", true);

Found : user_pref("CT2269050.GroupingServerCheckInterval", 1440);

Found : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Found : user_pref("CT2269050.Initialize", true);

Found : user_pref("CT2269050.InitializeCommonPrefs", true);

Found : user_pref("CT2269050.InstallationAndCookieDataSentCount", 3);

Found : user_pref("CT2269050.InstalledDate", "Wed Jun 16 2010 12:15:44 GMT+0200");

Found : user_pref("CT2269050.InvalidateCache", false);

Found : user_pref("CT2269050.IsGrouping", false);

Found : user_pref("CT2269050.IsMulticommunity", false);

Found : user_pref("CT2269050.IsOpenThankYouPage", false);

Found : user_pref("CT2269050.IsOpenUninstallPage", false);

Found : user_pref("CT2269050.LanguagePackLastCheckTime", "Tue Oct 19 2010 12:50:52 GMT+0200");

Found : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);

Found : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Found : user_pref("CT2269050.LastLogin_2.5.8.6", "Sat Aug 14 2010 11:31:50 GMT+0200");

Found : user_pref("CT2269050.LastLogin_2.7.0.14", "Wed Sep 01 2010 13:20:19 GMT+0200");

Found : user_pref("CT2269050.LastLogin_2.7.2.0", "Tue Oct 19 2010 22:36:13 GMT+0200");

Found : user_pref("CT2269050.LatestVersion", "2.7.2.0");

Found : user_pref("CT2269050.Locale", "en");

Found : user_pref("CT2269050.LoginCache", 4);

Found : user_pref("CT2269050.MCDetectTooltipHeight", "83");

Found : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Found : user_pref("CT2269050.MCDetectTooltipWidth", "295");

Found : user_pref("CT2269050.RadioIsPodcast", false);

Found : user_pref("CT2269050.RadioLastCheckTime", "Tue Oct 19 2010 12:50:52 GMT+0200");

Found : user_pref("CT2269050.RadioLastUpdateIPServer", "3");

Found : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");

Found : user_pref("CT2269050.RadioMediaID", "12473383");

Found : user_pref("CT2269050.RadioMediaType", "Media Player");

Found : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");

Found : user_pref("CT2269050.RadioStationName", "Hotmix%20108");

Found : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");

Found : user_pref("CT2269050.SHRINK_TOOLBAR", 1);

Found : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]

Found : user_pref("CT2269050.SearchFromAddressBarIsInit", true);

Found : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...]

Found : user_pref("CT2269050.SearchInNewTabEnabled", true);

Found : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);

Found : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Tue Oct 19 2010 12:50:51 GMT+0200");

Found : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Found : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

Found : user_pref("CT2269050.SettingsCheckIntervalMin", 120);

Found : user_pref("CT2269050.SettingsLastCheckTime", "Tue Oct 19 2010 12:50:50 GMT+0200");

Found : user_pref("CT2269050.SettingsLastUpdate", "1283947033");

Found : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);

Found : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Mon Oct 11 2010 15:35:28 GMT+0200");

Found : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1277823092");

Found : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]

Found : user_pref("CT2269050.UserID", "UN27564559127815888");

Found : user_pref("CT2269050.ValidationData_Toolbar", 2);

Found : user_pref("CT2269050.WeatherNetwork", "");

Found : user_pref("CT2269050.WeatherPollDate", "Tue Oct 19 2010 23:06:14 GMT+0200");

Found : user_pref("CT2269050.WeatherUnit", "C");

Found : user_pref("CT2269050.alertChannelId", "666138");

Found : user_pref("CT2269050.clientLogIsEnabled", false);

Found : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]

Found : user_pref("CT2269050.myStuffEnabled", true);

Found : user_pref("CT2269050.myStuffPublihserMinWidth", 400);

Found : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Found : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);

Found : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Found : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]

Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]

Found : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");

Found : user_pref("CommunityToolbar.EngineOwnerGuid", "engine@conduit.com");

Found : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");

Found : user_pref("CommunityToolbar.IsEngineShown", true);

Found : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Found : user_pref("CommunityToolbar.OriginalEngineOwner", "ConduitEngine");

Found : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "engine@conduit.com");

Found : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "conduitengine");

Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]

Found : user_pref("CommunityToolbar.ToolbarsList", "CT2269050,ConduitEngine");

Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050");

Found : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Sun Apr 17 2011 12:38:16 GMT+02[...]

Found : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Found : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Thu Jun 23 2011 21:22:51 GMT+0200");

Found : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Found : user_pref("CommunityToolbar.alert.locale", "en");

Found : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Found : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Thu Jun 23 2011 21:22:34 GMT+0200");

Found : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Found : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Found : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Found : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Found : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Found : user_pref("CommunityToolbar.alert.userId", "b5421584-f205-44d4-9f6e-721ca1bff232");

Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Tue Oct 19 2010 12:50:52 GMT+0200");

Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2269050");

Found : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Thu Jun 23 2011 21:22:52 GMT+0200");

Found : user_pref("ConduitEngine.CTID", "ConduitEngine");

Found : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Thu Jun 23 2011 21:22:35 GMT+0200");

Found : user_pref("ConduitEngine.FirstServerDate", "04/17/2011 13");

Found : user_pref("ConduitEngine.FirstTime", true);

Found : user_pref("ConduitEngine.FirstTimeFF3", true);

Found : user_pref("ConduitEngine.HasUserGlobalKeys", true);

Found : user_pref("ConduitEngine.Initialize", true);

Found : user_pref("ConduitEngine.InitializeCommonPrefs", true);

Found : user_pref("ConduitEngine.InstalledDate", "Sun Apr 17 2011 12:38:43 GMT+0200");

Found : user_pref("ConduitEngine.IsMulticommunity", false);

Found : user_pref("ConduitEngine.IsOpenThankYouPage", false);

Found : user_pref("ConduitEngine.IsOpenUninstallPage", true);

Found : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Thu Jun 23 2011 21:22:35 GMT+0200");

Found : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Fri Jun 24 2011 22:47:22 GMT+0200");

Found : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Found : user_pref("ConduitEngine.SettingsLastCheckTime", "Sat Jun 25 2011 10:55:14 GMT+0200");

Found : user_pref("ConduitEngine.UserID", "UN82722810469284797");

Found : user_pref("ConduitEngine.componentAlertEnabled", false);

Found : user_pref("ConduitEngine.engineLocale", "de");

Found : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Thu Jun 23 2011 21:22:35 GMT+0200");

Found : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Sat Jun 25 2011 10:55:13 GMT+0200");

Found : user_pref("ConduitEngine.initDone", true);

Found : user_pref("ConduitEngine.isAppTrackingManagerOn", true);

Found : user_pref("ConduitEngine.usagesFlag", 1);

Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&Sea[...]
 

*************************
 

AdwCleaner[R1].txt - [16308 octets] - [13/08/2012 20:01:32]
 

########## EOF - C:\AdwCleaner[R1].txt - [16437 octets] ##########

Gruß

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Code:

# AdwCleaner v1.800 - Logfile created 08/13/2012 at 20:38:58

# Updated 01/08/2012 by Xplode

# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

# User : *** - ***

# Running from : C:\Users\***\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

Folder Deleted : C:\Users\***\AppData\Local\Conduit

Folder Deleted : C:\Users\***\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\***\AppData\LocalLow\ConduitEngine

Folder Deleted : C:\Users\***\AppData\LocalLow\DVDVideoSoftTB

Folder Deleted : C:\Users\***\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\Conduit

Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\ConduitEngine

Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\CT2269050

Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}

Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}

Folder Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\extensions\engine@conduit.com

Folder Deleted : C:\Program Files\Conduit

Folder Deleted : C:\Program Files\ConduitEngine

Folder Deleted : C:\Program Files\DAEMON Tools Toolbar

Folder Deleted : C:\Program Files\DVDVideoSoftTB

File Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\Conduit.xml

File Deleted : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\searchplugins\daemon-search.xml

File Deleted : C:\Windows\system32\conduitEngine.tmp
 

***** [Registry] *****

[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2269050

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\conduitEngine

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Toolbar

Key Deleted : HKLM\SOFTWARE\ASKInstaller

Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Deleted : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj

Key Deleted : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj.1

Key Deleted : HKLM\SOFTWARE\Conduit

Key Deleted : HKLM\SOFTWARE\conduitEngine

Key Deleted : HKLM\SOFTWARE\DT Soft

Key Deleted : HKLM\SOFTWARE\DVDVideoSoftTB

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Conduit Engine 

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
 

***** [Registre - GUID] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C904CFF-5709-4AD1-867E-4F226D302BEB}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B56F2FDE-5DE3-4CE0-A702-6FA887D99BE3}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AD4E2463-C238-4F44-80B4-A21EC55125AE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{932E4585-ECC6-4BE5-90CB-505EE8A66AE7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{46746DB5-B681-4DA5-AA0E-B5E38A0CC63F}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B56F2FDE-5DE3-4CE0-A702-6FA887D99BE3}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v9.0.8112.16421
 

[OK] Registry is clean.
 

-\\ Mozilla Firefox v14.0.1 (de)
 

Profile name : default 

File : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\prefs.js
 

C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\5um2nqxm.default\user.js ... Deleted !
 

Deleted : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Deleted : user_pref("CT2269050.CTID", "CT2269050");

Deleted : user_pref("CT2269050.CurrentServerDate", "19-10-2010");

Deleted : user_pref("CT2269050.DialogsAlignMode", "LTR");

Deleted : user_pref("CT2269050.DownloadReferralCookieData", "");

Deleted : user_pref("CT2269050.EMailNotifierPollDate", "Tue Oct 19 2010 23:06:14 GMT+0200");

Deleted : user_pref("CT2269050.FirstServerDate", "16-6-2010");

Deleted : user_pref("CT2269050.FirstTime", true);

Deleted : user_pref("CT2269050.FirstTimeFF3", true);

Deleted : user_pref("CT2269050.FirstTimeSettingsDone", true);

Deleted : user_pref("CT2269050.FixPageNotFoundErrors", true);

Deleted : user_pref("CT2269050.GroupingServerCheckInterval", 1440);

Deleted : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Deleted : user_pref("CT2269050.Initialize", true);

Deleted : user_pref("CT2269050.InitializeCommonPrefs", true);

Deleted : user_pref("CT2269050.InstallationAndCookieDataSentCount", 3);

Deleted : user_pref("CT2269050.InstalledDate", "Wed Jun 16 2010 12:15:44 GMT+0200");

Deleted : user_pref("CT2269050.InvalidateCache", false);

Deleted : user_pref("CT2269050.IsGrouping", false);

Deleted : user_pref("CT2269050.IsMulticommunity", false);

Deleted : user_pref("CT2269050.IsOpenThankYouPage", false);

Deleted : user_pref("CT2269050.IsOpenUninstallPage", false);

Deleted : user_pref("CT2269050.LanguagePackLastCheckTime", "Tue Oct 19 2010 12:50:52 GMT+0200");

Deleted : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);

Deleted : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Deleted : user_pref("CT2269050.LastLogin_2.5.8.6", "Sat Aug 14 2010 11:31:50 GMT+0200");

Deleted : user_pref("CT2269050.LastLogin_2.7.0.14", "Wed Sep 01 2010 13:20:19 GMT+0200");

Deleted : user_pref("CT2269050.LastLogin_2.7.2.0", "Tue Oct 19 2010 22:36:13 GMT+0200");

Deleted : user_pref("CT2269050.LatestVersion", "2.7.2.0");

Deleted : user_pref("CT2269050.Locale", "en");

Deleted : user_pref("CT2269050.LoginCache", 4);

Deleted : user_pref("CT2269050.MCDetectTooltipHeight", "83");

Deleted : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Deleted : user_pref("CT2269050.MCDetectTooltipWidth", "295");

Deleted : user_pref("CT2269050.RadioIsPodcast", false);

Deleted : user_pref("CT2269050.RadioLastCheckTime", "Tue Oct 19 2010 12:50:52 GMT+0200");

Deleted : user_pref("CT2269050.RadioLastUpdateIPServer", "3");

Deleted : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");

Deleted : user_pref("CT2269050.RadioMediaID", "12473383");

Deleted : user_pref("CT2269050.RadioMediaType", "Media Player");

Deleted : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");

Deleted : user_pref("CT2269050.RadioStationName", "Hotmix%20108");

Deleted : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");

Deleted : user_pref("CT2269050.SHRINK_TOOLBAR", 1);

Deleted : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]

Deleted : user_pref("CT2269050.SearchFromAddressBarIsInit", true);

Deleted : user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT226[...]

Deleted : user_pref("CT2269050.SearchInNewTabEnabled", true);

Deleted : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);

Deleted : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Tue Oct 19 2010 12:50:51 GMT+0200");

Deleted : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]

Deleted : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]

Deleted : user_pref("CT2269050.SettingsCheckIntervalMin", 120);

Deleted : user_pref("CT2269050.SettingsLastCheckTime", "Tue Oct 19 2010 12:50:50 GMT+0200");

Deleted : user_pref("CT2269050.SettingsLastUpdate", "1283947033");

Deleted : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);

Deleted : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Mon Oct 11 2010 15:35:28 GMT+0200");

Deleted : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1277823092");

Deleted : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=[...]

Deleted : user_pref("CT2269050.UserID", "UN27564559127815888");

Deleted : user_pref("CT2269050.ValidationData_Toolbar", 2);

Deleted : user_pref("CT2269050.WeatherNetwork", "");

Deleted : user_pref("CT2269050.WeatherPollDate", "Tue Oct 19 2010 23:06:14 GMT+0200");

Deleted : user_pref("CT2269050.WeatherUnit", "C");

Deleted : user_pref("CT2269050.alertChannelId", "666138");

Deleted : user_pref("CT2269050.clientLogIsEnabled", false);

Deleted : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]

Deleted : user_pref("CT2269050.myStuffEnabled", true);

Deleted : user_pref("CT2269050.myStuffPublihserMinWidth", 400);

Deleted : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]

Deleted : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);

Deleted : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]

Deleted : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]

Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]

Deleted : user_pref("CommunityToolbar.EngineOwner", "ConduitEngine");

Deleted : user_pref("CommunityToolbar.EngineOwnerGuid", "engine@conduit.com");

Deleted : user_pref("CommunityToolbar.EngineOwnerToolbarId", "conduitengine");

Deleted : user_pref("CommunityToolbar.IsEngineShown", true);

Deleted : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);

Deleted : user_pref("CommunityToolbar.OriginalEngineOwner", "ConduitEngine");

Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "engine@conduit.com");

Deleted : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "conduitengine");

Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]

Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2269050,ConduitEngine");

Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050");

Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Sun Apr 17 2011 12:38:16 GMT+02[...]

Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);

Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Thu Jun 23 2011 21:22:51 GMT+0200");

Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");

Deleted : user_pref("CommunityToolbar.alert.locale", "en");

Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);

Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Thu Jun 23 2011 21:22:34 GMT+0200");

Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");

Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);

Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");

Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);

Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);

Deleted : user_pref("CommunityToolbar.alert.userId", "b5421584-f205-44d4-9f6e-721ca1bff232");

Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Tue Oct 19 2010 12:50:52 GMT+0200");

Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2269050");

Deleted : user_pref("ConduitEngine.AppTrackingLastCheckTime", "Thu Jun 23 2011 21:22:52 GMT+0200");

Deleted : user_pref("ConduitEngine.CTID", "ConduitEngine");

Deleted : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Thu Jun 23 2011 21:22:35 GMT+0200");

Deleted : user_pref("ConduitEngine.FirstServerDate", "04/17/2011 13");

Deleted : user_pref("ConduitEngine.FirstTime", true);

Deleted : user_pref("ConduitEngine.FirstTimeFF3", true);

Deleted : user_pref("ConduitEngine.HasUserGlobalKeys", true);

Deleted : user_pref("ConduitEngine.Initialize", true);

Deleted : user_pref("ConduitEngine.InitializeCommonPrefs", true);

Deleted : user_pref("ConduitEngine.InstalledDate", "Sun Apr 17 2011 12:38:43 GMT+0200");

Deleted : user_pref("ConduitEngine.IsMulticommunity", false);

Deleted : user_pref("ConduitEngine.IsOpenThankYouPage", false);

Deleted : user_pref("ConduitEngine.IsOpenUninstallPage", true);

Deleted : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Thu Jun 23 2011 21:22:35 GMT+0200");

Deleted : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Fri Jun 24 2011 22:47:22 GMT+0200");

Deleted : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);

Deleted : user_pref("ConduitEngine.SettingsLastCheckTime", "Sat Jun 25 2011 10:55:14 GMT+0200");

Deleted : user_pref("ConduitEngine.UserID", "UN82722810469284797");

Deleted : user_pref("ConduitEngine.componentAlertEnabled", false);

Deleted : user_pref("ConduitEngine.engineLocale", "de");

Deleted : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Thu Jun 23 2011 21:22:35 GMT+0200");

Deleted : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Sat Jun 25 2011 10:55:13 GMT+0200");

Deleted : user_pref("ConduitEngine.initDone", true);

Deleted : user_pref("ConduitEngine.isAppTrackingManagerOn", true);

Deleted : user_pref("ConduitEngine.usagesFlag", 1);

Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&Sea[...]
 

*************************
 

AdwCleaner[R1].txt - [16240 octets] - [13/08/2012 20:01:32]

AdwCleaner[S1].txt - [16709 octets] - [13/08/2012 20:38:58]
 

########## EOF - C:\AdwCleaner[S1].txt - [16838 octets] ##########

Gruß

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Zu 1.: Der normale Modus geht. Allerdings ist der "WebGuard" von Avira noch immer deaktiviert und lässt sich auch nciht aktivieren. Neuinstallation?

Zu 2.: Es ist alles vorhanden und keine leeren Ordner.

Dankeschön!