Trojaner-Board - Weißer Bildschirm, "Website kann nicht angezeigt werden

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Weißer Bildschirm, "Website kann nicht angezeigt werden (https://www.trojaner-board.de/126001-weisser-bildschirm-website-angezeigt.html)

JimmyRainer

22.10.2012 17:24

Weißer Bildschirm, "Website kann nicht angezeigt werden

Hallo habe folgendes problem

Beim Starten des PCs erscheint ein weißer Bildschirm mit der Botschaft "Website kann nicht angezeigt werden" als Problembehebung wird nur das Aktalisieren der Website vorgeschlagen. Kann weder auf Programme, Desktop etc. zugreifen, die Darstellung überdeckt alles.

MFG

Zitat:

OTL logfile created on: 10/22/2012 5:13:23 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 88.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.29 Mb Free Space | 74.29% Space Free | Partition Type: NTFS
Drive D: | 160.88 Gb Total Space | 55.16 Gb Free Space | 34.29% Space Free | Partition Type: NTFS
Drive E: | 290.78 Gb Total Space | 278.19 Gb Free Space | 95.67% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/06/15 06:51:56 | 000,822,304 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2010/04/20 19:34:40 | 000,202,752 | ---- | M] (AMD) [Auto] -- D:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010/01/28 19:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto] -- D:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009/11/02 07:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand] -- D:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/10/09 14:43:27 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/10/01 21:32:58 | 000,193,568 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- D:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2012/10/01 21:32:04 | 005,783,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- D:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/09/07 21:38:40 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/09/07 11:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/07 11:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/08/13 07:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled] -- D:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/11/21 05:49:24 | 000,247,608 | ---- | M] () [Disabled] -- D:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010/09/30 09:00:28 | 000,253,264 | ---- | M] () [Auto] -- D:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010/08/10 05:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto] -- D:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010/07/29 08:16:12 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto] -- D:\Program Files (x86)\Bluetooth Suite\AdminService.exe -- (AtherosSvc)
SRV - [2010/07/01 00:10:26 | 002,533,400 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010/07/01 00:10:22 | 000,325,656 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010/06/28 18:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto] -- D:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010/05/26 22:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand] -- D:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/08 09:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012/10/04 21:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- D:\Windows\System32\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2012/10/02 19:32:40 | 000,031,080 | ---- | M] (AVG Technologies) [Kernel | System] -- D:\Windows\System32\drivers\avgtpx64.sys -- (avgtp)
DRV:64bit: - [2012/10/01 21:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- D:\Windows\System32\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2012/09/20 21:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- D:\Windows\System32\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2012/09/20 21:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot] -- D:\Windows\System32\drivers\avgloga.sys -- (Avgloga)
DRV:64bit: - [2012/09/20 21:45:50 | 000,061,792 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- D:\Windows\System32\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2012/09/13 21:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- D:\Windows\System32\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2012/09/12 21:11:18 | 000,151,904 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System] -- D:\Windows\System32\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2012/09/07 11:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- D:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012/02/15 18:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2012/02/15 18:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2010/11/17 08:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010/07/29 08:16:30 | 000,270,496 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2010/07/29 08:16:28 | 000,295,072 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2010/07/29 08:16:28 | 000,201,376 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2010/07/29 08:16:28 | 000,154,272 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2010/07/29 08:16:28 | 000,051,872 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2010/07/29 08:16:28 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2010/07/29 08:16:28 | 000,028,832 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2010/07/15 17:57:34 | 002,350,952 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/06/24 22:33:36 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/06/05 10:27:58 | 010,326,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\igdpmd64.sys -- (intelkmd)
DRV:64bit: - [2010/05/05 17:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010/04/20 21:15:04 | 006,406,144 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atipmdag.sys -- (amdkmdag)
DRV:64bit: - [2010/04/20 18:39:36 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010/02/10 03:02:00 | 000,158,720 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2009/11/02 07:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2009/10/29 14:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV:64bit: - [2009/10/29 14:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV:64bit: - [2009/10/29 14:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV:64bit: - [2009/10/29 14:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2009/09/17 00:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/02 22:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 22:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- D:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009/06/02 22:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009/05/26 09:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand] -- D:\Windows\system32\drivers\AmUStor.SYS -- (AmUStor)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.funmoods.com/?f=1&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1QzuzytBzy0F0F0AzytB0E0DzyzyyD0D0A0DtN0D0Tzu0CtCzyzytN1L2XzutBtFtCtFtDtFtAtDtC&cr=1525869463

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_0&u=443F8AC41D7AC23FF253DE4F88C4F014
IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\Viktor_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.search.update: ""
FF - prefs.js..backup.old.browser.search.defaultenginename: ""
FF - prefs.js..backup.old.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: ""
FF - prefs.js..extensions.enabledItems: ""
FF - prefs.js..extensions.enabledItems: ""
FF - prefs.js..extensions.enabledItems: ""
FF - prefs.js..network.proxy.type: ""

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF64_11_4_402_287.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011/01/13 12:54:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/01/13 12:54:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011/01/13 12:54:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.2.5.34\
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/07 21:38:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/09/07 21:38:38 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\Viktor\AppData\Roaming\14001.018 [2012/08/27 06:02:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/07 21:38:40 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/09/07 21:38:38 | 000,000,000 | ---D | M]

[2012/10/02 19:26:31 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Viktor\AppData\Roaming\Mozilla\Extensions
[2012/10/05 14:24:33 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\extensions
[2012/03/28 21:15:34 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- D:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
File not found (No name found) --
File not found (No name found) -- D:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
File not found (No name found) -- D:\PROGRAM FILES (X86)\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\14001.003
File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{87934C42-161D-45BC-8CEF-EF18ABE2A30C}
File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1}
File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\BBRS_002@BLABBERS.COM
File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\FFXTLBR@FUNMOODS.COM
() (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI
[2012/09/07 21:38:40 | 000,266,720 | ---- | M] (Mozilla Foundation) -- D:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/03/19 20:07:54 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- D:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - File not found
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg64.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - D:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O3 - HKU\Viktor_ON_D\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] D:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LManager] D:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [ROC_ROC_NT] File not found
O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Viktor_ON_D..\Run: [qovcazdihoegacq] D:\Windows\qovcazdi.exe ()
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] File not found
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (systempropertiesperformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/10/22 07:51:41 | 000,000,000 | ---D | C] -- D:\ProgramData\llpesmvihzxvnkp
[2012/10/15 11:29:23 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/10/10 12:11:20 | 005,505,904 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntoskrnl.exe
[2012/10/10 12:11:19 | 003,958,128 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ntkrnlpa.exe
[2012/10/10 12:11:19 | 003,902,832 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ntoskrnl.exe
[2012/10/10 12:11:08 | 001,162,240 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\kernel32.dll
[2012/10/10 12:11:08 | 000,425,984 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\KernelBase.dll
[2012/10/10 12:11:08 | 000,338,432 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\conhost.exe
[2012/10/10 12:11:08 | 000,215,040 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\winsrv.dll
[2012/10/10 12:11:07 | 000,362,496 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64win.dll
[2012/10/10 12:11:07 | 000,243,200 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64.dll
[2012/10/10 12:11:07 | 000,025,600 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\setup16.exe
[2012/10/10 12:11:07 | 000,016,384 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntvdm64.dll
[2012/10/10 12:11:07 | 000,014,336 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ntvdm64.dll
[2012/10/10 12:11:07 | 000,013,312 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64cpu.dll
[2012/10/10 12:11:07 | 000,007,680 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\instnm.exe
[2012/10/10 12:11:07 | 000,005,120 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\wow32.dll
[2012/10/10 12:11:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2012/10/10 12:11:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012/10/10 12:11:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2012/10/10 12:11:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2012/10/10 12:11:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2012/10/10 12:11:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2012/10/10 12:11:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2012/10/10 12:11:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2012/10/10 12:11:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2012/10/10 12:11:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2012/10/10 12:11:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012/10/10 12:11:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2012/10/10 12:11:03 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012/10/10 12:11:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012/10/10 12:11:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2012/10/10 12:11:02 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012/10/10 12:11:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012/10/10 12:11:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2012/10/10 12:11:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012/10/10 12:11:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012/10/10 12:11:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012/10/10 12:11:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2012/10/10 12:10:59 | 000,002,048 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\user.exe
[2012/10/10 12:10:51 | 000,220,160 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wintrust.dll
[2012/10/10 12:10:51 | 000,172,544 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\wintrust.dll
[2012/10/10 12:10:38 | 001,462,784 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\crypt32.dll
[2012/10/10 12:10:38 | 000,140,288 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\cryptnet.dll
[2012/10/04 21:26:22 | 000,111,456 | ---- | C] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgmfx64.sys
[2012/10/03 00:52:03 | 002,237,440 | R--- | C] (OldTimer Tools) -- D:\OTLPE.exe
[2012/10/02 21:04:28 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Roaming\Malwarebytes
[2012/10/02 21:04:06 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/10/02 21:04:06 | 000,000,000 | ---D | C] -- D:\ProgramData\Malwarebytes
[2012/10/02 21:04:05 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- D:\Windows\System32\drivers\mbam.sys
[2012/10/02 21:04:05 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/10/02 19:34:08 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Roaming\AVG2013
[2012/10/02 19:32:40 | 000,031,080 | ---- | C] (AVG Technologies) -- D:\Windows\System32\drivers\avgtpx64.sys
[2012/10/02 19:31:18 | 000,000,000 | -H-D | C] -- D:\$AVG
[2012/10/02 19:31:17 | 000,000,000 | ---D | C] -- D:\ProgramData\AVG2013
[2012/10/02 19:30:28 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\AVG
[2012/10/02 19:27:05 | 000,000,000 | -H-D | C] -- D:\ProgramData\Common Files
[2012/10/02 19:27:05 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Local\MFAData
[2012/10/02 19:27:05 | 000,000,000 | ---D | C] -- D:\ProgramData\MFAData
[2012/10/02 19:27:05 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Local\Avg2013
[2012/10/01 23:55:58 | 000,000,000 | ---D | C] -- D:\_OTL
[2012/10/01 21:30:38 | 000,185,696 | ---- | C] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgldx64.sys
[2012/09/24 14:21:31 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Local\Macromedia
[2012/09/24 14:15:08 | 000,696,760 | ---- | C] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerApp.exe
[3 D:\Users\Viktor\AppData\Roaming\*.tmp files -> D:\Users\Viktor\AppData\Roaming\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/10/22 09:57:47 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2012/10/22 09:57:43 | 000,327,680 | ---- | M] () -- D:\Windows\System32\Ikeext.etl
[2012/10/22 09:57:06 | 000,001,106 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/10/22 09:56:36 | 2960,510,976 | -HS- | M] () -- D:\hiberfil.sys
[2012/10/22 09:43:55 | 265,040,132 | ---- | M] () -- D:\Windows\MEMORY.DMP
[2012/10/22 09:11:09 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/22 09:11:09 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/22 08:43:17 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job
[2012/10/22 07:55:00 | 000,001,110 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/10/22 07:51:41 | 000,076,353 | ---- | M] () -- D:\ProgramData\ohlbxzxxfguuovt
[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\Windows\qovcazdi.exe
[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\ProgramData\qovcazdi.exe
[2012/10/22 06:00:07 | 000,044,349 | ---- | M] () -- D:\Users\Viktor\Desktop\osA2V.jpg
[2012/10/21 11:35:38 | 000,048,761 | ---- | M] () -- D:\Users\Viktor\Desktop\416861_391747790894859_2014962406_n.jpg
[2012/10/20 19:27:58 | 000,047,794 | ---- | M] () -- D:\Users\Viktor\Desktop\579150_391748687561436_1589916956_n.jpg
[2012/10/15 11:29:23 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
[2012/10/14 16:39:30 | 000,654,400 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2012/10/14 16:39:30 | 000,616,242 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2012/10/14 16:39:30 | 000,130,240 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2012/10/14 16:39:30 | 000,106,622 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2012/10/09 15:44:46 | 000,052,188 | ---- | M] () -- D:\Users\Viktor\Desktop\getjvj.jpg
[2012/10/09 15:29:45 | 000,074,199 | ---- | M] () -- D:\Users\Viktor\Desktop\getgg.jpg
[2012/10/09 15:06:22 | 000,068,747 | ---- | M] () -- D:\Users\Viktor\Desktop\get.jpg
[2012/10/09 14:43:27 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerApp.exe
[2012/10/09 14:43:27 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/10/04 21:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgmfx64.sys
[2012/10/03 19:17:44 | 000,029,921 | ---- | M] () -- D:\Users\Viktor\Desktop\15195908E.jpg
[2012/10/03 19:17:36 | 000,014,462 | ---- | M] () -- D:\Users\Viktor\Desktop\24203316a.jpg
[2012/10/02 21:04:06 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/10/02 20:55:43 | 000,000,000 | R--D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2012/10/02 19:32:40 | 000,031,080 | ---- | M] (AVG Technologies) -- D:\Windows\System32\drivers\avgtpx64.sys
[2012/10/01 21:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgldx64.sys
[2012/09/23 15:41:23 | 000,120,249 | ---- | M] () -- D:\Users\Viktor\Desktop\229945_399044770152906_724560029_n.jpg
[2012/09/23 11:31:21 | 000,083,829 | ---- | M] () -- D:\Users\Viktor\Desktop\264109_465157953517111_1683313455_n.jpg
[2012/09/23 06:11:27 | 000,056,465 | ---- | M] () -- D:\Users\Viktor\Desktop\383466_517961104885261_816712024_n.jpg
[3 D:\Users\Viktor\AppData\Roaming\*.tmp files -> D:\Users\Viktor\AppData\Roaming\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/10/22 07:51:40 | 000,132,608 | ---- | C] () -- D:\Windows\qovcazdi.exe
[2012/10/22 07:51:40 | 000,132,608 | ---- | C] () -- D:\ProgramData\qovcazdi.exe
[2012/10/22 07:51:00 | 000,076,353 | ---- | C] () -- D:\ProgramData\ohlbxzxxfguuovt
[2012/10/22 06:00:06 | 000,044,349 | ---- | C] () -- D:\Users\Viktor\Desktop\osA2V.jpg
[2012/10/21 11:35:34 | 000,048,761 | ---- | C] () -- D:\Users\Viktor\Desktop\416861_391747790894859_2014962406_n.jpg
[2012/10/20 19:27:57 | 000,047,794 | ---- | C] () -- D:\Users\Viktor\Desktop\579150_391748687561436_1589916956_n.jpg
[2012/10/09 15:44:46 | 000,052,188 | ---- | C] () -- D:\Users\Viktor\Desktop\getjvj.jpg
[2012/10/09 15:29:45 | 000,074,199 | ---- | C] () -- D:\Users\Viktor\Desktop\getgg.jpg
[2012/10/09 15:06:22 | 000,068,747 | ---- | C] () -- D:\Users\Viktor\Desktop\get.jpg
[2012/10/03 19:17:44 | 000,029,921 | ---- | C] () -- D:\Users\Viktor\Desktop\15195908E.jpg
[2012/10/03 19:17:34 | 000,014,462 | ---- | C] () -- D:\Users\Viktor\Desktop\24203316a.jpg
[2012/09/24 14:15:08 | 000,000,884 | ---- | C] () -- D:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/23 15:41:22 | 000,120,249 | ---- | C] () -- D:\Users\Viktor\Desktop\229945_399044770152906_724560029_n.jpg
[2012/09/23 11:29:44 | 000,083,829 | ---- | C] () -- D:\Users\Viktor\Desktop\264109_465157953517111_1683313455_n.jpg
[2012/09/23 06:11:27 | 000,056,465 | ---- | C] () -- D:\Users\Viktor\Desktop\383466_517961104885261_816712024_n.jpg
[2012/08/28 18:19:34 | 000,065,536 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\pjq5x742.default.dat
[2012/07/23 08:50:30 | 000,000,025 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\urhtps.dat
[2011/06/14 05:36:39 | 000,000,064 | ---- | C] () -- D:\Windows\SysWow64\rp_stats.dat
[2011/06/14 05:36:39 | 000,000,044 | ---- | C] () -- D:\Windows\SysWow64\rp_rules.dat
[2011/04/13 15:59:14 | 000,059,904 | ---- | C] () -- D:\Windows\SysWow64\OVDecode.dll
[2011/02/15 12:52:16 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat
[2011/01/13 12:41:19 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin
[2011/01/13 12:37:22 | 000,002,093 | ---- | C] () -- D:\Windows\SysWow64\atipblup.dat
[2010/09/08 04:17:26 | 000,870,560 | ---- | C] () -- D:\Windows\SysWow64\igkrng575.bin
[2010/09/08 04:17:26 | 000,208,896 | ---- | C] () -- D:\Windows\SysWow64\iglhsip32.dll
[2010/09/08 04:17:26 | 000,143,360 | ---- | C] () -- D:\Windows\SysWow64\iglhcp32.dll
[2010/09/08 04:17:26 | 000,104,636 | ---- | C] () -- D:\Windows\SysWow64\igfcg575m.bin
[2010/09/08 04:17:25 | 000,127,868 | ---- | C] () -- D:\Windows\SysWow64\igcompkrng575.bin
[2010/09/08 04:17:24 | 000,002,093 | ---- | C] () -- D:\Windows\SysWow64\atipblag.dat
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2010/09/08 03:52:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Acer
[2010/09/08 03:34:08 | 000,000,000 | ---D | M] -- D:\ProgramData\AmUStor
[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2011/02/14 18:56:11 | 000,000,000 | ---D | M] -- D:\ProgramData\ashampoo
[2012/10/03 02:53:13 | 000,000,000 | ---D | M] -- D:\ProgramData\AVAST Software
[2012/10/02 20:07:38 | 000,000,000 | ---D | M] -- D:\ProgramData\AVG2013
[2010/09/08 04:04:17 | 000,000,000 | ---D | M] -- D:\ProgramData\BackupManager
[2012/06/20 08:45:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Battle.net
[2012/05/31 11:28:27 | 000,000,000 | -H-D | M] -- D:\ProgramData\CanonBJ
[2012/10/02 19:27:05 | 000,000,000 | -H-D | M] -- D:\ProgramData\Common Files
[2011/02/14 19:10:19 | 000,000,000 | ---D | M] -- D:\ProgramData\createpart
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/01/13 12:42:32 | 000,000,000 | ---D | M] -- D:\ProgramData\EgisTec IPS
[2010/09/08 03:39:41 | 000,000,000 | ---D | M] -- D:\ProgramData\eSobi
[2011/02/14 19:09:58 | 000,000,000 | ---D | M] -- D:\ProgramData\explauncher
[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2012/06/07 17:05:13 | 000,000,000 | ---D | M] -- D:\ProgramData\Friends Games
[2012/07/24 14:18:25 | 000,000,000 | ---D | M] -- D:\ProgramData\GFI Software
[2011/05/12 13:35:47 | 000,000,000 | ---D | M] -- D:\ProgramData\ICQ
[2011/02/14 19:09:55 | 000,000,000 | ---D | M] -- D:\ProgramData\launcher
[2012/10/22 07:51:41 | 000,000,000 | ---D | M] -- D:\ProgramData\llpesmvihzxvnkp
[2012/10/22 06:22:08 | 000,000,000 | ---D | M] -- D:\ProgramData\MFAData
[2010/09/08 03:48:10 | 000,000,000 | ---D | M] -- D:\ProgramData\OberonGameConsole
[2011/02/12 11:26:58 | 000,000,000 | ---D | M] -- D:\ProgramData\oem
[2012/06/08 04:13:07 | 000,000,000 | ---D | M] -- D:\ProgramData\Sandlot Games
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2012/06/20 10:20:35 | 000,000,000 | ---D | M] -- D:\ProgramData\TuneUp Software
[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2011/02/14 18:40:07 | 000,000,000 | -HSD | M] -- D:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012/08/01 03:32:34 | 000,032,640 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto4.bmp:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto3.bmp:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto2.bmp:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto1.bmp:3or4kl4x13tuuug3Byamue2s4b
< End of report >

schrauber

23.10.2012 07:56

Hi,

Fixen mit OTL

Starte die OTLPE.exe..
Kopiere folgendes Skript:

Code:

:OTL

O4 - HKLM..\Run: [ROC_ROC_NT] File not found

O4 - HKU\Viktor_ON_D..\Run: [qovcazdihoegacq] D:\Windows\qovcazdi.exe ()

[2012/10/22 07:51:41 | 000,000,000 | ---D | C] -- D:\ProgramData\llpesmvihzxvnkp

[2012/10/22 07:51:41 | 000,076,353 | ---- | M] () -- D:\ProgramData\ohlbxzxxfguuovt

[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\Windows\qovcazdi.exe

[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\ProgramData\qovcazdi.exe

@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto4.bmp:3or4kl4x13tuuug3Byamue2s4b

@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto3.bmp:3or4kl4x13tuuug3Byamue2s4b

@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto2.bmp:3or4kl4x13tuuug3Byamue2s4b

@Alternate Data Stream - 152 bytes -> D:\Users\Viktor\Desktop\Auto1.bmp:3or4kl4x13tuuug3Byamue2s4b

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.

Rechner normal booten, dann das hier:

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

%windir%\installer\*. /5

%localappdata%\*. /5

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

JimmyRainer

23.10.2012 14:12

leider kommt das bild immer noch und ich kann schritt 2 nicht ausführen

hier ist das ergebnis von schritt eins

Zitat:

registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\ROC_ROC_NT deleted successfully.
Registry key HKEY_USERS\Viktor_ON_D\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
File D:\Windows\qovcazdi.exe not found.
Folder D:\ProgramData\llpesmvihzxvnkp\ not found.
File D:\ProgramData\ohlbxzxxfguuovt not found.
File D:\Windows\qovcazdi.exe not found.
File D:\ProgramData\qovcazdi.exe not found.
Unable to delete ADS D:\Users\Viktor\Desktop\Auto4.bmp:3or4kl4x13tuuug3Byamue2s4b .
Unable to delete ADS D:\Users\Viktor\Desktop\Auto3.bmp:3or4kl4x13tuuug3Byamue2s4b .
Unable to delete ADS D:\Users\Viktor\Desktop\Auto2.bmp:3or4kl4x13tuuug3Byamue2s4b .
Unable to delete ADS D:\Users\Viktor\Desktop\Auto1.bmp:3or4kl4x13tuuug3Byamue2s4b .

OTLPE by OldTimer - Version 3.1.48.0 log created on 10232012_190117

schrauber

23.10.2012 14:14

Mach mal bitte mit OTLPE ein neues Scan-Logfile und poste es.

JimmyRainer

23.10.2012 16:10

hier ist das ergebniss

OTL Logfile:

Code:

OTL logfile created on: 10/23/2012 9:45:07 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 88.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)

Drive C: | 100.00 Mb Total Space | 74.29 Mb Free Space | 74.29% Space Free | Partition Type: NTFS

Drive D: | 160.88 Gb Total Space | 55.00 Gb Free Space | 34.19% Space Free | Partition Type: NTFS

Drive E: | 290.78 Gb Total Space | 278.19 Gb Free Space | 95.67% Space Free | Partition Type: NTFS

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010/06/15 06:51:56 | 000,822,304 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)

SRV:64bit: - [2010/04/20 19:34:40 | 000,202,752 | ---- | M] (AMD) [Auto] -- D:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2010/01/28 19:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto] -- D:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)

SRV:64bit: - [2009/11/02 07:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand] -- D:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)

SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2012/10/09 14:43:27 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012/10/01 21:32:58 | 000,193,568 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- D:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)

SRV - [2012/10/01 21:32:04 | 005,783,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- D:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2012/09/07 21:38:40 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012/09/07 11:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012/09/07 11:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2012/08/13 07:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled] -- D:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)

SRV - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2010/11/21 05:49:24 | 000,247,608 | ---- | M] () [Disabled] -- D:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)

SRV - [2010/09/30 09:00:28 | 000,253,264 | ---- | M] () [Auto] -- D:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)

SRV - [2010/08/10 05:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto] -- D:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)

SRV - [2010/07/29 08:16:12 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto] -- D:\Program Files (x86)\Bluetooth Suite\AdminService.exe -- (AtherosSvc)

SRV - [2010/07/01 00:10:26 | 002,533,400 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010/07/01 00:10:22 | 000,325,656 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010/06/28 18:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto] -- D:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)

SRV - [2010/05/26 22:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand] -- D:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)

SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010/01/08 09:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)

SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012/10/04 21:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- D:\Windows\System32\drivers\avgmfx64.sys -- (Avgmfx64)

DRV:64bit: - [2012/10/02 19:32:40 | 000,031,080 | ---- | M] (AVG Technologies) [Kernel | System] -- D:\Windows\System32\drivers\avgtpx64.sys -- (avgtp)

DRV:64bit: - [2012/10/01 21:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- D:\Windows\System32\drivers\avgldx64.sys -- (Avgldx64)

DRV:64bit: - [2012/09/20 21:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- D:\Windows\System32\drivers\avgtdia.sys -- (Avgtdia)

DRV:64bit: - [2012/09/20 21:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot] -- D:\Windows\System32\drivers\avgloga.sys -- (Avgloga)

DRV:64bit: - [2012/09/20 21:45:50 | 000,061,792 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- D:\Windows\System32\drivers\avgidsha.sys -- (AVGIDSHA)

DRV:64bit: - [2012/09/13 21:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- D:\Windows\System32\drivers\avgrkx64.sys -- (Avgrkx64)

DRV:64bit: - [2012/09/12 21:11:18 | 000,151,904 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System] -- D:\Windows\System32\drivers\avgidsdrivera.sys -- (AVGIDSDriver)

DRV:64bit: - [2012/09/07 11:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- D:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012/02/15 18:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)

DRV:64bit: - [2012/02/15 18:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)

DRV:64bit: - [2010/11/17 08:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2010/07/29 08:16:30 | 000,270,496 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btfilter.sys -- (BtFilter)

DRV:64bit: - [2010/07/29 08:16:28 | 000,295,072 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)

DRV:64bit: - [2010/07/29 08:16:28 | 000,201,376 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)

DRV:64bit: - [2010/07/29 08:16:28 | 000,154,272 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)

DRV:64bit: - [2010/07/29 08:16:28 | 000,051,872 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)

DRV:64bit: - [2010/07/29 08:16:28 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)

DRV:64bit: - [2010/07/29 08:16:28 | 000,028,832 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)

DRV:64bit: - [2010/07/15 17:57:34 | 002,350,952 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athrx.sys -- (athr)

DRV:64bit: - [2010/06/24 22:33:36 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2010/06/05 10:27:58 | 010,326,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\igdpmd64.sys -- (intelkmd)

DRV:64bit: - [2010/05/05 17:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2010/04/20 21:15:04 | 006,406,144 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atipmdag.sys -- (amdkmdag)

DRV:64bit: - [2010/04/20 18:39:36 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2010/02/10 03:02:00 | 000,158,720 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Impcd.sys -- (Impcd)

DRV:64bit: - [2009/11/02 07:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\TurboB.sys -- (TurboB)

DRV:64bit: - [2009/10/29 14:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)

DRV:64bit: - [2009/10/29 14:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)

DRV:64bit: - [2009/10/29 14:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)

DRV:64bit: - [2009/10/29 14:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\massfilter.sys -- (massfilter)

DRV:64bit: - [2009/09/17 00:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECIx64.sys -- (HECIx64) Intel(R)

DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)

DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/02 22:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2009/06/02 22:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- D:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2009/06/02 22:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

DRV:64bit: - [2009/05/26 09:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand] -- D:\Windows\system32\drivers\AmUStor.SYS -- (AmUStor)

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.funmoods.com/?f=1&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1QzuzytBzy0F0F0AzytB0E0DzyzyyD0D0A0DtN0D0Tzu0CtCzyzytN1L2XzutBtFtCtFtDtFtAtDtC&cr=1525869463

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

 

IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_0&u=443F8AC41D7AC23FF253DE4F88C4F014

IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com

IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKU\Viktor_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"

FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"

FF - prefs.js..browser.search.update: ""

FF - prefs.js..backup.old.browser.search.defaultenginename: ""

FF - prefs.js..backup.old.browser.search.selectedEngine: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..browser.search.defaultthis.engineName: ""

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.selectedEngine: ""

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.search.useDBForOrder: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..network.proxy.type: ""

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF64_11_4_402_287.dll ()

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin:  File not found

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011/01/13 12:54:38 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/01/13 12:54:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011/01/13 12:54:47 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.2.5.34\

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/07 21:38:40 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/09/07 21:38:38 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\Viktor\AppData\Roaming\14001.018 [2012/08/27 06:02:26 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/09/07 21:38:40 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/09/07 21:38:38 | 000,000,000 | ---D | M]

 

[2012/10/02 19:26:31 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Viktor\AppData\Roaming\Mozilla\Extensions

[2012/10/05 14:24:33 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\extensions

[2012/03/28 21:15:34 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- D:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

File not found (No name found) -- 

File not found (No name found) -- D:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

File not found (No name found) -- D:\PROGRAM FILES (X86)\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\14001.003

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{87934C42-161D-45BC-8CEF-EF18ABE2A30C}

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1}

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\BBRS_002@BLABBERS.COM

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\FFXTLBR@FUNMOODS.COM

() (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI

[2012/09/07 21:38:40 | 000,266,720 | ---- | M] (Mozilla Foundation) -- D:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012/03/19 20:07:54 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- D:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

 

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} -  File not found

O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.7529.1424\swg64.dll (Google Inc.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} -  File not found

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

O3:64bit: - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - D:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} -  File not found

O3 - HKU\Viktor_ON_D\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.

O4 - HKLM..\Run: [AVG_UI] D:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [LManager] D:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\Viktor_ON_D..\Run: [qovcazdihoegacq] D:\Windows\qovcazdi.exe ()

O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin]  File not found

O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin]  File not found

O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O13:64bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)

O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (systempropertiesperformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/10/22 07:51:41 | 000,000,000 | ---D | C] -- D:\ProgramData\llpesmvihzxvnkp

[2012/10/15 11:29:23 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012/10/10 12:11:20 | 005,505,904 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntoskrnl.exe

[2012/10/10 12:11:19 | 003,958,128 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ntkrnlpa.exe

[2012/10/10 12:11:19 | 003,902,832 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ntoskrnl.exe

[2012/10/10 12:11:08 | 001,162,240 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\kernel32.dll

[2012/10/10 12:11:08 | 000,425,984 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\KernelBase.dll

[2012/10/10 12:11:08 | 000,338,432 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\conhost.exe

[2012/10/10 12:11:08 | 000,215,040 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\winsrv.dll

[2012/10/10 12:11:07 | 000,362,496 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64win.dll

[2012/10/10 12:11:07 | 000,243,200 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64.dll

[2012/10/10 12:11:07 | 000,025,600 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\setup16.exe

[2012/10/10 12:11:07 | 000,016,384 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntvdm64.dll

[2012/10/10 12:11:07 | 000,014,336 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ntvdm64.dll

[2012/10/10 12:11:07 | 000,013,312 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64cpu.dll

[2012/10/10 12:11:07 | 000,007,680 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\instnm.exe

[2012/10/10 12:11:07 | 000,005,120 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\wow32.dll

[2012/10/10 12:11:06 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

[2012/10/10 12:11:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

[2012/10/10 12:11:06 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

[2012/10/10 12:11:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

[2012/10/10 12:11:06 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

[2012/10/10 12:11:06 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

[2012/10/10 12:11:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

[2012/10/10 12:11:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

[2012/10/10 12:11:06 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

[2012/10/10 12:11:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

[2012/10/10 12:11:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

[2012/10/10 12:11:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

[2012/10/10 12:11:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

[2012/10/10 12:11:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll

[2012/10/10 12:11:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

[2012/10/10 12:11:03 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

[2012/10/10 12:11:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll

[2012/10/10 12:11:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

[2012/10/10 12:11:02 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

[2012/10/10 12:11:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

[2012/10/10 12:11:02 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

[2012/10/10 12:11:02 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

[2012/10/10 12:11:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

[2012/10/10 12:11:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

[2012/10/10 12:11:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

[2012/10/10 12:10:59 | 000,002,048 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\user.exe

[2012/10/10 12:10:51 | 000,220,160 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wintrust.dll

[2012/10/10 12:10:51 | 000,172,544 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\wintrust.dll

[2012/10/10 12:10:38 | 001,462,784 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\crypt32.dll

[2012/10/10 12:10:38 | 000,140,288 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\cryptnet.dll

[2012/10/04 21:26:22 | 000,111,456 | ---- | C] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgmfx64.sys

[2012/10/03 00:52:03 | 002,237,440 | R--- | C] (OldTimer Tools) -- D:\OTLPE.exe

[2012/10/02 21:04:28 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Roaming\Malwarebytes

[2012/10/02 21:04:06 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/10/02 21:04:06 | 000,000,000 | ---D | C] -- D:\ProgramData\Malwarebytes

[2012/10/02 21:04:05 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- D:\Windows\System32\drivers\mbam.sys

[2012/10/02 21:04:05 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware

[2012/10/02 19:34:08 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Roaming\AVG2013

[2012/10/02 19:32:40 | 000,031,080 | ---- | C] (AVG Technologies) -- D:\Windows\System32\drivers\avgtpx64.sys

[2012/10/02 19:31:18 | 000,000,000 | -H-D | C] -- D:\$AVG

[2012/10/02 19:31:17 | 000,000,000 | ---D | C] -- D:\ProgramData\AVG2013

[2012/10/02 19:30:28 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\AVG

[2012/10/02 19:27:05 | 000,000,000 | -H-D | C] -- D:\ProgramData\Common Files

[2012/10/02 19:27:05 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Local\MFAData

[2012/10/02 19:27:05 | 000,000,000 | ---D | C] -- D:\ProgramData\MFAData

[2012/10/02 19:27:05 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Local\Avg2013

[2012/10/01 23:55:58 | 000,000,000 | ---D | C] -- D:\_OTL

[2012/10/01 21:30:38 | 000,185,696 | ---- | C] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgldx64.sys

[2012/09/24 14:21:31 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Local\Macromedia

[2012/09/24 14:15:08 | 000,696,760 | ---- | C] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerApp.exe

[3 D:\Users\Viktor\AppData\Roaming\*.tmp files -> D:\Users\Viktor\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/10/23 13:08:35 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat

[2012/10/23 13:08:05 | 000,001,106 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012/10/23 13:07:45 | 000,065,536 | ---- | M] () -- D:\Windows\System32\Ikeext.etl

[2012/10/23 13:07:36 | 2960,510,976 | -HS- | M] () -- D:\hiberfil.sys

[2012/10/22 16:47:21 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012/10/22 16:47:21 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012/10/22 09:43:55 | 265,040,132 | ---- | M] () -- D:\Windows\MEMORY.DMP

[2012/10/22 08:43:17 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job

[2012/10/22 07:55:00 | 000,001,110 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012/10/22 07:51:41 | 000,076,353 | ---- | M] () -- D:\ProgramData\ohlbxzxxfguuovt

[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\Windows\qovcazdi.exe

[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\ProgramData\qovcazdi.exe

[2012/10/15 11:29:23 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012/10/14 16:39:30 | 000,654,400 | ---- | M] () -- D:\Windows\System32\perfh007.dat

[2012/10/14 16:39:30 | 000,616,242 | ---- | M] () -- D:\Windows\System32\perfh009.dat

[2012/10/14 16:39:30 | 000,130,240 | ---- | M] () -- D:\Windows\System32\perfc007.dat

[2012/10/14 16:39:30 | 000,106,622 | ---- | M] () -- D:\Windows\System32\perfc009.dat

[2012/10/09 14:43:27 | 000,696,760 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerApp.exe

[2012/10/09 14:43:27 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012/10/04 21:26:22 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgmfx64.sys

[2012/10/02 21:04:06 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/10/02 20:55:43 | 000,000,000 | R--D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

[2012/10/02 19:32:40 | 000,031,080 | ---- | M] (AVG Technologies) -- D:\Windows\System32\drivers\avgtpx64.sys

[2012/10/01 21:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) -- D:\Windows\System32\drivers\avgldx64.sys

[3 D:\Users\Viktor\AppData\Roaming\*.tmp files -> D:\Users\Viktor\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012/10/22 07:51:40 | 000,132,608 | ---- | C] () -- D:\Windows\qovcazdi.exe

[2012/10/22 07:51:40 | 000,132,608 | ---- | C] () -- D:\ProgramData\qovcazdi.exe

[2012/10/22 07:51:00 | 000,076,353 | ---- | C] () -- D:\ProgramData\ohlbxzxxfguuovt

[2012/09/24 14:15:08 | 000,000,884 | ---- | C] () -- D:\Windows\tasks\Adobe Flash Player Updater.job

[2012/08/28 18:19:34 | 000,065,536 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\pjq5x742.default.dat

[2012/07/23 08:50:30 | 000,000,025 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\urhtps.dat

[2011/06/14 05:36:39 | 000,000,064 | ---- | C] () -- D:\Windows\SysWow64\rp_stats.dat

[2011/06/14 05:36:39 | 000,000,044 | ---- | C] () -- D:\Windows\SysWow64\rp_rules.dat

[2011/04/13 15:59:14 | 000,059,904 | ---- | C] () -- D:\Windows\SysWow64\OVDecode.dll

[2011/02/15 12:52:16 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat

[2011/01/13 12:41:19 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin

[2011/01/13 12:37:22 | 000,002,093 | ---- | C] () -- D:\Windows\SysWow64\atipblup.dat

[2010/09/08 04:17:26 | 000,870,560 | ---- | C] () -- D:\Windows\SysWow64\igkrng575.bin

[2010/09/08 04:17:26 | 000,208,896 | ---- | C] () -- D:\Windows\SysWow64\iglhsip32.dll

[2010/09/08 04:17:26 | 000,143,360 | ---- | C] () -- D:\Windows\SysWow64\iglhcp32.dll

[2010/09/08 04:17:26 | 000,104,636 | ---- | C] () -- D:\Windows\SysWow64\igfcg575m.bin

[2010/09/08 04:17:25 | 000,127,868 | ---- | C] () -- D:\Windows\SysWow64\igcompkrng575.bin

[2010/09/08 04:17:24 | 000,002,093 | ---- | C] () -- D:\Windows\SysWow64\atipblag.dat

[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat

[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT

[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat

[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin

[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll

[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll

[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll

[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll

[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat

 
 ========== LOP Check ==========

 

[2010/09/08 03:52:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Acer

[2010/09/08 03:34:08 | 000,000,000 | ---D | M] -- D:\ProgramData\AmUStor

[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data

[2011/02/14 18:56:11 | 000,000,000 | ---D | M] -- D:\ProgramData\ashampoo

[2012/10/03 02:53:13 | 000,000,000 | ---D | M] -- D:\ProgramData\AVAST Software

[2012/10/02 20:07:38 | 000,000,000 | ---D | M] -- D:\ProgramData\AVG2013

[2010/09/08 04:04:17 | 000,000,000 | ---D | M] -- D:\ProgramData\BackupManager

[2012/06/20 08:45:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Battle.net

[2012/05/31 11:28:27 | 000,000,000 | -H-D | M] -- D:\ProgramData\CanonBJ

[2012/10/02 19:27:05 | 000,000,000 | -H-D | M] -- D:\ProgramData\Common Files

[2011/02/14 19:10:19 | 000,000,000 | ---D | M] -- D:\ProgramData\createpart

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents

[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente

[2011/01/13 12:42:32 | 000,000,000 | ---D | M] -- D:\ProgramData\EgisTec IPS

[2010/09/08 03:39:41 | 000,000,000 | ---D | M] -- D:\ProgramData\eSobi

[2011/02/14 19:09:58 | 000,000,000 | ---D | M] -- D:\ProgramData\explauncher

[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites

[2012/06/07 17:05:13 | 000,000,000 | ---D | M] -- D:\ProgramData\Friends Games

[2012/07/24 14:18:25 | 000,000,000 | ---D | M] -- D:\ProgramData\GFI Software

[2011/05/12 13:35:47 | 000,000,000 | ---D | M] -- D:\ProgramData\ICQ

[2011/02/14 19:09:55 | 000,000,000 | ---D | M] -- D:\ProgramData\launcher

[2012/10/22 07:51:41 | 000,000,000 | ---D | M] -- D:\ProgramData\llpesmvihzxvnkp

[2012/10/22 06:22:08 | 000,000,000 | ---D | M] -- D:\ProgramData\MFAData

[2010/09/08 03:48:10 | 000,000,000 | ---D | M] -- D:\ProgramData\OberonGameConsole

[2011/02/12 11:26:58 | 000,000,000 | ---D | M] -- D:\ProgramData\oem

[2012/06/08 04:13:07 | 000,000,000 | ---D | M] -- D:\ProgramData\Sandlot Games

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu

[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü

[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates

[2012/06/20 10:20:35 | 000,000,000 | ---D | M] -- D:\ProgramData\TuneUp Software

[2011/02/12 18:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen

[2011/02/14 18:40:07 | 000,000,000 | -HSD | M] -- D:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}

[2012/08/01 03:32:34 | 000,032,640 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

< End of report >

--- --- ---

schrauber

23.10.2012 17:33

nanü, irgendwie will OTLPE mich foppen. Gleich nochmal.

Inhalt der Codebox in die Box Benutzerdefinierte Scans/Fixes bei OTLPE kopieren, dann Fix drücken. Wenn das Tool fertig ist Rechner neustarten.

Code:

:OTL

O4 - HKU\Viktor_ON_D..\Run: [qovcazdihoegacq] D:\Windows\qovcazdi.exe ()

[2012/10/22 07:51:41 | 000,000,000 | ---D | C] -- D:\ProgramData\llpesmvihzxvnkp

[2012/10/22 07:51:41 | 000,076,353 | ---- | M] () -- D:\ProgramData\ohlbxzxxfguuovt

[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\Windows\qovcazdi.exe

[2012/10/22 07:50:57 | 000,132,608 | ---- | M] () -- D:\ProgramData\qovcazdi.exe

JimmyRainer

23.10.2012 19:35

hallo leider hat es wieder nicht geklappt :-(

Zitat:

========== OTL ==========
Registry key HKEY_USERS\Viktor_ON_D\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
File D:\Windows\qovcazdi.exe not found.
Folder D:\ProgramData\llpesmvihzxvnkp\ not found.
File D:\ProgramData\ohlbxzxxfguuovt not found.
File D:\Windows\qovcazdi.exe not found.
File D:\ProgramData\qovcazdi.exe not found.

OTLPE by OldTimer - Version 3.1.48.0 log created on 10242012_023056

schrauber

24.10.2012 06:18

Downloade dir bitte Farbar Recovery Scan Tool 64-Bit und speichere diese auf einen USB Stick.

Schließe den USB Stick an das infizierte System an

Du musst das System nun in die System Reparatur Option booten.

Über den Boot Manager

Starte den Rechner neu auf.
Während dem Hochfahren drücke mehrmals die F8 Taste
Wähle nun Computer reparieren.
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD

Lege die Windows CD in dein Laufwerk.
Starte den Rechner neu auf und starte von der CD
Wähle die Spracheinstellungen und klicke "Weiter".
Klicke auf Computerreparaturoptionen !!
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Wähle in den Reparaturoptionen Eingabeaufforderung

Gib nun bitte notepad ein und drücke Enter.
Im öffnenden Textdokument --> Datei --> Speichern unter und wähle Computer
Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt.
Schließe Notepad wieder
Gib nun bitte folgenden Befehl ein.
e:\frst64.exe
Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Gegebenfalls anpassen.
Akzeptiere den Disclaimer mit Yes und klicke Scan

Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

JimmyRainer

24.10.2012 13:56

so hier ist das ergebniss

Zitat:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-10-2012
Ran by SYSTEM at 24-10-2012 20:53:47
Running from H:\
Windows 7 Home Premium (X64) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [3116152 2012-10-10] (AVG Technologies CZ, s.r.o.)
HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Viktor\...\Run: [qovcazdihoegacq] C:\Windows\qovcazdi.exe [132608 2012-10-22] ()
HKU\Viktor\...\Winlogon: [Shell]

==================== Services (Whitelisted) ===================

2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe" [5783672 2012-10-01] (AVG Technologies CZ, s.r.o.)
2 avgwd; "C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe" [193568 2012-10-01] (AVG Technologies CZ, s.r.o.)
2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [822304 2010-06-15] (Acer Incorporated)
4 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [399432 2012-09-07] (Malwarebytes Corporation)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [676936 2012-09-07] (Malwarebytes Corporation)
3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-26] (Egis Technology Inc.)
2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-16] (NTI, Inc.)
4 RichVideo; "C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe" [244904 2010-02-03] ()
2 UI Assistant Service; C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
4 vToolbarUpdater12.2.6; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) =====================

1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [151904 2012-09-12] (AVG Technologies CZ, s.r.o. )
0 AVGIDSHA; C:\Windows\System32\Drivers\AVGIDSHA.sys [61792 2012-09-20] (AVG Technologies CZ, s.r.o. )
1 Avgldx64; C:\Windows\System32\Drivers\Avgldx64.sys [185696 2012-10-01] (AVG Technologies CZ, s.r.o.)
0 Avgloga; C:\Windows\System32\Drivers\Avgloga.sys [225120 2012-09-20] (AVG Technologies CZ, s.r.o.)
0 Avgmfx64; C:\Windows\System32\Drivers\Avgmfx64.sys [111456 2012-10-04] (AVG Technologies CZ, s.r.o.)
0 Avgrkx64; C:\Windows\System32\Drivers\Avgrkx64.sys [40800 2012-09-13] (AVG Technologies CZ, s.r.o.)
1 Avgtdia; C:\Windows\System32\Drivers\Avgtdia.sys [200032 2012-09-20] (AVG Technologies CZ, s.r.o.)
1 avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [31080 2012-10-02] (AVG Technologies)
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [25928 2012-09-07] (Malwarebytes Corporation)
2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] ()
1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [x]

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2012-10-22 05:44 - 2012-10-22 05:44 - 00270600 ____A C:\Windows\Minidump\102212-16894-01.dmp
2012-10-22 03:51 - 2012-10-22 03:51 - 00076353 ____A C:\Users\All Users\ohlbxzxxfguuovt
2012-10-22 03:51 - 2012-10-22 03:51 - 00000000 ____D C:\Users\All Users\llpesmvihzxvnkp
2012-10-22 03:51 - 2012-10-22 03:50 - 00132608 ____A C:\Windows\qovcazdi.exe
2012-10-22 03:51 - 2012-10-22 03:50 - 00132608 ____A C:\Users\All Users\qovcazdi.exe
2012-10-22 03:50 - 2012-10-22 03:50 - 00132608 ____A C:\Users\Viktor\0.39205960266991524.exe
2012-10-12 10:49 - 2012-10-12 10:49 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2012-10-12 10:49 - 2012-10-12 10:49 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2012-10-10 08:11 - 2012-08-31 10:02 - 01656688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2012-10-10 08:11 - 2012-08-30 10:11 - 05505904 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-10-10 08:11 - 2012-08-30 09:18 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-10-10 08:11 - 2012-08-30 09:18 - 03902832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-10-10 08:11 - 2012-08-18 07:43 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll
2012-10-10 08:11 - 2012-08-18 07:43 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll
2012-10-10 08:11 - 2012-08-18 07:43 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
2012-10-10 08:11 - 2012-08-18 07:42 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2012-10-10 08:11 - 2012-08-18 07:40 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
2012-10-10 08:11 - 2012-08-18 07:37 - 01162240 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2012-10-10 08:11 - 2012-08-18 07:37 - 00425984 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2012-10-10 08:11 - 2012-08-18 07:34 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe
2012-10-10 08:11 - 2012-08-18 07:22 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 07:22 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:22 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2012-10-10 08:11 - 2012-08-18 03:19 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2012-10-10 08:11 - 2012-08-18 03:17 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2012-10-10 08:11 - 2012-08-18 03:17 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2012-10-10 08:11 - 2012-08-18 03:17 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 03:09 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 01:12 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2012-10-10 08:11 - 2012-08-18 01:07 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 01:07 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 01:07 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2012-10-10 08:11 - 2012-08-18 01:07 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2012-10-10 08:10 - 2012-09-14 11:23 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2012-10-10 08:10 - 2012-09-14 10:30 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2012-10-10 08:10 - 2012-08-24 10:05 - 00220160 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2012-10-10 08:10 - 2012-08-24 09:10 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2012-10-10 08:10 - 2012-08-18 01:12 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2012-10-10 08:10 - 2012-08-10 16:53 - 00714752 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2012-10-10 08:10 - 2012-08-10 15:54 - 00541184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2012-10-10 08:10 - 2012-06-01 21:25 - 01462784 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-10-10 08:10 - 2012-06-01 21:25 - 00182272 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-10-10 08:10 - 2012-06-01 21:25 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-10-10 08:10 - 2012-06-01 20:45 - 01157632 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-10-10 08:10 - 2012-06-01 20:45 - 00139264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-10-10 08:10 - 2012-06-01 20:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-10-05 10:24 - 2012-10-05 10:24 - 00002491 ____A C:\AdwCleaner[S1].txt
2012-10-05 10:00 - 2012-10-05 10:00 - 00000096 ___AH C:\Users\Viktor\Desktop\.~lock.Checkliste.docx#
2012-10-05 09:59 - 2012-10-05 09:59 - 00067750 ____A C:\Users\Viktor\Desktop\AdwCleaner[R1].txt
2012-10-05 09:57 - 2012-10-05 09:57 - 00067811 ____A C:\AdwCleaner[R2].txt
2012-10-05 09:57 - 2012-10-05 09:57 - 00067750 ____A C:\AdwCleaner[R1].txt
2012-10-04 17:26 - 2012-10-04 17:26 - 00111456 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgmfx64.sys
2012-10-02 20:52 - 2011-07-12 18:55 - 02237440 ___RA (OldTimer Tools) C:\OTLPE.exe
2012-10-02 17:04 - 2012-10-02 17:04 - 58674136 ____A (AVG) C:\Users\Viktor\Downloads\avg_tuh_stf_all_2013_2_24c6.exe
2012-10-02 17:04 - 2012-10-02 17:04 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-10-02 17:04 - 2012-10-02 17:04 - 00000000 ____D C:\Users\Viktor\AppData\Roaming\Malwarebytes
2012-10-02 17:04 - 2012-10-02 17:04 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-10-02 17:04 - 2012-10-02 17:04 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-10-02 17:04 - 2012-09-07 07:04 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-10-02 17:03 - 2012-10-02 17:03 - 10524080 ____A (Malwarebytes Corporation ) C:\Users\Viktor\Downloads\mbam-setup-1.65.0.1400.exe
2012-10-02 15:34 - 2012-10-02 15:34 - 00000000 ____D C:\Users\Viktor\AppData\Roaming\AVG2013
2012-10-02 15:32 - 2012-10-15 07:29 - 00000985 ____A C:\Users\Public\Desktop\AVG 2013.lnk
2012-10-02 15:32 - 2012-10-02 15:32 - 00031080 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2012-10-02 15:31 - 2012-10-02 16:07 - 00000000 ____D C:\Users\All Users\AVG2013
2012-10-02 15:31 - 2012-10-02 15:31 - 00000000 ___HD C:\$AVG
2012-10-02 15:30 - 2012-10-02 15:30 - 00000000 ____D C:\Program Files (x86)\AVG
2012-10-02 15:27 - 2012-10-22 02:22 - 00000000 ____D C:\Users\All Users\MFAData
2012-10-02 15:27 - 2012-10-02 15:35 - 00000000 ____D C:\Users\Viktor\AppData\Local\Avg2013
2012-10-02 15:27 - 2012-10-02 15:27 - 00000000 ____D C:\Users\Viktor\AppData\Local\MFAData
2012-10-01 19:55 - 2012-10-23 17:55 - 00091962 ____A C:\OTL.Txt
2012-10-01 19:55 - 2012-10-01 19:55 - 00000000 ____D C:\_OTL
2012-10-01 17:30 - 2012-10-01 17:30 - 00185696 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgldx64.sys
2012-09-30 15:27 - 2012-09-30 15:27 - 00268616 ____A C:\Windows\Minidump\100112-28173-01.dmp
2012-09-24 10:21 - 2012-09-24 10:21 - 00000000 ____D C:\Users\Viktor\AppData\Local\Macromedia
2012-09-24 10:15 - 2012-10-22 04:43 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-09-24 10:15 - 2012-10-09 10:43 - 00696760 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

==================== 3 Months Modified Files ==================

2012-10-23 17:55 - 2012-10-01 19:55 - 00091962 ____A C:\OTL.Txt
2012-10-23 16:36 - 2011-03-11 08:41 - 00327680 ____A C:\Windows\System32\Ikeext.etl
2012-10-23 16:36 - 2011-01-13 08:39 - 01881320 ____A C:\Windows\WindowsUpdate.log
2012-10-23 16:36 - 2009-07-13 20:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-10-23 16:36 - 2009-07-13 20:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-10-23 16:34 - 2011-11-26 12:17 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-10-23 16:33 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-10-23 16:33 - 2009-07-13 20:51 - 00136730 ____A C:\Windows\setupact.log
2012-10-22 05:44 - 2012-10-22 05:44 - 00270600 ____A C:\Windows\Minidump\102212-16894-01.dmp
2012-10-22 05:43 - 2011-08-08 14:28 - 265040132 ____A C:\Windows\MEMORY.DMP
2012-10-22 04:43 - 2012-09-24 10:15 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-10-22 03:55 - 2011-11-26 12:17 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-10-22 03:51 - 2012-10-22 03:51 - 00076353 ____A C:\Users\All Users\ohlbxzxxfguuovt
2012-10-22 03:50 - 2012-10-22 03:51 - 00132608 ____A C:\Windows\qovcazdi.exe
2012-10-22 03:50 - 2012-10-22 03:51 - 00132608 ____A C:\Users\All Users\qovcazdi.exe
2012-10-22 03:50 - 2012-10-22 03:50 - 00132608 ____A C:\Users\Viktor\0.39205960266991524.exe
2012-10-15 07:29 - 2012-10-02 15:32 - 00000985 ____A C:\Users\Public\Desktop\AVG 2013.lnk
2012-10-14 12:39 - 2011-01-13 17:30 - 00654400 ____A C:\Windows\System32\perfh007.dat
2012-10-14 12:39 - 2011-01-13 17:30 - 00130240 ____A C:\Windows\System32\perfc007.dat
2012-10-14 12:39 - 2009-07-13 21:13 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2012-10-12 10:57 - 2012-08-29 01:04 - 00002378 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2012-10-10 14:01 - 2011-02-16 07:23 - 65309168 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-10-09 10:43 - 2012-09-24 10:15 - 00696760 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-10-09 10:43 - 2011-11-26 12:18 - 00073656 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-10-09 10:20 - 2011-01-13 08:34 - 00045708 ____A C:\Windows\PFRO.log
2012-10-05 10:24 - 2012-10-05 10:24 - 00002491 ____A C:\AdwCleaner[S1].txt
2012-10-05 10:00 - 2012-10-05 10:00 - 00000096 ___AH C:\Users\Viktor\Desktop\.~lock.Checkliste.docx#
2012-10-05 09:59 - 2012-10-05 09:59 - 00067750 ____A C:\Users\Viktor\Desktop\AdwCleaner[R1].txt
2012-10-05 09:57 - 2012-10-05 09:57 - 00067811 ____A C:\AdwCleaner[R2].txt
2012-10-05 09:57 - 2012-10-05 09:57 - 00067750 ____A C:\AdwCleaner[R1].txt
2012-10-04 17:26 - 2012-10-04 17:26 - 00111456 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgmfx64.sys
2012-10-02 17:04 - 2012-10-02 17:04 - 58674136 ____A (AVG) C:\Users\Viktor\Downloads\avg_tuh_stf_all_2013_2_24c6.exe
2012-10-02 17:04 - 2012-10-02 17:04 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-10-02 17:03 - 2012-10-02 17:03 - 10524080 ____A (Malwarebytes Corporation ) C:\Users\Viktor\Downloads\mbam-setup-1.65.0.1400.exe
2012-10-02 15:32 - 2012-10-02 15:32 - 00031080 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2012-10-01 17:30 - 2012-10-01 17:30 - 00185696 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgldx64.sys
2012-09-30 15:27 - 2012-09-30 15:27 - 00268616 ____A C:\Windows\Minidump\100112-28173-01.dmp
2012-09-25 12:28 - 2011-02-19 10:28 - 00002290 ____A C:\Users\Viktor\Desktop\Neues Textdokument.txt
2012-09-22 13:06 - 2012-09-22 12:27 - 00000993 ____A C:\Users\Public\Desktop\World of Warcraft.lnk
2012-09-20 17:46 - 2012-09-20 17:46 - 00225120 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgloga.sys
2012-09-20 17:46 - 2012-09-20 17:46 - 00200032 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgtdia.sys
2012-09-20 17:45 - 2012-09-20 17:45 - 00061792 ____A (AVG Technologies CZ, s.r.o. ) C:\Windows\System32\Drivers\avgidsha.sys
2012-09-14 11:23 - 2012-10-10 08:10 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2012-09-14 10:30 - 2012-10-10 08:10 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2012-09-13 17:05 - 2012-09-13 17:05 - 00040800 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgrkx64.sys
2012-09-12 17:11 - 2012-09-12 17:11 - 00151904 ____A (AVG Technologies CZ, s.r.o. ) C:\Windows\System32\Drivers\avgidsdrivera.sys
2012-09-07 07:04 - 2012-10-02 17:04 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-08-31 10:02 - 2012-10-10 08:11 - 01656688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2012-08-30 10:11 - 2012-10-10 08:11 - 05505904 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-08-30 09:18 - 2012-10-10 08:11 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-08-30 09:18 - 2012-10-10 08:11 - 03902832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-08-30 06:01 - 2012-08-30 05:00 - 02413150 ____A C:\Users\Viktor\Desktop\Auto4.bmp
2012-08-30 06:01 - 2012-08-30 04:56 - 02413150 ____A C:\Users\Viktor\Desktop\Auto3.bmp
2012-08-30 06:00 - 2012-08-30 04:57 - 02413150 ____A C:\Users\Viktor\Desktop\Auto2.bmp
2012-08-30 05:57 - 2012-08-30 04:56 - 02413150 ____A C:\Users\Viktor\Desktop\Auto1.bmp
2012-08-29 01:02 - 2012-08-29 01:02 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2012-08-28 14:20 - 2012-08-28 14:20 - 00000000 ____A C:\Users\Viktor\AppData\Roaming\pjq5x742.default.tmp
2012-08-28 14:19 - 2012-08-28 14:19 - 00065536 ____A C:\Users\Viktor\AppData\Roaming\pjq5x742.default.dat
2012-08-28 02:51 - 2012-07-21 14:19 - 00000048 ____A C:\Users\Viktor\AppData\Roaming\AcroIEHelpe.txt
2012-08-27 10:49 - 2012-08-27 10:49 - 00000000 ____A C:\Users\Viktor\AppData\Roaming\yjqczl3w.Standard-Benutzer.tmp
2012-08-24 10:05 - 2012-10-10 08:10 - 00220160 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2012-08-24 10:05 - 2012-09-22 02:10 - 01501696 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-08-24 10:05 - 2012-09-22 02:09 - 01197568 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-08-24 10:05 - 2012-09-22 02:09 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-08-24 10:03 - 2012-09-22 02:09 - 01026560 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2012-08-24 10:02 - 2012-09-22 02:10 - 09375744 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-08-24 10:02 - 2012-09-22 02:10 - 00736256 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00082944 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-08-24 10:01 - 2012-09-22 02:10 - 12404736 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 02458624 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 00445952 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 00256000 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-08-24 09:59 - 2012-09-22 02:09 - 00012288 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-08-24 09:10 - 2012-10-10 08:10 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2012-08-24 09:10 - 2012-09-22 02:10 - 01230848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-08-24 09:10 - 2012-09-22 02:09 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-08-24 09:10 - 2012-09-22 02:09 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-08-24 09:09 - 2012-09-22 02:10 - 06029824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-08-24 09:09 - 2012-09-22 02:10 - 00627200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-08-24 09:09 - 2012-09-22 02:09 - 00606208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2012-08-24 09:09 - 2012-09-22 02:09 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-08-24 09:09 - 2012-09-22 02:09 - 00064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2012-08-24 09:08 - 2012-09-22 02:10 - 11019776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 02072576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00381440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00185856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2012-08-24 09:06 - 2012-09-22 02:09 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2012-08-24 08:45 - 2012-09-22 02:09 - 00482816 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-08-24 08:02 - 2012-09-22 02:09 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-08-24 08:01 - 2012-09-22 02:09 - 00386048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2012-08-24 07:27 - 2012-09-22 02:09 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-08-18 07:43 - 2012-10-10 08:11 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll
2012-08-18 07:43 - 2012-10-10 08:11 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll
2012-08-18 07:43 - 2012-10-10 08:11 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
2012-08-18 07:42 - 2012-10-10 08:11 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2012-08-18 07:40 - 2012-10-10 08:11 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
2012-08-18 07:37 - 2012-10-10 08:11 - 01162240 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2012-08-18 07:37 - 2012-10-10 08:11 - 00425984 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2012-08-18 07:34 - 2012-10-10 08:11 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe
2012-08-18 07:22 - 2012-10-10 08:11 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2012-08-18 07:22 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2012-08-18 03:22 - 2012-10-10 08:11 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2012-08-18 03:19 - 2012-10-10 08:11 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2012-08-18 03:17 - 2012-10-10 08:11 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2012-08-18 03:17 - 2012-10-10 08:11 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2012-08-18 03:17 - 2012-10-10 08:11 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2012-08-18 03:09 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2012-08-18 01:12 - 2012-10-10 08:11 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2012-08-18 01:12 - 2012-10-10 08:10 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2012-08-18 01:07 - 2012-10-10 08:11 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2012-08-18 01:07 - 2012-10-10 08:11 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2012-08-18 01:07 - 2012-10-10 08:11 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2012-08-18 01:07 - 2012-10-10 08:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2012-08-16 02:02 - 2009-07-13 20:45 - 00433928 ____A C:\Windows\System32\FNTCACHE.DAT
2012-08-10 16:53 - 2012-10-10 08:10 - 00714752 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2012-08-10 15:54 - 2012-10-10 08:10 - 00541184 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2012-08-02 09:55 - 2012-09-12 11:34 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2012-08-02 09:05 - 2012-09-12 11:34 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2012-07-31 23:32 - 2009-07-13 21:08 - 00032640 ____A C:\Windows\Tasks\SCHEDLGU.TXT

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-09-28 08:12:20
Restore point made on: 2012-10-02 15:29:57
Restore point made on: 2012-10-02 15:30:13
Restore point made on: 2012-10-02 15:30:48
Restore point made on: 2012-10-02 16:53:44
Restore point made on: 2012-10-03 17:00:42
Restore point made on: 2012-10-10 13:58:54
Restore point made on: 2012-10-17 15:06:07

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3764.48 MB
Available physical RAM: 3059.34 MB
Total Pagefile: 3762.63 MB
Available Pagefile: 3045.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: (Acer) (Fixed) (Total:160.88 GB) (Free:54.92 GB) NTFS
2 Drive e: (Laufwerk) (Fixed) (Total:290.78 GB) (Free:278.18 GB) NTFS
3 Drive f: (PQSERVICE) (Fixed) (Total:14 GB) (Free:2.26 GB) NTFS
5 Drive h: (NBRT) (Removable) (Total:14.92 GB) (Free:14.9 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Wiederherstellun 14 GB 1024 KB
Partition 2 Prim„r 100 MB 14 GB
Partition 3 Prim„r 160 GB 14 GB
Partition 4 Prim„r 290 GB 174 GB

==================================================================================

Disk: 0
Partition 1
Typ : 27
Versteckt: Ja
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F PQSERVICE NTFS Partition 14 GB Fehlerfre Versteck

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM RESE NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 3
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C Acer NTFS Partition 160 GB Fehlerfre

=========================================================

Disk: 0
Partition 4
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E Laufwerk NTFS Partition 290 GB Fehlerfre

=========================================================

Disk: 0
Partition 4
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E Laufwerk NTFS Partition 290 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1024 KB

==================================================================================

Disk: 1
Partition 1
Typ : 0C
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H NBRT FAT32 Wechselmed 14 GB Fehlerfre

=========================================================

Disk: 1
Partition 1
Typ : 0C
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H NBRT FAT32 Wechselmed 14 GB Fehlerfre

=========================================================

Last Boot: 2012-10-17 10:10

==================== End Of Log =============================

schrauber

24.10.2012 14:15

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKU\Viktor\...\Run: [qovcazdihoegacq] C:\Windows\qovcazdi.exe [132608 2012-10-22] ()

HKU\Viktor\...\Winlogon: [Shell] 

2012-10-22 03:51 - 2012-10-22 03:51 - 00076353 ____A C:\Users\All Users\ohlbxzxxfguuovt

2012-10-22 03:51 - 2012-10-22 03:51 - 00000000 ____D C:\Users\All Users\llpesmvihzxvnkp

2012-10-22 03:51 - 2012-10-22 03:50 - 00132608 ____A C:\Windows\qovcazdi.exe

2012-10-22 03:51 - 2012-10-22 03:50 - 00132608 ____A C:\Users\All Users\qovcazdi.exe

2012-10-22 03:50 - 2012-10-22 03:50 - 00132608 ____A C:\Users\Viktor\0.39205960266991524.exe

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

JimmyRainer

24.10.2012 15:47

so hier die daten

Zitat:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-10-2012
Ran by SYSTEM at 2012-10-24 22:46:40 Run:1
Running from H:\

==============================================

HKEY_USERS\Viktor\Software\Microsoft\Windows\CurrentVersion\Run\\qovcazdihoegacq Value deleted successfully.
HKEY_USERS\Viktor\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
C:\Users\All Users\ohlbxzxxfguuovt moved successfully.
C:\Users\All Users\llpesmvihzxvnkp moved successfully.
C:\Windows\qovcazdi.exe moved successfully.
C:\Users\All Users\qovcazdi.exe moved successfully.
C:\Users\Viktor\0.39205960266991524.exe moved successfully.

==== End of Fixlog ====

schrauber

24.10.2012 16:28

Reboot in Windows möglich?

JimmyRainer

24.10.2012 19:31

ja er fährt wieder hoch vielen dank

schrauber

25.10.2012 07:06

Dann jetzt bitte das hier im normalen Windows:

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

%windir%\installer\*. /5

%localappdata%\*. /5

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

JimmyRainer

21.11.2012 19:21

guten tag der rechner hat noch mal das selbe problem das hat frst ausgespuckt

Zitat:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-10-2012 (ATTENTION: FRST version is 31 days old)
Ran by SYSTEM at 21-11-2012 19:17:52
Running from H:\
Windows 7 Home Premium (X64) OS Language: German Standard
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [975952 2010-08-10] (Dritek System Inc.)
HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [3143800 2012-11-06] (AVG Technologies CZ, s.r.o.)
HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Viktor\...\Winlogon: [Shell] explorer.exe,C:\Users\Viktor\AppData\Roaming\msconfig.dat [76135 2011-11-16] ()
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) ===================

2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe" [5814392 2012-11-06] (AVG Technologies CZ, s.r.o.)
2 avgwd; "C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe" [196664 2012-10-22] (AVG Technologies CZ, s.r.o.)
2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [822304 2010-06-15] (Acer Incorporated)
4 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [399432 2012-09-07] (Malwarebytes Corporation)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [676936 2012-09-07] (Malwarebytes Corporation)
3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-26] (Egis Technology Inc.)
2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-16] (NTI, Inc.)
4 RichVideo; "C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe" [244904 2010-02-03] ()
2 UI Assistant Service; C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
4 vToolbarUpdater12.2.6; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) =====================

1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [154464 2012-10-22] (AVG Technologies CZ, s.r.o. )
0 AVGIDSHA; C:\Windows\System32\Drivers\AVGIDSHA.sys [63328 2012-10-14] (AVG Technologies CZ, s.r.o. )
1 Avgldx64; C:\Windows\System32\Drivers\Avgldx64.sys [185696 2012-10-01] (AVG Technologies CZ, s.r.o.)
0 Avgloga; C:\Windows\System32\Drivers\Avgloga.sys [225120 2012-09-20] (AVG Technologies CZ, s.r.o.)
0 Avgmfx64; C:\Windows\System32\Drivers\Avgmfx64.sys [111456 2012-10-04] (AVG Technologies CZ, s.r.o.)
0 Avgrkx64; C:\Windows\System32\Drivers\Avgrkx64.sys [40800 2012-09-13] (AVG Technologies CZ, s.r.o.)
1 Avgtdia; C:\Windows\System32\Drivers\Avgtdia.sys [200032 2012-09-20] (AVG Technologies CZ, s.r.o.)
1 avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [31080 2012-10-02] (AVG Technologies)
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [25928 2012-09-07] (Malwarebytes Corporation)
2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] ()
1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [x]

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2012-11-16 15:19 - 2012-11-17 09:57 - 00000047 ____A C:\Users\Viktor\AppData\Roaming\msconfig.ini
2012-11-13 22:11 - 2012-07-25 20:55 - 00785512 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys
2012-11-13 22:11 - 2012-07-25 20:55 - 00054376 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WdfLdr.sys
2012-11-13 22:11 - 2012-07-25 18:36 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\Wdfres.dll
2012-11-13 22:11 - 2012-06-02 06:35 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2012-11-13 22:05 - 2012-07-25 19:08 - 00744448 ____A (Microsoft Corporation) C:\Windows\System32\WUDFx.dll
2012-11-13 22:05 - 2012-07-25 19:08 - 00229888 ____A (Microsoft Corporation) C:\Windows\System32\WUDFHost.exe
2012-11-13 22:05 - 2012-07-25 19:08 - 00194048 ____A (Microsoft Corporation) C:\Windows\System32\WUDFPlatform.dll
2012-11-13 22:05 - 2012-07-25 19:08 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\WUDFSvc.dll
2012-11-13 22:05 - 2012-07-25 19:08 - 00045056 ____A (Microsoft Corporation) C:\Windows\System32\WUDFCoinstaller.dll
2012-11-13 22:05 - 2012-07-25 18:26 - 00198656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFRd.sys
2012-11-13 22:05 - 2012-07-25 18:26 - 00087040 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFPf.sys
2012-11-13 22:05 - 2012-06-02 06:57 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2012-11-13 19:21 - 2012-10-18 10:18 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-11-13 19:21 - 2012-09-25 14:39 - 00095744 ____A (Microsoft Corporation) C:\Windows\System32\synceng.dll
2012-11-13 19:21 - 2012-09-25 13:55 - 00078336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2012-10-31 17:25 - 2012-10-31 17:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2012-10-24 20:53 - 2012-10-24 20:53 - 00000000 ____D C:\FRST
2012-10-22 05:44 - 2012-10-22 05:44 - 00270600 ____A C:\Windows\Minidump\102212-16894-01.dmp
2012-10-22 04:02 - 2012-10-22 04:02 - 00154464 ____A (AVG Technologies CZ, s.r.o. ) C:\Windows\System32\Drivers\avgidsdrivera.sys

==================== 3 Months Modified Files ==================

2012-11-17 09:57 - 2012-11-16 15:19 - 00000047 ____A C:\Users\Viktor\AppData\Roaming\msconfig.ini
2012-11-17 09:55 - 2011-11-26 12:17 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-11-17 09:55 - 2011-03-11 08:41 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2012-11-17 09:55 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-11-17 09:55 - 2009-07-13 20:51 - 00138410 ____A C:\Windows\setupact.log
2012-11-16 14:55 - 2011-11-26 12:17 - 00001110 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-11-16 14:55 - 2009-07-13 20:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-11-16 14:55 - 2009-07-13 20:45 - 00009696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-11-15 16:01 - 2011-01-13 08:39 - 01950675 ____A C:\Windows\WindowsUpdate.log
2012-11-15 15:43 - 2012-09-24 10:15 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-11-14 09:12 - 2011-02-12 07:25 - 00115304 ____A C:\Users\Viktor\AppData\Local\GDIPFONTCACHEV1.DAT
2012-11-14 09:12 - 2009-07-13 20:45 - 00435296 ____A C:\Windows\System32\FNTCACHE.DAT
2012-11-14 09:09 - 2011-01-13 08:34 - 00051668 ____A C:\Windows\PFRO.log
2012-11-13 22:13 - 2011-01-13 17:30 - 00654400 ____A C:\Windows\System32\perfh007.dat
2012-11-13 22:13 - 2011-01-13 17:30 - 00130240 ____A C:\Windows\System32\perfc007.dat
2012-11-13 22:13 - 2009-07-13 21:13 - 01520734 ____A C:\Windows\System32\PerfStringBackup.INI
2012-11-13 22:05 - 2011-02-16 07:23 - 66395536 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-11-13 22:04 - 2009-07-13 18:34 - 00000478 ____A C:\Windows\win.ini
2012-11-08 11:24 - 2012-10-02 15:32 - 00000985 ____A C:\Users\Public\Desktop\AVG 2013.lnk
2012-11-08 05:48 - 2009-07-13 21:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-11-06 11:57 - 2012-08-29 01:04 - 00002378 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2012-10-23 17:55 - 2012-10-01 19:55 - 00091962 ____A C:\OTL.Txt
2012-10-22 05:44 - 2012-10-22 05:44 - 00270600 ____A C:\Windows\Minidump\102212-16894-01.dmp
2012-10-22 05:43 - 2011-08-08 14:28 - 265040132 ____A C:\Windows\MEMORY.DMP
2012-10-22 04:02 - 2012-10-22 04:02 - 00154464 ____A (AVG Technologies CZ, s.r.o. ) C:\Windows\System32\Drivers\avgidsdrivera.sys
2012-10-18 10:18 - 2012-11-13 19:21 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-10-14 18:48 - 2012-10-14 18:48 - 00063328 ____A (AVG Technologies CZ, s.r.o. ) C:\Windows\System32\Drivers\avgidsha.sys
2012-10-09 10:43 - 2012-09-24 10:15 - 00696760 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-10-09 10:43 - 2011-11-26 12:18 - 00073656 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-10-05 10:24 - 2012-10-05 10:24 - 00002491 ____A C:\AdwCleaner[S1].txt
2012-10-05 10:00 - 2012-10-05 10:00 - 00000096 ___AH C:\Users\Viktor\Desktop\.~lock.Checkliste.docx#
2012-10-05 09:59 - 2012-10-05 09:59 - 00067750 ____A C:\Users\Viktor\Desktop\AdwCleaner[R1].txt
2012-10-05 09:57 - 2012-10-05 09:57 - 00067811 ____A C:\AdwCleaner[R2].txt
2012-10-05 09:57 - 2012-10-05 09:57 - 00067750 ____A C:\AdwCleaner[R1].txt
2012-10-04 18:32 - 2012-10-04 18:32 - 00111456 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgmfx64.sys
2012-10-02 17:04 - 2012-10-02 17:04 - 58674136 ____A (AVG) C:\Users\Viktor\Downloads\avg_tuh_stf_all_2013_2_24c6.exe
2012-10-02 17:04 - 2012-10-02 17:04 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-10-02 17:03 - 2012-10-02 17:03 - 10524080 ____A (Malwarebytes Corporation ) C:\Users\Viktor\Downloads\mbam-setup-1.65.0.1400.exe
2012-10-02 15:32 - 2012-10-02 15:32 - 00031080 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2012-10-01 17:30 - 2012-10-01 17:30 - 00185696 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgldx64.sys
2012-09-30 15:27 - 2012-09-30 15:27 - 00268616 ____A C:\Windows\Minidump\100112-28173-01.dmp
2012-09-25 14:39 - 2012-11-13 19:21 - 00095744 ____A (Microsoft Corporation) C:\Windows\System32\synceng.dll
2012-09-25 13:55 - 2012-11-13 19:21 - 00078336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2012-09-25 12:28 - 2011-02-19 10:28 - 00002290 ____A C:\Users\Viktor\Desktop\Neues Textdokument.txt
2012-09-22 13:06 - 2012-09-22 12:27 - 00000993 ____A C:\Users\Public\Desktop\World of Warcraft.lnk
2012-09-20 17:46 - 2012-09-20 17:46 - 00225120 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgloga.sys
2012-09-20 17:46 - 2012-09-20 17:46 - 00200032 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgtdia.sys
2012-09-14 11:23 - 2012-10-10 08:10 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2012-09-14 10:30 - 2012-10-10 08:10 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2012-09-13 17:05 - 2012-09-13 17:05 - 00040800 ____A (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgrkx64.sys
2012-09-07 07:04 - 2012-10-02 17:04 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-08-31 10:02 - 2012-10-10 08:11 - 01656688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2012-08-30 10:11 - 2012-10-10 08:11 - 05505904 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-08-30 09:18 - 2012-10-10 08:11 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-08-30 09:18 - 2012-10-10 08:11 - 03902832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-08-30 06:01 - 2012-08-30 05:00 - 02413150 ____A C:\Users\Viktor\Desktop\Auto4.bmp
2012-08-30 06:01 - 2012-08-30 04:56 - 02413150 ____A C:\Users\Viktor\Desktop\Auto3.bmp
2012-08-30 06:00 - 2012-08-30 04:57 - 02413150 ____A C:\Users\Viktor\Desktop\Auto2.bmp
2012-08-30 05:57 - 2012-08-30 04:56 - 02413150 ____A C:\Users\Viktor\Desktop\Auto1.bmp
2012-08-29 01:02 - 2012-08-29 01:02 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2012-08-28 14:20 - 2012-08-28 14:20 - 00000000 ____A C:\Users\Viktor\AppData\Roaming\pjq5x742.default.tmp
2012-08-28 14:19 - 2012-08-28 14:19 - 00065536 ____A C:\Users\Viktor\AppData\Roaming\pjq5x742.default.dat
2012-08-28 02:51 - 2012-07-21 14:19 - 00000048 ____A C:\Users\Viktor\AppData\Roaming\AcroIEHelpe.txt
2012-08-27 10:49 - 2012-08-27 10:49 - 00000000 ____A C:\Users\Viktor\AppData\Roaming\yjqczl3w.Standard-Benutzer.tmp
2012-08-24 10:05 - 2012-10-10 08:10 - 00220160 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2012-08-24 10:05 - 2012-09-22 02:10 - 01501696 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-08-24 10:05 - 2012-09-22 02:09 - 01197568 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-08-24 10:05 - 2012-09-22 02:09 - 00134144 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-08-24 10:03 - 2012-09-22 02:09 - 01026560 ____A (Microsoft Corporation) C:\Windows\System32\mstime.dll
2012-08-24 10:02 - 2012-09-22 02:10 - 09375744 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-08-24 10:02 - 2012-09-22 02:10 - 00736256 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00097792 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00082944 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00064512 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-08-24 10:02 - 2012-09-22 02:09 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2012-08-24 10:01 - 2012-09-22 02:10 - 12404736 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 02458624 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 00445952 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 00256000 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2012-08-24 10:01 - 2012-09-22 02:09 - 00247808 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-08-24 09:59 - 2012-09-22 02:09 - 00012288 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2012-08-24 09:10 - 2012-10-10 08:10 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2012-08-24 09:10 - 2012-09-22 02:10 - 01230848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-08-24 09:10 - 2012-09-22 02:09 - 00981504 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-08-24 09:10 - 2012-09-22 02:09 - 00132096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-08-24 09:09 - 2012-09-22 02:10 - 06029824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-08-24 09:09 - 2012-09-22 02:10 - 00627200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-08-24 09:09 - 2012-09-22 02:09 - 00606208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2012-08-24 09:09 - 2012-09-22 02:09 - 00067584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-08-24 09:09 - 2012-09-22 02:09 - 00064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2012-08-24 09:08 - 2012-09-22 02:10 - 11019776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 02072576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00381440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00185856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00048128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-08-24 09:08 - 2012-09-22 02:09 - 00044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2012-08-24 09:06 - 2012-09-22 02:09 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2012-08-24 08:45 - 2012-09-22 02:09 - 00482816 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2012-08-24 08:02 - 2012-09-22 02:09 - 01638912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-08-24 08:01 - 2012-09-22 02:09 - 00386048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2012-08-24 07:27 - 2012-09-22 02:09 - 01638912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-11-01 15:00:21
Restore point made on: 2012-11-09 15:45:43
Restore point made on: 2012-11-13 22:04:04

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3764.48 MB
Available physical RAM: 3058.4 MB
Total Pagefile: 3762.63 MB
Available Pagefile: 3046.11 MB
Total Virtual: 8192 MB
Available Virtual: 8191.91 MB

==================== Partitions =============================

1 Drive c: (Acer) (Fixed) (Total:160.88 GB) (Free:53.8 GB) NTFS
2 Drive e: (Laufwerk) (Fixed) (Total:290.78 GB) (Free:278.15 GB) NTFS
3 Drive f: (PQSERVICE) (Fixed) (Total:14 GB) (Free:2.26 GB) NTFS
5 Drive h: (NBRT) (Removable) (Total:14.92 GB) (Free:14.9 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
7 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Datentr„ger ### Status Gr”áe Frei Dyn GPT
--------------- ------------- ------- ------- --- ---
Datentr„ger 0 Online 465 GB 0 B
Datentr„ger 1 Online 14 GB 0 B

Partitions of Disk 0:
===============

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Wiederherstellun 14 GB 1024 KB
Partition 2 Prim„r 100 MB 14 GB
Partition 3 Prim„r 160 GB 14 GB
Partition 4 Prim„r 290 GB 174 GB

==================================================================================

Disk: 0
Partition 1
Typ : 27
Versteckt: Ja
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F PQSERVICE NTFS Partition 14 GB Fehlerfre Versteck

=========================================================

Disk: 0
Partition 2
Typ : 07
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM RESE NTFS Partition 100 MB Fehlerfre

=========================================================

Disk: 0
Partition 3
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C Acer NTFS Partition 160 GB Fehlerfre

=========================================================

Disk: 0
Partition 4
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E Laufwerk NTFS Partition 290 GB Fehlerfre

=========================================================

Disk: 0
Partition 4
Typ : 07
Versteckt: Nein
Aktiv : Nein

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E Laufwerk NTFS Partition 290 GB Fehlerfre

=========================================================

Partitions of Disk 1:
===============

Partition ### Typ Gr”áe Offset
------------- ---------------- ------- -------
Partition 1 Prim„r 14 GB 1024 KB

==================================================================================

Disk: 1
Partition 1
Typ : 0C
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H NBRT FAT32 Wechselmed 14 GB Fehlerfre

=========================================================

Disk: 1
Partition 1
Typ : 0C
Versteckt: Nein
Aktiv : Ja

Volume ### Bst Bezeichnung DS Typ Gr”áe Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H NBRT FAT32 Wechselmed 14 GB Fehlerfre

=========================================================

Last Boot: 2012-11-15 09:40

==================== End Of Log =============================

schrauber

21.11.2012 19:31

Das kommt davon wenn man nit das macht was man noch so an Instruktionen bekommt und einfach nicht mehr weiter macht, mal sehen ob du diesmal bis zum schluss dabei bleibst ;)

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKU\Viktor\...\Winlogon: [Shell] explorer.exe,C:\Users\Viktor\AppData\Roaming\msconfig.dat [76135 2011-11-16] ()

2012-11-16 15:19 - 2012-11-17 09:57 - 00000047 ____A C:\Users\Viktor\AppData\Roaming\msconfig.ini

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Fix Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

JimmyRainer

21.11.2012 20:12

so hier ist der fixlog

Zitat:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-10-2012
Ran by SYSTEM at 2012-11-21 20:12:07 Run:2
Running from H:\

==============================================

HKEY_USERS\Viktor\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
C:\Users\Viktor\AppData\Roaming\msconfig.ini moved successfully.

==== End of Fixlog ====

schrauber

22.11.2012 07:18

Gehts normal booten wieder?

JimmyRainer

22.11.2012 14:47

ja er bootet wieder normal

schrauber

22.11.2012 15:24

Dann jetzt bitte das hier im normalen Windows:

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

%windir%\installer\*. /5

%localappdata%\*. /5

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

JimmyRainer

22.11.2012 16:16

hallo hier sind die daten

OTL Logfile:

Code:

OTL logfile created on: 22.11.2012 15:59:42 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = F:\

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,68 Gb Total Physical Memory | 2,50 Gb Available Physical Memory | 67,95% Memory free

7,35 Gb Paging File | 6,10 Gb Available in Paging File | 83,02% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 160,88 Gb Total Space | 55,25 Gb Free Space | 34,34% Space Free | Partition Type: NTFS

Drive E: | 290,78 Gb Total Space | 278,15 Gb Free Space | 95,65% Space Free | Partition Type: NTFS

Drive F: | 14,92 Gb Total Space | 14,90 Gb Free Space | 99,84% Space Free | Partition Type: FAT32

 

Computer Name: WITJOK | User Name: Viktor | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.11.06 19:00:32 | 003,143,800 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe

PRC - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

PRC - [2012.10.23 15:02:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- F:\OTL.exe

PRC - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

PRC - [2012.09.07 16:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012.09.07 16:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

PRC - [2012.09.07 16:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe

PRC - [2010.08.10 10:06:16 | 000,975,952 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe

PRC - [2010.08.10 10:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe

PRC - [2010.08.10 10:06:16 | 000,305,744 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe

PRC - [2010.06.28 23:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe

PRC - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe

PRC - [2010.01.08 14:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2009.05.20 07:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2010.04.21 00:34:40 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2012.11.01 02:25:50 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)

SRV - [2012.10.09 19:43:27 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.09.07 16:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012.09.07 16:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2012.08.13 12:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)

SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)

SRV - [2010.09.30 14:00:28 | 000,253,264 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)

SRV - [2010.08.10 10:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)

SRV - [2010.07.29 13:16:12 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc)

SRV - [2010.07.01 05:10:26 | 002,533,400 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)

SRV - [2010.07.01 05:10:22 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)

SRV - [2010.06.28 23:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)

SRV - [2010.06.15 11:51:56 | 000,822,304 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)

SRV - [2010.05.27 03:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)

SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010.01.29 00:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)

SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2010.01.08 14:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)

SRV - [2009.11.02 12:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)

SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012.10.22 13:02:44 | 000,154,464 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)

DRV:64bit: - [2012.10.15 03:48:50 | 000,063,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)

DRV:64bit: - [2012.10.05 03:32:50 | 000,111,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)

DRV:64bit: - [2012.10.03 00:32:40 | 000,031,080 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)

DRV:64bit: - [2012.10.02 02:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)

DRV:64bit: - [2012.09.21 02:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)

DRV:64bit: - [2012.09.21 02:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)

DRV:64bit: - [2012.09.14 02:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)

DRV:64bit: - [2012.09.07 16:04:46 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012.03.01 07:54:38 | 000,022,896 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2012.02.15 23:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm)

DRV:64bit: - [2012.02.15 23:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus)

DRV:64bit: - [2011.03.11 07:22:41 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 07:22:40 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2010.11.17 13:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2010.07.29 13:16:30 | 000,270,496 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)

DRV:64bit: - [2010.07.29 13:16:28 | 000,295,072 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)

DRV:64bit: - [2010.07.29 13:16:28 | 000,201,376 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)

DRV:64bit: - [2010.07.29 13:16:28 | 000,154,272 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)

DRV:64bit: - [2010.07.29 13:16:28 | 000,051,872 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)

DRV:64bit: - [2010.07.29 13:16:28 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)

DRV:64bit: - [2010.07.29 13:16:28 | 000,028,832 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)

DRV:64bit: - [2010.07.15 22:57:34 | 002,350,952 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)

DRV:64bit: - [2010.06.25 03:33:36 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2010.06.05 15:27:58 | 010,326,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdpmd64.sys -- (intelkmd)

DRV:64bit: - [2010.05.05 22:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2010.04.28 07:21:38 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV:64bit: - [2010.04.28 07:21:38 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)

DRV:64bit: - [2010.04.21 02:15:04 | 006,406,144 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag)

DRV:64bit: - [2010.04.20 23:39:36 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2010.03.04 03:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)

DRV:64bit: - [2010.02.10 08:02:00 | 000,158,720 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd)

DRV:64bit: - [2009.11.02 12:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)

DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)

DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)

DRV:64bit: - [2009.10.29 19:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)

DRV:64bit: - [2009.10.29 19:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\massfilter.sys -- (massfilter)

DRV:64bit: - [2009.09.17 05:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64)

DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.03 03:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2009.06.03 03:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2009.06.03 03:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

DRV:64bit: - [2009.05.26 14:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)

DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Funmoods Search

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1QzuzytBzy0F0F0AzytB0E0DzyzyyD0D0A0DtN0D0Tzu0CtCzyzytN1L2XzutBtFtCtFtDtFtAtDtC&cr=1525869463

IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms}

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Funmoods Search

IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1QzuzytBzy0F0F0AzytB0E0DzyzyyD0D0A0DtN0D0Tzu0CtCzyzytN1L2XzutBtFtCtFtDtFtAtDtC&cr=1525869463

IE - HKLM\..\SearchScopes\{55AD9155-D410-F399-748F-731AC87B6D93}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox

IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms}

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = Lavasoft

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKCU\..\SearchScopes,Backup.Old.DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://start.funmoods.com/results.php?f=4&q={searchTerms}&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1QzuzytBzy0F0F0AzytB0E0DzyzyyD0D0A0DtN0D0Tzu0CtCzyzytN1L2XzutBtFtCtFtDtFtAtDtC&cr=1525869463

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=115307&tt=280812_2004_3512_6&babsrc=SP_ss&mntrId=e4dc5dad000000000000929ffa92ed99

IE - HKCU\..\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: "URL" = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=rbox&toolbarid=adawaretb&u=443F8AC41D7AC23FF253DE500A04A51C&q={searchTerms}

IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm

IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={FF0EF6BE-E4BA-4B8E-9117-F683821D9715}&mid=fb482d9302fb47d09890b1a22f5c7044-44ee70d2c753c11c35416468cba56e1fa8b870fa&lang=de&ds=AVG&pr=pr&d=2012-10-03 01:32:41&v=12.2.5.34&sap=dsp&q={searchTerms}

IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=161&systemid=406&sr=0&q={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"

FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"

FF - prefs.js..browser.search.update: ""

FF - prefs.js..backup.old.browser.search.defaultenginename: ""

FF - prefs.js..backup.old.browser.search.selectedEngine: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..browser.search.defaultthis.engineName: ""

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.selectedEngine: ""

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.search.useDBForOrder: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..extensions.enabledAddons: {800b5000-a755-47e1-992b-48a1c1357f07}:1.4.7

FF - prefs.js..extensions.enabledAddons: toolbar@gmx.net:2.1.4

FF - prefs.js..extensions.enabledAddons: {ebd898f8-fcf6-4694-bc3b-eabc7271eeb1}:3.14.1.0

FF - prefs.js..extensions.enabledAddons: ffxtlbr@funmoods.com:1.5.1

FF - prefs.js..extensions.enabledAddons: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0

FF - prefs.js..extensions.enabledAddons: {99079a25-328f-4bd4-be04-00955acaa0a7}:4.6.1.01

FF - prefs.js..extensions.enabledAddons: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:6.1.0.10441

FF - prefs.js..extensions.enabledAddons: {87934c42-161d-45bc-8cef-ef18abe2a30c}:2.1

FF - prefs.js..extensions.enabledAddons: bbrs_002@blabbers.com:1.0.5

FF - prefs.js..extensions.enabledAddons: {9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}:1.0

FF - prefs.js..extensions.enabledItems: 

FF - prefs.js..extensions.enabledItems: 

FF - prefs.js..extensions.enabledItems: 

FF - prefs.js..extensions.enabledItems: 

FF - prefs.js..network.proxy.type: ""

 

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_287.dll File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll ()

FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\12.2.6\\npsitesafety.dll File not found

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011.01.13 17:54:38 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.01.13 17:54:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.01.13 17:54:47 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\12.2.5.34\

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.11.01 02:25:54 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.11.01 02:25:34 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\Viktor\AppData\Roaming\14001.018 [2012.08.27 11:02:26 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.11.01 02:25:54 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.11.01 02:25:34 | 000,000,000 | ---D | M]

 

[2012.10.03 00:26:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Viktor\AppData\Roaming\mozilla\Extensions

[2012.10.05 19:24:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Viktor\AppData\Roaming\mozilla\Firefox\Profiles\pjq5x742.default\extensions

[2012.03.29 02:15:34 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Viktor\AppData\Roaming\mozilla\Firefox\Profiles\pjq5x742.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2012.10.25 03:08:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Viktor\AppData\Roaming\mozilla\Firefox\Profiles\yjqczl3w.Standard-Benutzer\extensions

[2012.06.30 02:35:25 | 000,575,217 | ---- | M] () (No name found) -- C:\Users\Viktor\AppData\Roaming\mozilla\firefox\profiles\pjq5x742.default\extensions\toolbar@gmx.net.xpi

File not found (No name found) -- C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

File not found (No name found) -- C:\PROGRAM FILES (X86)\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION

File not found (No name found) -- C:\USERS\VIKTOR\APPDATA\ROAMING\14001.003

File not found (No name found) -- C:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{87934C42-161D-45BC-8CEF-EF18ABE2A30C}

File not found (No name found) -- C:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

File not found (No name found) -- C:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1}

File not found (No name found) -- C:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\BBRS_002@BLABBERS.COM

File not found (No name found) -- C:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\FFXTLBR@FUNMOODS.COM

[2012.11.01 02:25:54 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012.03.20 01:07:54 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

 
 ========== Chrome  ==========

 

CHR - homepage: Google

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}

CHR - homepage: Google

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\23.0.1271.64\pdf.dll

CHR - plugin:  (Enabled) = C:\Users\Viktor\AppData\Local\Google\Chrome\User Data\Default\Extensions\bodddioamolcibagionmmobehnbhiakf\1.0.5_0\chromeNPAPI.dll

CHR - plugin: Babylon ToolBar (Enabled) = C:\Users\Viktor\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.8_0\BabylonChromeToolBar.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll

CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL

CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

CHR - plugin: Bing Bar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll

CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

 

O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll File not found

O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7529.1424\swg64.dll (Google Inc.)

O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll File not found

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

O3:64bit: - HKLM\..\Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll File not found

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.

O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found

O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found

O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{961AA67A-C9EC-4656-ACAE-5D99B17819B5}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E77964F0-289D-4C1C-A250-5D0B67FAD4F3}: DhcpNameServer = 192.168.178.1

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\ms-help - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll File not found

O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O32 - HKLM CDRom: AutoRun - 1

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings

ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework

ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig

ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

 

MsConfig:64bit - StartUpReg: Ad-Aware Antivirus - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig:64bit - StartUpReg: ArcadeMovieService - hkey= - key= - C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe (CyberLink Corp.)

MsConfig:64bit - StartUpReg: ICQ - hkey= - key= - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

MsConfig:64bit - StartUpReg: jICc7n9BYxBTRVw - hkey= - key= -  File not found

MsConfig:64bit - StartUpReg: MDS_Menu - hkey= - key= - C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

MsConfig:64bit - StartUpReg: vProt - hkey= - key= -  File not found

MsConfig:64bit - State: "startup" - Reg Error: Key error.

MsConfig:64bit - State: "bootini" - Reg Error: Key error.

MsConfig:64bit - State: "services" - Reg Error: Key error.

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.11.14 07:08:11 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012.11.08 20:24:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2012.11.01 02:25:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2012.10.25 05:53:42 | 000,000,000 | ---D | C] -- C:\FRST

[3 C:\Users\Viktor\AppData\Roaming\*.tmp files -> C:\Users\Viktor\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.11.22 16:00:41 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012.11.22 16:00:41 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2012.11.22 16:00:41 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012.11.22 16:00:41 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2012.11.22 16:00:41 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012.11.22 15:58:28 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012.11.22 15:58:12 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl

[2012.11.22 15:58:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.11.22 15:58:02 | 2960,510,976 | -HS- | M] () -- C:\hiberfil.sys

[2012.11.22 15:38:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.11.22 15:38:51 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.11.21 23:55:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012.11.21 23:43:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.11.14 18:12:14 | 000,435,296 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2012.11.08 20:24:55 | 000,000,985 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk

[2012.11.06 20:57:49 | 000,002,378 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[3 C:\Users\Viktor\AppData\Roaming\*.tmp files -> C:\Users\Viktor\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2012.11.14 07:11:52 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf

[2012.11.14 07:05:15 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf

[2012.08.28 23:19:34 | 000,065,536 | ---- | C] () -- C:\Users\Viktor\AppData\Roaming\pjq5x742.default.dat

[2012.07.23 13:50:30 | 000,000,025 | ---- | C] () -- C:\Users\Viktor\AppData\Roaming\urhtps.dat

[2012.01.11 12:45:08 | 000,076,135 | ---- | C] () -- C:\Users\Viktor\AppData\Roaming\msconfig.dat

[2011.06.14 10:36:39 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat

[2011.06.14 10:36:39 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat

[2011.04.13 20:59:14 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll

[2011.02.15 17:52:16 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2011.02.12 17:28:55 | 117,349,376 | ---- | C] () -- C:\Users\Viktor\kavkis.msi

[2011.01.13 17:41:19 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2011.01.13 17:37:22 | 000,002,093 | ---- | C] () -- C:\Windows\SysWow64\atipblup.dat

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== LOP Check ==========

 

[2012.07.21 23:19:09 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.002

[2012.07.25 18:52:50 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.004

[2012.07.27 20:38:58 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.005

[2012.07.28 17:17:13 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.006

[2012.07.30 13:25:49 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.007

[2012.07.31 20:20:40 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.008

[2012.08.06 15:46:28 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.009

[2012.08.07 12:40:06 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.010

[2012.08.08 11:14:14 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.011

[2012.08.09 10:20:09 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.012

[2012.08.12 17:40:55 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.014

[2012.08.15 11:31:33 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.015

[2012.08.17 14:45:22 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.016

[2012.08.25 21:44:10 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.017

[2012.08.27 11:02:26 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\14001.018

[2011.06.17 14:20:10 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\Acreon

[2012.07.21 02:25:42 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\Ad-Aware Antivirus

[2011.02.14 23:56:41 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\Ashampoo

[2012.10.03 00:34:08 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\AVG2013

[2012.04.14 01:29:42 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\Blekko

[2012.10.01 18:08:21 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\BrowserCompanion

[2012.11.04 23:32:13 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\ICQ

[2011.11.10 09:56:36 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\Juniper Networks

[2012.07.21 23:18:39 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\kock

[2012.05.28 23:17:16 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\OpenOffice.org

[2011.04.02 19:18:06 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\PowerCinema

[2012.07.17 20:44:20 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\ScanToPDF_4

[2011.09.07 22:04:12 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\TS3Client

[2012.10.03 00:32:48 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\TuneUp Software

[2012.08.29 10:05:15 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\UAs

[2012.08.29 10:05:39 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Roaming\xmldm

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 
 < %SYSTEMDRIVE%\*. >

[2012.10.03 00:31:18 | 000,000,000 | -H-D | M] -- C:\$AVG

[2011.03.30 12:44:19 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2012.06.20 16:20:38 | 000,000,000 | ---D | M] -- C:\ATI

[2011.01.13 17:42:44 | 000,000,000 | ---D | M] -- C:\book

[2012.11.14 07:15:38 | 000,000,000 | -HSD | M] -- C:\Config.Msi

[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2011.02.12 23:24:14 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2012.10.25 05:53:42 | 000,000,000 | ---D | M] -- C:\FRST

[2010.09.08 08:31:04 | 000,000,000 | ---D | M] -- C:\Intel

[2012.03.20 16:31:57 | 000,000,000 | RH-D | M] -- C:\MSOCache

[2011.02.12 16:26:20 | 000,000,000 | -H-D | M] -- C:\OEM

[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2012.08.29 10:01:50 | 000,000,000 | R--D | M] -- C:\Program Files

[2012.11.01 13:20:24 | 000,000,000 | R--D | M] -- C:\Program Files (x86)

[2012.10.25 07:46:41 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2011.02.12 23:24:14 | 000,000,000 | -HSD | M] -- C:\Programme

[2011.02.12 23:24:15 | 000,000,000 | -HSD | M] -- C:\Recovery

[2012.11.22 16:02:03 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2011.02.16 16:40:38 | 000,000,000 | ---D | M] -- C:\UserData

[2011.02.12 23:24:22 | 000,000,000 | R--D | M] -- C:\Users

[2012.10.25 01:30:50 | 000,000,000 | ---D | M] -- C:\Windows

[2012.10.02 04:55:58 | 000,000,000 | ---D | M] -- C:\_OTL

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 
 < %windir%\installer\*. /5 >

 
 < %localappdata%\*. /5 >

[2012.11.22 15:58:25 | 000,000,000 | ---D | M] -- C:\Users\Viktor\AppData\Local\Temp
 

< End of report >

--- --- ---

Zitat:

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-22 16:11:50
-----------------------------
16:11:50.485 OS Version: Windows x64 6.1.7600
16:11:50.485 Number of processors: 4 586 0x2505
16:11:50.485 ComputerName: WITJOK UserName: Viktor
16:11:51.531 Initialize success
16:12:03.112 AVAST engine download error: 0
16:12:21.645 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
16:12:21.645 Disk 0 Vendor: Hitachi_ PB4O Size: 476940MB BusType: 3
16:12:21.676 Disk 0 MBR read successfully
16:12:21.676 Disk 0 MBR scan
16:12:21.676 Disk 0 Windows 7 default MBR code
16:12:21.691 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 14336 MB offset 2048
16:12:21.707 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 29362176
16:12:21.723 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 164741 MB offset 29566976
16:12:21.754 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 297761 MB offset 366956730
16:12:21.785 Disk 0 scanning C:\Windows\system32\drivers
16:12:27.619 Service scanning
16:12:48.601 Modules scanning
16:12:48.601 Disk 0 trace - called modules:
16:12:48.633 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
16:12:48.633 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006fdf060]
16:12:48.648 3 CLASSPNP.SYS[fffff88001aef43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004f47050]
16:12:48.648 Scan finished successfully
16:14:12.093 Disk 0 MBR has been saved successfully to "F:\MBR.dat"
16:14:12.093 The log file has been saved successfully to "F:\aswMBR1.txt"

wo bekomme ich den die extra txt her??

schrauber

22.11.2012 17:41

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

und ein frisches OTL log bitte.

JimmyRainer

22.11.2012 18:21

so hier das ergebniss

Zitat:

# AdwCleaner v2.008 - Datei am 22/11/2012 um 18:16:43 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Home Premium (64 bits)
# Benutzer : Viktor - WITJOK
# Bootmodus : Normal
# Ausgeführt unter : F:\adwcleaner.exe
# Option [Löschen]

**** [Dienste] ****

Gestoppt & Gelöscht : ICQ Service

***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Users\Viktor\AppData\Roaming\BrowserCompanion
Ordner Gelöscht : C:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Schlüssel Gelöscht : HKCU\Software\Microsoft\Babylon
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\updatebho.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\wit4ie.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\b
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5B4144E1-B61D-495A-9A50-CD1A95D86D15}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{841D5A49-E48D-413C-9C28-EB3D9081D705}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{8830DDF0-3042-404D-A62C-384A85E34833}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\updatebho.TimerBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\updatebho.TimerBHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wit4ie.WitBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wit4ie.WitBHO.2
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9F0C17EB-EF2C-4278-9136-2D547656BC03}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E55E7026-EF2A-4A17-AAA7-DB98EA3FD1B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BrowserCompanion
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Searchqu Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FEFD3AF5-A346-4451-AA23-A3AD54915515}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9F0C17EB-EF2C-4278-9136-2D547656BC03}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}
Schlüssel Gelöscht : HKLM\SOFTWARE\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.7600.16385

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affid=115307&tt=280812_2004_3512_6&babsrc=nt_ss&mntrid=e4dc5dad000000000000929ffa92ed99 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1QzuzytBzy0F0F0AzytB0E0DzyzyyD0D0A0DtN0D0Tzu0CtCzyzytN1L2XzutBtFtCtFtDtFtAtDtC&cr=1525869463 --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.funmoods.com/?f=1&a=fmtgl&chnl=fmtgl&cd=2XzuyEtN2Y1L1QzuzytBzy0F0F0AzytB0E0DzyzyyD0D0A0DtN0D0Tzu0CtCzyzytN1L2XzutBtFtCtFtDtFtAtDtC&cr=1525869463 --> hxxp://www.google.com

-\\ Mozilla Firefox v15.0 (de)

Profilname : default
Datei : C:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\prefs.js

C:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Gelöscht : user_pref("browser.search.selectedEngine", "AVG Secure Search");
Gelöscht : user_pref("CT3196716..clientLogIsEnabled", false);
Gelöscht : user_pref("CT3196716..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Gelöscht : user_pref("CT3196716..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Gelöscht : user_pref("CT3196716.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Gelöscht : user_pref("CT3196716.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Gelöscht : user_pref("CT3196716.AppTrackingLastCheckTime", "Sun Jul 22 2012 03:33:52 GMT+0200");
Gelöscht : user_pref("CT3196716.BrowserCompStateIsOpen_3263554499264134319", true);
Gelöscht : user_pref("CT3196716.BrowserCompStateIsOpen_4711547172607932304", true);
Gelöscht : user_pref("CT3196716.CT3196716", "CT3196716");
Gelöscht : user_pref("CT3196716.CurrentServerDate", "24-7-2012");
Gelöscht : user_pref("CT3196716.DSChangedManually", false);
Gelöscht : user_pref("CT3196716.DSInstall", true);
Gelöscht : user_pref("CT3196716.DSProtectChoice", true);
Gelöscht : user_pref("CT3196716.DSProtectCount", 3);
Gelöscht : user_pref("CT3196716.DialogsAlignMode", "LTR");
Gelöscht : user_pref("CT3196716.DialogsGetterLastCheckTime", "Mon Jul 23 2012 20:43:09 GMT+0200");
Gelöscht : user_pref("CT3196716.DownloadReferralCookieData", "");
Gelöscht : user_pref("CT3196716.EMailNotifierPollDate", "Tue Jul 24 2012 10:24:08 GMT+0200");
Gelöscht : user_pref("CT3196716.ExternalComponentPollDate129844886196746599", "Mon Jul 23 2012 00:36:07 GMT+020[...]
Gelöscht : user_pref("CT3196716.ExternalComponentPollDate129844886197059098", "Mon Jul 23 2012 00:36:07 GMT+020[...]
Gelöscht : user_pref("CT3196716.FirstServerDate", "16-7-2012");
Gelöscht : user_pref("CT3196716.FirstTime", true);
Gelöscht : user_pref("CT3196716.FirstTimeFF3", true);
Gelöscht : user_pref("CT3196716.FirstTimeHiddenVer", true);
Gelöscht : user_pref("CT3196716.FixPageNotFoundErrors", true);
Gelöscht : user_pref("CT3196716.GroupingServerCheckInterval", 1440);
Gelöscht : user_pref("CT3196716.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Gelöscht : user_pref("CT3196716.HPInstall", true);
Gelöscht : user_pref("CT3196716.HPProtectChoice", true);
Gelöscht : user_pref("CT3196716.HPProtectCount", 3);
Gelöscht : user_pref("CT3196716.HasUserGlobalKeys", true);
Gelöscht : user_pref("CT3196716.HomePageProtectorEnabled", false);
Gelöscht : user_pref("CT3196716.HomepageBeforeUnload", "hxxp://www.searchnu.com/406");
Gelöscht : user_pref("CT3196716.Initialize", true);
Gelöscht : user_pref("CT3196716.InitializeCommonPrefs", true);
Gelöscht : user_pref("CT3196716.InstallationAndCookieDataSentCount", 3);
Gelöscht : user_pref("CT3196716.InstallationType", "Unknown");
Gelöscht : user_pref("CT3196716.InstalledDate", "Mon Jul 16 2012 22:36:18 GMT+0200");
Gelöscht : user_pref("CT3196716.InvalidateCache", false);
Gelöscht : user_pref("CT3196716.IsAlertDBUpdated", true);
Gelöscht : user_pref("CT3196716.IsGrouping", false);
Gelöscht : user_pref("CT3196716.IsInitSetupIni", true);
Gelöscht : user_pref("CT3196716.IsMulticommunity", false);
Gelöscht : user_pref("CT3196716.IsOpenThankYouPage", true);
Gelöscht : user_pref("CT3196716.IsOpenUninstallPage", true);
Gelöscht : user_pref("CT3196716.IsProtectorsInit", true);
Gelöscht : user_pref("CT3196716.LanguagePackLastCheckTime", "Mon Jul 23 2012 13:21:42 GMT+0200");
Gelöscht : user_pref("CT3196716.LanguagePackReloadIntervalMM", 1440);
Gelöscht : user_pref("CT3196716.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Gelöscht : user_pref("CT3196716.LastLogin_3.14.1.0", "Tue Jul 24 2012 10:24:10 GMT+0200");
Gelöscht : user_pref("CT3196716.LatestVersion", "3.14.1.0");
Gelöscht : user_pref("CT3196716.Locale", "en");
Gelöscht : user_pref("CT3196716.MCDetectTooltipHeight", "83");
Gelöscht : user_pref("CT3196716.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Gelöscht : user_pref("CT3196716.MCDetectTooltipWidth", "295");
Gelöscht : user_pref("CT3196716.MyStuffEnabledAtInstallation", true);
Gelöscht : user_pref("CT3196716.OriginalFirstVersion", "3.14.1.0");
Gelöscht : user_pref("CT3196716.RadioIsPodcast", false);
Gelöscht : user_pref("CT3196716.RadioLastCheckTime", "Mon Jul 23 2012 13:21:38 GMT+0200");
Gelöscht : user_pref("CT3196716.RadioLastUpdateIPServer", "3");
Gelöscht : user_pref("CT3196716.RadioLastUpdateServer", "3");
Gelöscht : user_pref("CT3196716.RadioMediaID", "9962");
Gelöscht : user_pref("CT3196716.RadioMediaType", "Media Player");
Gelöscht : user_pref("CT3196716.RadioMenuSelectedID", "EBRadioMenu_CT31967169962");
Gelöscht : user_pref("CT3196716.RadioShrinkedFromSetup", false);
Gelöscht : user_pref("CT3196716.RadioStationName", "California%20Rock");
Gelöscht : user_pref("CT3196716.RadioStationURL", "hxxp://feedlive.net/california.asx");
Gelöscht : user_pref("CT3196716.SavedHomepage", "hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&[...]
Gelöscht : user_pref("CT3196716.SearchCaption", "WiseConvert Customized Web Search");
Gelöscht : user_pref("CT3196716.SearchEngineBeforeUnload", "WiseConvert Customized Web Search");
Gelöscht : user_pref("CT3196716.SearchFromAddressBarIsInit", true);
Gelöscht : user_pref("CT3196716.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT323[...]
Gelöscht : user_pref("CT3196716.SearchInNewTabEnabled", true);
Gelöscht : user_pref("CT3196716.SearchInNewTabIntervalMM", 1440);
Gelöscht : user_pref("CT3196716.SearchInNewTabLastCheckTime", "Mon Jul 23 2012 13:21:38 GMT+0200");
Gelöscht : user_pref("CT3196716.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Gelöscht : user_pref("CT3196716.SearchProtectorEnabled", false);
Gelöscht : user_pref("CT3196716.SearchProtectorToolbarDisabled", false);
Gelöscht : user_pref("CT3196716.SendProtectorDataViaLogin", true);
Gelöscht : user_pref("CT3196716.ServiceMapLastCheckTime", "Mon Jul 23 2012 13:21:40 GMT+0200");
Gelöscht : user_pref("CT3196716.SettingsLastCheckTime", "Tue Jul 24 2012 10:24:08 GMT+0200");
Gelöscht : user_pref("CT3196716.SettingsLastUpdate", "1342194074");
Gelöscht : user_pref("CT3196716.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT3230028&SearchSource=13");
Gelöscht : user_pref("CT3196716.ThirdPartyComponentsInterval", 504);
Gelöscht : user_pref("CT3196716.ThirdPartyComponentsLastCheck", "Mon Jul 16 2012 22:36:16 GMT+0200");
Gelöscht : user_pref("CT3196716.ThirdPartyComponentsLastUpdate", "1331805997");
Gelöscht : user_pref("CT3196716.ToolbarShrinkedFromSetup", false);
Gelöscht : user_pref("CT3196716.TrusteLinkUrl", "hxxp://trust.conduit.com/CT3230028");
Gelöscht : user_pref("CT3196716.UserID", "UN61387861802182825");
Gelöscht : user_pref("CT3196716.ValidationData_Toolbar", 1);
Gelöscht : user_pref("CT3196716.WeatherNetwork", "");
Gelöscht : user_pref("CT3196716.WeatherPollDate", "Tue Jul 24 2012 10:24:27 GMT+0200");
Gelöscht : user_pref("CT3196716.WeatherUnit", "C");
Gelöscht : user_pref("CT3196716.alertChannelId", "1667895");
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B4D4[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C474[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e-x305", "247E2936303C363679453A3D2A722C797A207B3128333D462[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e.:2z527", "247E707571777278333228702A7B797B7B7E30273224262[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F5[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e/x305", "247E2B413536327844393C29712B787C7B773027323E4C434[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e06cg5el8:", "6E6D6D6F72736D747070");
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e06cg5el;8i:k", "247E2D2F226A747373757879737A7676242F4B4947[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e0x305", "247E2C403A407743383B28702A777C757D2F26313E4129554[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D322934435[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e31;cjc<=fbj#mm", "247E61393F236B257576737A2A212C6E414F444D[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e31;cjdjihl@af%peh", "247E61393F236B25767172727A2B222D6F425[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e31;cjeik4!kk", "247E61393F236B25767177722A212C6E414F444D32[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e31;cji68>;la<>\"!(rr", "247E61393F236B2576767329202B6D404E[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e31;cji8a k@c", "247E61393F236B256F75287E2A6C3F4D424B307832[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e4x305", "247E302C407642373A276F29777B74762E2530413E4F494A5[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e5x305", "247E3136422B7743383B28702A79757A772F2631434B3D495[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B3[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347474[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e8x305", "247E343D3F3B35373B3F367C47472C742E7E7823322934495[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e:x305", "247E36333B38327844393C29712B7B76797A3027324948554[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e<x305", "247E38343030442F463644377D493E412E7630217D2426352[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e=x305", "247E3933363F41413739357C483D402D752F207E2022342B3[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A355[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7e@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7eax305", "247E3D3D37387743383B28702A7B7A757E2F26314F4F544A5[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7ebe3g=;d9n9=d", "372C2D326975762E3A3C7B3A39434A494841434B26[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7ebx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7ecx305", "247E3F3D303043312E7A463B3E2B732D7B207E31283353515[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7edx305", "247E4035422A363879453A3D2A722C7D202F26315247543C4[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b+7etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C322934215[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b-0?3g>d", "396B6F6C3F7141727A71467447207978794C25204F7D212A55[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b-0?3g@6:5;", "");
Gelöscht : user_pref("CT3196716.backendstorage./9b-0?3gfa7ef", "2B2E2C3D");
Gelöscht : user_pref("CT3196716.backendstorage./9b-3=3eccja=f>", "247E333D2C452F4135276F292A212C393D44307832332[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b/>01=9a6k6<im;krie@pdawm", "6A696B7273747576");
Gelöscht : user_pref("CT3196716.backendstorage./9b3=>@44i48?", "372C2D326975763342363341484779213F3E484F4E4D464[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b5ba==9cjag", "676E6A6A3F6B706E7A73767574784876774B782024");
Gelöscht : user_pref("CT3196716.backendstorage./9b6b11g4c56b>f;p;anr@p", "6E6D6D6F72736D746F7675757A");
Gelöscht : user_pref("CT3196716.backendstorage./9b9643g3/9e", "6A");
Gelöscht : user_pref("CT3196716.backendstorage./9b<:222h64<", "393F352F3E");
Gelöscht : user_pref("CT3196716.backendstorage./9b=+03eh8h8j?:", "4443");
Gelöscht : user_pref("CT3196716.backendstorage./9b?+e2a52d8", "372C2D326975762E3A3C7B3A39434A494841434B26514649[...]
Gelöscht : user_pref("CT3196716.backendstorage./9b?b0d:8aj62<h", "6D");
Gelöscht : user_pref("CT3196716.backendstorage./9ba@0<0bi6a7gn:6@l?", "6E6B");
Gelöscht : user_pref("CT3196716.backendstorage.event_data", "253542253544");
Gelöscht : user_pref("CT3196716.backendstorage.fired_events", "");
Gelöscht : user_pref("CT3196716.backendstorage.key_date", "3234");
Gelöscht : user_pref("CT3196716.backendstorage.shoppingapp.gk.exipres", "467269204A756C20323720323031322030333A[...]
Gelöscht : user_pref("CT3196716.backendstorage.shoppingapp.gk.geolocation", "6765726D616E79");
Gelöscht : user_pref("CT3196716.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Gelöscht : user_pref("CT3196716.globalFirstTimeInfoLastCheckTime", "Mon Jul 16 2012 22:36:17 GMT+0200");
Gelöscht : user_pref("CT3196716.homepageProtectorEnableByLogin", true);
Gelöscht : user_pref("CT3196716.initDone", true);
Gelöscht : user_pref("CT3196716.isAppTrackingManagerOn", true);
Gelöscht : user_pref("CT3196716.isFirstRadioInstallation", false);
Gelöscht : user_pref("CT3196716.myStuffEnabled", true);
Gelöscht : user_pref("CT3196716.myStuffPublihserMinWidth", 400);
Gelöscht : user_pref("CT3196716.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Gelöscht : user_pref("CT3196716.myStuffServiceIntervalMM", 1440);
Gelöscht : user_pref("CT3196716.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Gelöscht : user_pref("CT3196716.navigateToUrlOnSearch", false);
Gelöscht : user_pref("CT3196716.revertSettingsEnabled", true);
Gelöscht : user_pref("CT3196716.searchProtectorDialogDelayInSec", 10);
Gelöscht : user_pref("CT3196716.searchProtectorEnableByLogin", true);
Gelöscht : user_pref("CT3196716.testingCtid", "CT3230028");
Gelöscht : user_pref("CT3196716.toolbarAppMetaDataLastCheckTime", "Mon Jul 23 2012 13:21:42 GMT+0200");
Gelöscht : user_pref("CT3196716.toolbarContextMenuLastCheckTime", "Mon Jul 16 2012 22:36:18 GMT+0200");
Gelöscht : user_pref("CT3196716.usagesFlag", 2);
Gelöscht : user_pref("CT3230028.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Gelöscht : user_pref("CommunityToolbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3230028&Search[...]
Gelöscht : user_pref("CommunityToolbar.ConduitSearchList", "WiseConvert Customized Web Search");
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT3230028/CT3230028[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1667895/1660359/DE", "\"0\"[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT3230028", [...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT3230028",[...]
Gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"229[...]
Gelöscht : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Viktor\\AppData\\Roaming\\Mozilla\\[...]
Gelöscht : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.14.1.0");
Gelöscht : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://pgcff.pricegong.com/agreement/agree.html#pg_e[...]
Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://safesearchr.lavasoft.com/?source=[...]
Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT3196716");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT3196716");
Gelöscht : user_pref("CommunityToolbar.ToolbarsList4", "CT3196716");
Gelöscht : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Tue Jul 24 2012 10:24:31 GMT+0200");
Gelöscht : user_pref("CommunityToolbar.globalUserId", "0ce8ef9c-6134-48d7-a7c9-9e5aa55b09c6");
Gelöscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT3196716");
Gelöscht : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Mon Jul 23 2012 22:36:2[...]
Gelöscht : user_pref("CommunityToolbar.notifications.alertEnabled", true);
Gelöscht : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Gelöscht : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Mon Jul 23 2012 13:21:48 GMT+020[...]
Gelöscht : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.locale", "en");
Gelöscht : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Mon Jul 23 2012 13:21:41 GMT+0200");
Gelöscht : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Gelöscht : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Gelöscht : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Gelöscht : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Gelöscht : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Gelöscht : user_pref("CommunityToolbar.notifications.userId", "4b28b6cb-2f0e-44ff-b241-0e49a937979b");
Gelöscht : user_pref("CommunityToolbar.originalHomepage", "hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp[...]
Gelöscht : user_pref("CommunityToolbar.originalSearchEngine", "ICQ Search");
Gelöscht : user_pref("extensions.enabledAddons", "{800b5000-a755-47e1-992b-48a1c1357f07}:1.4.7,toolbar@gmx.net:[...]
Gelöscht : user_pref("extensions.funmoods.aflt", "fmtgl");
Gelöscht : user_pref("extensions.funmoods.autoRvrt", false);
Gelöscht : user_pref("extensions.funmoods.brwsrsrc", "ietlbr");
Gelöscht : user_pref("extensions.funmoods.cntry", "DE");
Gelöscht : user_pref("extensions.funmoods.dfltLng", "");
Gelöscht : user_pref("extensions.funmoods.dfltSrch", true);
Gelöscht : user_pref("extensions.funmoods.dfltlng", "en");
Gelöscht : user_pref("extensions.funmoods.dfltsrch", true);
Gelöscht : user_pref("extensions.funmoods.dnsErr", true);
Gelöscht : user_pref("extensions.funmoods.envrmnt", "production");
Gelöscht : user_pref("extensions.funmoods.excTlbr", false);
Gelöscht : user_pref("extensions.funmoods.hdrMd5", "5D04C6EE110AD33A194FE20A323D4651");
Gelöscht : user_pref("extensions.funmoods.hmpg", true);
Gelöscht : user_pref("extensions.funmoods.hmpgUrl", "hxxp://start.funmoods.com/?f=1&a=fmtgl&chnl=fmtgl&cd=2Xzuy[...]
Gelöscht : user_pref("extensions.funmoods.hrdid", "929FFA92ED995DAD");
Gelöscht : user_pref("extensions.funmoods.id", "929FFA92ED995DAD");
Gelöscht : user_pref("extensions.funmoods.instlDay", "15538");
Gelöscht : user_pref("extensions.funmoods.instlRef", "fmtgl");
Gelöscht : user_pref("extensions.funmoods.instlday", "15538");
Gelöscht : user_pref("extensions.funmoods.instlref", "fmtgl");
Gelöscht : user_pref("extensions.funmoods.isdcmntcmplt", true);
Gelöscht : user_pref("extensions.funmoods.keywordurl", "");
Gelöscht : user_pref("extensions.funmoods.lastVrsnTs", "1.5.23.2221:33:9");
Gelöscht : user_pref("extensions.funmoods.mntrvrsn", "1.3.0");
Gelöscht : user_pref("extensions.funmoods.newTab", true);
Gelöscht : user_pref("extensions.funmoods.newTabUrl", "hxxp://start.funmoods.com/?f=2&a=fmtgl&chnl=fmtgl&cd=2Xz[...]
Gelöscht : user_pref("extensions.funmoods.newtab", true);
Gelöscht : user_pref("extensions.funmoods.newtaburl", "hxxp://start.funmoods.com/?f=2&a=fmtgl&chnl=fmtgl&cd=2Xz[...]
Gelöscht : user_pref("extensions.funmoods.prdct", "funmoods");
Gelöscht : user_pref("extensions.funmoods.prtnrId", "funmoods");
Gelöscht : user_pref("extensions.funmoods.prtnrid", "funmoods");
Gelöscht : user_pref("extensions.funmoods.savedVrsnTs", "1");
Gelöscht : user_pref("extensions.funmoods.sg", "none");
Gelöscht : user_pref("extensions.funmoods.smplGrp", "none");
Gelöscht : user_pref("extensions.funmoods.smplgrp", "none");
Gelöscht : user_pref("extensions.funmoods.srch", "");
Gelöscht : user_pref("extensions.funmoods.srchPrvdr", "Search");
Gelöscht : user_pref("extensions.funmoods.srchprvdr", "Search");
Gelöscht : user_pref("extensions.funmoods.tlbrId", "base");
Gelöscht : user_pref("extensions.funmoods.tlbrSrchUrl", "hxxp://start.funmoods.com/?f=3&a=fmtgl&chnl=fmtgl&cd=2[...]
Gelöscht : user_pref("extensions.funmoods.tlbrid", "base");
Gelöscht : user_pref("extensions.funmoods.tlbrsrchurl", "hxxp://start.funmoods.com/?f=3&a=fmtgl&chnl=fmtgl&cd=2[...]
Gelöscht : user_pref("extensions.funmoods.vrsn", "1.5.23.22");
Gelöscht : user_pref("extensions.funmoods.vrsnTs", "1.5.23.2221:33:9");
Gelöscht : user_pref("extensions.funmoods.vrsni", "1.5.23.22");
Gelöscht : user_pref("extensions.funmoods.vrsnts", "1.5.23.2221:33:9");
Gelöscht : user_pref("extensions.funmoods.xpestat\\xpereportdata", "18-6-2012");
Gelöscht : user_pref("extensions.funmoods_i.newTab", true);
Gelöscht : user_pref("extensions.funmoods_i.smplGrp", "none");
Gelöscht : user_pref("extensions.funmoods_i.vrsnTs", "1.5.23.2221:33:9");

Profilname : Standard-Benutzer [Profil par défaut]
Datei : C:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\yjqczl3w.Standard-Benutzer\prefs.js

C:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\yjqczl3w.Standard-Benutzer\user.js ... Gelöscht !

Gelöscht : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=115307&tt=280812_2004_3512_6&babsr[...]
Gelöscht : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Gelöscht : user_pref("browser.search.order.1", "Search the web (Babylon)");
Gelöscht : user_pref("browser.search.selectedEngine", "AVG Secure Search");
Gelöscht : user_pref("browser.startup.homepage", "hxxp://search.babylon.com/?affID=115307&tt=280812_2004_3512_6[...]
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Gelöscht : user_pref("extensions.BabylonToolbar.autoRvrt", "false");
Gelöscht : user_pref("extensions.BabylonToolbar.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=115307&tt=280812_2004_3512_6");
Gelöscht : user_pref("extensions.BabylonToolbar.babext", "babExt");
Gelöscht : user_pref("extensions.BabylonToolbar.babtrack", "babTrack");
Gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", "30");
Gelöscht : user_pref("extensions.BabylonToolbar.bbdpng", 9);
Gelöscht : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltlng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltsrch", "false");
Gelöscht : user_pref("extensions.BabylonToolbar.dpk", "");
Gelöscht : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.firstrun", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "17FCBB545801DF86422B83A0B957A5C4");
Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hrdid", "e4dc5dad000000000000929ffa92ed99");
Gelöscht : user_pref("extensions.BabylonToolbar.id", "e4dc5dad000000000000929ffa92ed99");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15581");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.instlday", "15581");
Gelöscht : user_pref("extensions.BabylonToolbar.instlref", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.isdcmntcmplt", "false");
Gelöscht : user_pref("extensions.BabylonToolbar.keywordurl", "");
Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.6.9.1210:58:17");
Gelöscht : user_pref("extensions.BabylonToolbar.lastdp", 9);
Gelöscht : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.1");
Gelöscht : user_pref("extensions.BabylonToolbar.newTab", false);
Gelöscht : user_pref("extensions.BabylonToolbar.newtab", "false");
Gelöscht : user_pref("extensions.BabylonToolbar.newtaburl", "");
Gelöscht : user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"29\",\"lastVrsn\":\"29\",\"vrsnLoad\[...]
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrid", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.savedVrsnTs", "1");
Gelöscht : user_pref("extensions.BabylonToolbar.sg", "azb");
Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "azb");
Gelöscht : user_pref("extensions.BabylonToolbar.smplgrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.srcext", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.srch", "");
Gelöscht : user_pref("extensions.BabylonToolbar.srchprvdr", "");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrid", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrsrchurl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.6.9.12");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.6.9.1210:58:17");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.6.9.12");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnts", "1.6.9.1210:58:17");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=115307&tt=280812_2004_3512_6");
Gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", false);
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.6.9.1210:58:17");
Gelöscht : user_pref("keyword.URL", "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=e4dc5dad000000000000929ffa9[...]

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\Viktor\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [67750 octets] - [05/10/2012 18:57:36]
AdwCleaner[R2].txt - [67811 octets] - [05/10/2012 18:57:48]
AdwCleaner[S1].txt - [2491 octets] - [05/10/2012 19:24:21]
AdwCleaner[S2].txt - [48680 octets] - [22/11/2012 18:16:43]

########## EOF - C:\AdwCleaner[S2].txt - [48741 octets] ##########

schrauber

22.11.2012 18:52

Und weiter im Text :)

JimmyRainer

05.02.2013 18:20

Hi leider hat der rechner von meinem kumpel das problem schon wieder, weil der junge es nicht geschaft hat bis zum ende es durch zu ziehen, hoffe du hilfst ihm noch einmal aber diesma behalte ich den rechner bei mir bis es fertig ist ^^
hier das otl log

MFG Jimmy

OTL Logfile:

Code:

OTL logfile created on: 2/5/2013 6:06:26 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)

Drive C: | 100.00 Mb Total Space | 74.28 Mb Free Space | 74.28% Space Free | Partition Type: NTFS

Drive D: | 160.88 Gb Total Space | 49.81 Gb Free Space | 30.96% Space Free | Partition Type: NTFS

Drive E: | 290.78 Gb Total Space | 278.14 Gb Free Space | 95.65% Space Free | Partition Type: NTFS

Drive F: | 14.92 Gb Total Space | 12.28 Gb Free Space | 82.29% Space Free | Partition Type: FAT32

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2010/06/15 05:51:56 | 000,822,304 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)

SRV:64bit: - [2010/04/20 18:34:40 | 000,202,752 | ---- | M] (AMD) [Auto] -- D:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV:64bit: - [2010/01/28 18:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto] -- D:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)

SRV:64bit: - [2009/11/02 06:48:18 | 000,126,352 | ---- | M] (Intel(R) Corporation) [On_Demand] -- D:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)

SRV - [2013/01/19 05:08:37 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand] -- D:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013/01/08 15:43:57 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012/12/18 09:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012/12/14 10:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012/12/14 10:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2012/11/15 17:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- D:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)

SRV - [2012/10/22 07:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- D:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)

SRV - [2012/08/13 06:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled] -- D:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)

SRV - [2010/09/30 08:00:28 | 000,253,264 | ---- | M] () [Auto] -- D:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)

SRV - [2010/08/10 04:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto] -- D:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)

SRV - [2010/07/29 07:16:12 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto] -- D:\Program Files (x86)\Bluetooth Suite\AdminService.exe -- (AtherosSvc)

SRV - [2010/06/30 23:10:26 | 002,533,400 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)

SRV - [2010/06/30 23:10:22 | 000,325,656 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)

SRV - [2010/06/28 17:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto] -- D:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)

SRV - [2010/05/26 21:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand] -- D:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)

SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010/01/08 08:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)

SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012/12/14 10:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- D:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV:64bit: - [2012/11/15 17:33:24 | 000,111,968 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- D:\Windows\System32\drivers\avgmfx64.sys -- (Avgmfx64)

DRV:64bit: - [2012/10/22 07:02:44 | 000,154,464 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System] -- D:\Windows\System32\drivers\avgidsdrivera.sys -- (AVGIDSDriver)

DRV:64bit: - [2012/10/14 21:48:50 | 000,063,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- D:\Windows\System32\drivers\avgidsha.sys -- (AVGIDSHA)

DRV:64bit: - [2012/10/02 18:32:40 | 000,031,080 | ---- | M] (AVG Technologies) [Kernel | System] -- D:\Windows\System32\drivers\avgtpx64.sys -- (avgtp)

DRV:64bit: - [2012/10/01 20:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- D:\Windows\System32\drivers\avgldx64.sys -- (Avgldx64)

DRV:64bit: - [2012/09/20 20:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- D:\Windows\System32\drivers\avgtdia.sys -- (Avgtdia)

DRV:64bit: - [2012/09/20 20:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot] -- D:\Windows\System32\drivers\avgloga.sys -- (Avgloga)

DRV:64bit: - [2012/09/13 20:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- D:\Windows\System32\drivers\avgrkx64.sys -- (Avgrkx64)

DRV:64bit: - [2012/02/15 17:24:40 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)

DRV:64bit: - [2012/02/15 17:24:38 | 000,099,384 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)

DRV:64bit: - [2010/11/17 07:04:32 | 000,115,216 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtihdW76.sys -- (AtiHDAudioService)

DRV:64bit: - [2010/07/29 07:16:30 | 000,270,496 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btfilter.sys -- (BtFilter)

DRV:64bit: - [2010/07/29 07:16:28 | 000,295,072 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)

DRV:64bit: - [2010/07/29 07:16:28 | 000,201,376 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)

DRV:64bit: - [2010/07/29 07:16:28 | 000,154,272 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)

DRV:64bit: - [2010/07/29 07:16:28 | 000,051,872 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)

DRV:64bit: - [2010/07/29 07:16:28 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)

DRV:64bit: - [2010/07/29 07:16:28 | 000,028,832 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)

DRV:64bit: - [2010/07/15 16:57:34 | 002,350,952 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athrx.sys -- (athr)

DRV:64bit: - [2010/06/24 21:33:36 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L1C62x64.sys -- (L1C)

DRV:64bit: - [2010/06/05 09:27:58 | 010,326,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\igdpmd64.sys -- (intelkmd)

DRV:64bit: - [2010/05/05 16:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV:64bit: - [2010/04/20 20:15:04 | 006,406,144 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atipmdag.sys -- (amdkmdag)

DRV:64bit: - [2010/04/20 17:39:36 | 000,188,928 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV:64bit: - [2010/02/10 02:02:00 | 000,158,720 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Impcd.sys -- (Impcd)

DRV:64bit: - [2009/11/02 06:48:02 | 000,013,784 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\TurboB.sys -- (TurboB)

DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)

DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)

DRV:64bit: - [2009/10/29 13:28:24 | 000,119,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)

DRV:64bit: - [2009/10/29 13:28:24 | 000,011,776 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\massfilter.sys -- (massfilter)

DRV:64bit: - [2009/09/16 23:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECIx64.sys -- (HECIx64) Intel(R)

DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)

DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)

DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009/06/02 21:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)

DRV:64bit: - [2009/06/02 21:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- D:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)

DRV:64bit: - [2009/06/02 21:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)

DRV:64bit: - [2009/05/26 08:32:38 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand] -- D:\Windows\system32\drivers\AmUStor.SYS -- (AmUStor)

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

 

IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = Lavasoft

IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN

IE - HKU\Viktor_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKU\Viktor_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.update: ""

FF - prefs.js..backup.old.browser.search.defaultenginename: ""

FF - prefs.js..backup.old.browser.search.selectedEngine: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..browser.search.defaultthis.engineName: ""

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.selectedEngine: ""

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.search.useDBForOrder: ""

FF - prefs.js..browser.startup.homepage: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..extensions.enabledItems: ""

FF - prefs.js..network.proxy.type: ""

 

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()

FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011/01/13 11:54:38 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/01/13 11:54:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011/01/13 11:54:47 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/01/19 05:08:37 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/01/19 05:08:34 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\Viktor\AppData\Roaming\14001.018 [2012/08/27 05:02:26 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/01/19 05:08:37 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/01/19 05:08:34 | 000,000,000 | ---D | M]

 

[2012/10/02 18:26:31 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Viktor\AppData\Roaming\Mozilla\Extensions

[2012/11/22 12:16:48 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\pjq5x742.default\extensions

[2012/10/24 21:08:51 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Viktor\AppData\Roaming\Mozilla\Firefox\Profiles\yjqczl3w.Standard-Benutzer\extensions

File not found (No name found) -- 

File not found (No name found) -- D:\PROGRAM FILES (X86)\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

File not found (No name found) -- D:\PROGRAM FILES (X86)\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\14001.003

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{87934C42-161D-45BC-8CEF-EF18ABE2A30C}

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\{EBD898F8-FCF6-4694-BC3B-EABC7271EEB1}

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\BBRS_002@BLABBERS.COM

File not found (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\FFXTLBR@FUNMOODS.COM

() (No name found) -- D:\USERS\VIKTOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PJQ5X742.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI

[2013/01/19 05:08:37 | 000,262,552 | ---- | M] (Mozilla Foundation) -- D:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012/03/19 19:07:54 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- D:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

 

O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts

O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg64.dll (Google Inc.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (@C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - D:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)

O3:64bit: - HKU\Viktor_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

O4 - HKLM..\Run: [AVG_UI] D:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [LManager] D:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)

O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin]  File not found

O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin]  File not found

O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O13:64bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)

O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - D:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (systempropertiesperformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKU\Viktor_ON_D Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKU\Viktor_ON_D Winlogon: Shell - (C:\Users\Viktor\AppData\Roaming\skype.dat) - D:\Users\Viktor\AppData\Roaming\skype.dat ()

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013/01/21 09:16:51 | 000,000,000 | ---D | C] -- D:\Users\Viktor\AppData\Local\Programs

[2013/01/19 05:08:34 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Mozilla Firefox

[2013/01/17 16:05:49 | 000,000,000 | -HSD | C] -- D:\Config.Msi

[2013/01/11 16:31:23 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2013/01/10 09:13:45 | 000,751,104 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\win32spl.dll

[2013/01/10 09:13:45 | 000,492,032 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\win32spl.dll

[2013/01/10 09:13:33 | 000,307,200 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ncrypt.dll

[2013/01/10 09:13:33 | 000,219,136 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ncrypt.dll

[2013/01/10 09:13:26 | 000,801,280 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\usp10.dll

[2013/01/10 09:13:23 | 002,745,856 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\gameux.dll

[2013/01/10 09:13:23 | 000,441,856 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\Wpc.dll

[2013/01/10 09:13:23 | 000,046,592 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\fpb.rs

[2013/01/10 09:13:23 | 000,046,592 | ---- | C] (Microsoft) -- D:\Windows\System32\fpb.rs

[2013/01/10 09:13:23 | 000,045,568 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\oflc-nz.rs

[2013/01/10 09:13:23 | 000,045,568 | ---- | C] (Microsoft) -- D:\Windows\System32\oflc-nz.rs

[2013/01/10 09:13:23 | 000,044,544 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\pegibbfc.rs

[2013/01/10 09:13:23 | 000,044,544 | ---- | C] (Microsoft) -- D:\Windows\System32\pegibbfc.rs

[2013/01/10 09:13:23 | 000,043,520 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\csrr.rs

[2013/01/10 09:13:23 | 000,043,520 | ---- | C] (Microsoft) -- D:\Windows\System32\csrr.rs

[2013/01/10 09:13:23 | 000,040,960 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\cob-au.rs

[2013/01/10 09:13:23 | 000,040,960 | ---- | C] (Microsoft) -- D:\Windows\System32\cob-au.rs

[2013/01/10 09:13:23 | 000,030,720 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\usk.rs

[2013/01/10 09:13:23 | 000,030,720 | ---- | C] (Microsoft) -- D:\Windows\System32\usk.rs

[2013/01/10 09:13:23 | 000,021,504 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\grb.rs

[2013/01/10 09:13:23 | 000,021,504 | ---- | C] (Microsoft) -- D:\Windows\System32\grb.rs

[2013/01/10 09:13:23 | 000,020,480 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\pegi-pt.rs

[2013/01/10 09:13:23 | 000,020,480 | ---- | C] (Microsoft) -- D:\Windows\System32\pegi-pt.rs

[2013/01/10 09:13:23 | 000,020,480 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\pegi.rs

[2013/01/10 09:13:23 | 000,020,480 | ---- | C] (Microsoft) -- D:\Windows\System32\pegi.rs

[2013/01/10 09:13:23 | 000,015,360 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\djctq.rs

[2013/01/10 09:13:23 | 000,015,360 | ---- | C] (Microsoft) -- D:\Windows\System32\djctq.rs

[2013/01/10 09:13:22 | 002,576,384 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\gameux.dll

[2013/01/10 09:13:22 | 000,308,736 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\Wpc.dll

[2013/01/10 09:13:22 | 000,055,296 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\cero.rs

[2013/01/10 09:13:22 | 000,055,296 | ---- | C] (Microsoft) -- D:\Windows\System32\cero.rs

[2013/01/10 09:13:22 | 000,051,712 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\esrb.rs

[2013/01/10 09:13:22 | 000,051,712 | ---- | C] (Microsoft) -- D:\Windows\System32\esrb.rs

[2013/01/10 09:13:22 | 000,023,552 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\oflc.rs

[2013/01/10 09:13:22 | 000,023,552 | ---- | C] (Microsoft) -- D:\Windows\System32\oflc.rs

[2013/01/10 09:13:22 | 000,020,480 | ---- | C] (Microsoft) -- D:\Windows\SysWow64\pegi-fi.rs

[2013/01/10 09:13:22 | 000,020,480 | ---- | C] (Microsoft) -- D:\Windows\System32\pegi-fi.rs

[2013/01/10 09:13:07 | 000,424,960 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\KernelBase.dll

[2013/01/10 09:13:06 | 001,161,216 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\kernel32.dll

[2013/01/10 09:13:05 | 000,362,496 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64win.dll

[2013/01/10 09:13:05 | 000,338,432 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\conhost.exe

[2013/01/10 09:13:05 | 000,243,200 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64.dll

[2013/01/10 09:13:05 | 000,215,040 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\winsrv.dll

[2013/01/10 09:13:05 | 000,025,600 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\setup16.exe

[2013/01/10 09:13:05 | 000,016,384 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ntvdm64.dll

[2013/01/10 09:13:05 | 000,014,336 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ntvdm64.dll

[2013/01/10 09:13:05 | 000,013,312 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\wow64cpu.dll

[2013/01/10 09:13:05 | 000,007,680 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\instnm.exe

[2013/01/10 09:13:05 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

[2013/01/10 09:13:05 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

[2013/01/10 09:13:05 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

[2013/01/10 09:13:05 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

[2013/01/10 09:13:05 | 000,005,120 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\wow32.dll

[2013/01/10 09:13:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

[2013/01/10 09:13:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

[2013/01/10 09:13:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- D:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

[2013/01/10 09:13:05 | 000,002,048 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\user.exe

[3 D:\Users\Viktor\AppData\Roaming\*.tmp files -> D:\Users\Viktor\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013/02/03 09:58:22 | 000,000,004 | ---- | M] () -- D:\Users\Viktor\AppData\Roaming\skype.ini

[2013/02/03 09:58:21 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat

[2013/02/03 09:58:04 | 000,001,106 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013/02/03 09:56:19 | 2960,510,976 | -HS- | M] () -- D:\hiberfil.sys

[2013/02/02 20:55:00 | 000,001,110 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013/02/02 20:43:00 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job

[2013/02/02 16:17:27 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013/02/02 16:17:27 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013/01/21 09:17:12 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013/01/17 16:06:02 | 000,002,441 | ---- | M] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk

[2013/01/16 12:30:32 | 000,002,283 | ---- | M] () -- D:\Users\Viktor\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2013/01/15 15:58:10 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

[2013/01/11 16:31:23 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

[2013/01/11 16:23:58 | 000,435,296 | ---- | M] () -- D:\Windows\System32\FNTCACHE.DAT

[2013/01/10 18:20:03 | 000,654,400 | ---- | M] () -- D:\Windows\System32\perfh007.dat

[2013/01/10 18:20:03 | 000,616,242 | ---- | M] () -- D:\Windows\System32\perfh009.dat

[2013/01/10 18:20:03 | 000,130,240 | ---- | M] () -- D:\Windows\System32\perfc007.dat

[2013/01/10 18:20:03 | 000,106,622 | ---- | M] () -- D:\Windows\System32\perfc009.dat

[2013/01/08 15:43:57 | 000,697,864 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerApp.exe

[2013/01/08 15:43:57 | 000,074,248 | ---- | M] (Adobe Systems Incorporated) -- D:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[3 D:\Users\Viktor\AppData\Roaming\*.tmp files -> D:\Users\Viktor\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013/02/02 21:24:08 | 000,000,004 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\skype.ini

[2012/08/28 17:19:34 | 000,065,536 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\pjq5x742.default.dat

[2012/07/23 07:50:30 | 000,000,025 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\urhtps.dat

[2012/01/11 06:45:08 | 000,073,216 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\skype.dat

[2011/06/14 04:36:39 | 000,000,064 | ---- | C] () -- D:\Windows\SysWow64\rp_stats.dat

[2011/06/14 04:36:39 | 000,000,044 | ---- | C] () -- D:\Windows\SysWow64\rp_rules.dat

[2011/04/13 14:59:14 | 000,059,904 | ---- | C] () -- D:\Windows\SysWow64\OVDecode.dll

[2011/02/15 11:52:16 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat

[2011/01/13 11:41:19 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin

[2011/01/13 11:37:22 | 000,002,093 | ---- | C] () -- D:\Windows\SysWow64\atipblup.dat

[2010/09/08 03:17:26 | 000,870,560 | ---- | C] () -- D:\Windows\SysWow64\igkrng575.bin

[2010/09/08 03:17:26 | 000,208,896 | ---- | C] () -- D:\Windows\SysWow64\iglhsip32.dll

[2010/09/08 03:17:26 | 000,143,360 | ---- | C] () -- D:\Windows\SysWow64\iglhcp32.dll

[2010/09/08 03:17:26 | 000,104,636 | ---- | C] () -- D:\Windows\SysWow64\igfcg575m.bin

[2010/09/08 03:17:25 | 000,127,868 | ---- | C] () -- D:\Windows\SysWow64\igcompkrng575.bin

[2010/09/08 03:17:24 | 000,002,093 | ---- | C] () -- D:\Windows\SysWow64\atipblag.dat

[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat

[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT

[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat

[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin

[2009/07/13 19:02:54 | 000,245,248 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll

[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll

[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll

[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll

[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat

 
 ========== LOP Check ==========

 

[2010/09/08 02:52:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Acer

[2010/09/08 02:34:08 | 000,000,000 | ---D | M] -- D:\ProgramData\AmUStor

[2011/02/12 17:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten

[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data

[2011/02/14 17:56:11 | 000,000,000 | ---D | M] -- D:\ProgramData\ashampoo

[2012/10/03 01:53:13 | 000,000,000 | ---D | M] -- D:\ProgramData\AVAST Software

[2012/10/02 19:07:38 | 000,000,000 | ---D | M] -- D:\ProgramData\AVG2013

[2010/09/08 03:04:17 | 000,000,000 | ---D | M] -- D:\ProgramData\BackupManager

[2012/06/20 07:45:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Battle.net

[2012/05/31 10:28:27 | 000,000,000 | -H-D | M] -- D:\ProgramData\CanonBJ

[2012/10/02 18:27:05 | 000,000,000 | -H-D | M] -- D:\ProgramData\Common Files

[2011/02/14 18:10:19 | 000,000,000 | ---D | M] -- D:\ProgramData\createpart

[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop

[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents

[2011/02/12 17:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente

[2011/01/13 11:42:32 | 000,000,000 | ---D | M] -- D:\ProgramData\EgisTec IPS

[2010/09/08 02:39:41 | 000,000,000 | ---D | M] -- D:\ProgramData\eSobi

[2011/02/14 18:09:58 | 000,000,000 | ---D | M] -- D:\ProgramData\explauncher

[2011/02/12 17:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten

[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites

[2012/06/07 16:05:13 | 000,000,000 | ---D | M] -- D:\ProgramData\Friends Games

[2012/07/24 13:18:25 | 000,000,000 | ---D | M] -- D:\ProgramData\GFI Software

[2012/11/22 12:16:45 | 000,000,000 | ---D | M] -- D:\ProgramData\ICQ

[2011/02/14 18:09:55 | 000,000,000 | ---D | M] -- D:\ProgramData\launcher

[2013/02/02 19:34:43 | 000,000,000 | ---D | M] -- D:\ProgramData\MFAData

[2010/09/08 02:48:10 | 000,000,000 | ---D | M] -- D:\ProgramData\OberonGameConsole

[2011/02/12 10:26:58 | 000,000,000 | ---D | M] -- D:\ProgramData\oem

[2012/06/08 03:13:07 | 000,000,000 | ---D | M] -- D:\ProgramData\Sandlot Games

[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu

[2011/02/12 17:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü

[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates

[2012/06/20 09:20:35 | 000,000,000 | ---D | M] -- D:\ProgramData\TuneUp Software

[2011/02/12 17:24:14 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen

[2011/02/14 17:40:07 | 000,000,000 | -HSD | M] -- D:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}

[2012/11/08 08:48:39 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

< End of report >

--- --- ---

schrauber

05.02.2013 18:27

ich würd mal die seiten mit den erwachsenen-filmen weglassen, und nit alles laden und anklicken was blinkt und hallo schreit, dann könnt die kiste vielleicht sogar das wochenende überleben ;)

Code:

:OTL

O20 - HKU\Viktor_ON_D Winlogon: Shell - (C:\Users\Viktor\AppData\Roaming\skype.dat) - D:\Users\Viktor\AppData\Roaming\skype.dat ()

[2013/02/03 09:58:22 | 000,000,004 | ---- | M] () -- D:\Users\Viktor\AppData\Roaming\skype.ini

[2013/02/03 09:58:21 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat

[2013/02/02 21:24:08 | 000,000,004 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\skype.ini

[2012/08/28 17:19:34 | 000,065,536 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\pjq5x742.default.dat

[2012/07/23 07:50:30 | 000,000,025 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\urhtps.dat

[2012/01/11 06:45:08 | 000,073,216 | ---- | C] () -- D:\Users\Viktor\AppData\Roaming\skype.dat

Diesen Fix ausführen mit OTLPE und das normale booten versuchen :)

JimmyRainer

05.02.2013 18:34

obs glaubst oder nicht genau das habe ich ihm auch gesagt :-D
jo mache

startet wieder was sol ich nun machen??

hoi der rechner startet wieder was soll ich nun machen???

Alle Zeitangaben in WEZ +1. Es ist jetzt 00:14 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131