Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Google problem wegen tracking999.com (https://www.trojaner-board.de/127303-google-problem-wegen-tracking999-com.html)

Diabolo 20.11.2012 20:39
Google problem wegen tracking999.com
 
Guten Abend

ich habe seit gestern ein Google Problem, sprich wenn ich dort was eingebe dann auf suche klicke ist noch alles in Ordnung. sobald ich aber dann auf den link klicke kommt eine weiße seite mit tracking999.com.........

hatte hier auch schon eingie beiträge dazu gefunden, nur irgendwie konnte ich nicht drauf antworten..

habe mir dann diese Programme geladen die in einen anderen post angeboten worden sind

adwcleaner scan ergebnis

Code:
# AdwCleaner v2.008 - Datei am 20/11/2012 um 20:18:05 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : Speedy - SPEEDY-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Speedy\Downloads\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\Program Files\Conduit
Ordner Gefunden : C:\ProgramData\Babylon
Ordner Gefunden : C:\Users\Speedy\AppData\Local\Conduit
Ordner Gefunden : C:\Users\Speedy\AppData\LocalLow\Conduit

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gefunden : HKCU\Software\DataMngr
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2736476
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gefunden : HKLM\Software\Conduit
Schlüssel Gefunden : HKLM\Software\DataMngr
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011441179}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2736476

-\\ Mozilla Firefox v17.0 (de)

Profilname : default
Datei : C:\Users\Speedy\AppData\Roaming\Mozilla\Firefox\Profiles\y62tegp8.default\prefs.js

Gefunden : user_pref("browser.search.defaultthis.engineName", "Freeware.de Customized Web Search");
Gefunden : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2736476&Sea[...]
Gefunden : user_pref("browser.search.selectedEngine", "Freeware.de Customized Web Search");
Gefunden : user_pref("extensions.BabylonToolbar.admin", false);
Gefunden : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gefunden : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Gefunden : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gefunden : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gefunden : user_pref("extensions.BabylonToolbar.id", "3c9527a300000000000000262d2f260d");
Gefunden : user_pref("extensions.BabylonToolbar.instlDay", "15626");
Gefunden : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gefunden : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gefunden : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrId", "tb9");
Gefunden : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]
Gefunden : user_pref("extensions.BabylonToolbar.vrsn", "1.8.0.7");
Gefunden : user_pref("extensions.BabylonToolbar.vrsni", "1.8.0.7");
Gefunden : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gefunden : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.0.717:58:05");
Gefunden : user_pref("extensions.bloson.affiliateLists_data", "aoamedia.com,winavi.com,vso-software.fr,sothink.[...]

*************************

AdwCleaner[R1].txt - [4975 octets] - [20/11/2012 20:18:05]

########## EOF - C:\AdwCleaner[R1].txt - [5035 octets] ##########
OTL

Hoffe man kann mir helfen das mist dingen zu vernichten..


Grüße

M-K-D-B 21.11.2012 16:35
:hallo:


Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
    Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
  • Bei Anzeichen von illegaler Software wird der Support ohne Diskussion eingestellt.
  • Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
  • Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
  • Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
    Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
    Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.






Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).






Schritt 1
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden).
  • Starte bitte die OTL.exe.
  • Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Standard Ausgabe.
  • Setze einen Haken bei Scanne alle Benutzer.
  • Unter Extra Registry, wähle bitte Use SafeList.
  • Kopiere nun den Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.
Code:
activex
netsvcs
msconfig
CREATERESTOREPOINT
  • Schließe bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Scan Button.
  • Am Ende des Suchlaufs werden 2 Logdateien erstellt.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread





Schritt 2
Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
  • Starte das Tool mit Doppelklick.
  • Klicke nun auf den Disable Button, um die Treiber gewisser Emulatoren zu deaktivieren.
  • Defogger wird dich fragen "Defogger will forcefully terminate and disable all CD Emulator related drivers and processes... Continue?" bestätige diese Sicherheitsabfrage mit Ja.
  • Wenn der Scan beendet wurde (Finished), klicke auf OK.
  • Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
  • Defogger erstellt auf dem Desktop eine Logdatei mit dem Namen defogger_disable.txt. Poste deren Inhalt mit deiner nächsten Antwort.
Klicke den Re-enable Button nicht ohne Anweisung!





Schritt 3
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Vista und Win7 User mit Rechtsklick "als Admininstartor starten"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. ( Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.





Schritt 4
Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen.

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und speichere das Logfile.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern ( Meistens C:\ )
    Als Beispiel: C:\TDSSKiller.<version_date_time>log.txt
Poste den Inhalt bitte hier in deinen Thread.





Bitte poste mit deiner nächsten Antwort
  • die Logdatei von AdwCleaner,
  • die beiden Logdateien von OTL,
  • die Logdatei von DeFogger,
  • die Logdatei von aswMBR,
  • die Logdatei von TDSSKiller.

Diabolo 21.11.2012 19:24
Code:
# AdwCleaner v2.008 - Datei am 21/11/2012 um 18:45:31 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : Speedy - SPEEDY-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Speedy\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\Speedy\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Speedy\AppData\LocalLow\Conduit

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2736476
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441179}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21111111-1111-1111-1111-110011441179}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441179}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&ctid=CT2736476 --> hxxp://www.google.com

-\\ Mozilla Firefox v17.0 (de)

Profilname : default
Datei : C:\Users\Speedy\AppData\Roaming\Mozilla\Firefox\Profiles\y62tegp8.default\prefs.js

C:\Users\Speedy\AppData\Roaming\Mozilla\Firefox\Profiles\y62tegp8.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.search.defaultthis.engineName", "Freeware.de Customized Web Search");
Gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2736476&Sea[...]
Gelöscht : user_pref("browser.search.selectedEngine", "Freeware.de Customized Web Search");
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.id", "3c9527a300000000000000262d2f260d");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15626");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "tb9");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=[...]
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.8.0.7");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.8.0.7");
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.0.717:58:05");
Gelöscht : user_pref("extensions.bloson.affiliateLists_data", "aoamedia.com,winavi.com,vso-software.fr,sothink.[...]

*************************

AdwCleaner[R1].txt - [5104 octets] - [20/11/2012 20:18:05]
AdwCleaner[R2].txt - [5164 octets] - [20/11/2012 20:44:41]
AdwCleaner[S1].txt - [5231 octets] - [21/11/2012 18:45:31]

########## EOF - C:\AdwCleaner[S1].txt - [5291 octets] ##########
Code:
OTL logfile created on: 21.11.2012 18:51:25 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Speedy\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 69,06% Memory free
6,00 Gb Paging File | 5,02 Gb Available in Paging File | 83,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,58 Gb Total Space | 60,78 Gb Free Space | 62,28% Space Free | Partition Type: NTFS
Drive G: | 833,83 Gb Total Space | 171,65 Gb Free Space | 20,59% Space Free | Partition Type: NTFS
 
Computer Name: SPEEDY-PC | User Name: Speedy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.21 18:48:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Speedy\Desktop\OTL.exe
PRC - [2012.11.06 19:00:32 | 003,143,800 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgui.exe
PRC - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgidsagent.exe
PRC - [2012.10.30 04:59:56 | 000,726,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgrsx.exe
PRC - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgwdsvc.exe
PRC - [2012.10.22 13:04:32 | 001,116,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgnsx.exe
PRC - [2012.10.22 13:03:52 | 000,796,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgemcx.exe
PRC - [2012.10.22 13:03:46 | 000,440,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgcsrvx.exe
PRC - [2012.10.02 23:20:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.10.02 20:29:14 | 000,864,616 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012.10.02 20:28:55 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.08.31 15:02:02 | 002,754,984 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.08.28 14:52:46 | 002,608,992 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Lite\DTShellHlp.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.03.08 17:50:28 | 004,280,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe
PRC - [2012.01.18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 13:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.07.14 02:14:46 | 000,115,200 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE
PRC - [2009.04.30 10:23:26 | 000,090,112 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.17 20:55:35 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.11.20 19:18:58 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.12 12:02:58 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2012.10.19 16:56:30 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.02 23:20:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.08.31 15:02:02 | 002,754,984 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.03.10 18:07:26 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012.03.07 11:09:32 | 004,033,024 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2012.01.18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.04.30 10:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Speedy\AppData\Local\Temp\ALSysIO.sys -- (ALSysIO)
DRV - [2012.10.29 17:42:23 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012.10.22 13:02:46 | 000,179,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2012.10.15 03:48:52 | 000,055,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012.10.05 03:32:50 | 000,093,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2012.10.02 23:20:00 | 010,837,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.10.02 03:30:38 | 000,159,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012.09.21 03:46:06 | 000,164,832 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012.09.21 03:46:00 | 000,177,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avglogx.sys -- (Avglogx)
DRV - [2012.09.21 03:45:54 | 000,019,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2012.09.14 03:05:20 | 000,035,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2012.08.23 15:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2012.08.23 15:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2012.07.03 16:25:17 | 000,149,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2012.04.01 18:42:23 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2012.04.01 18:42:23 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggflt.sys -- (ggflt)
DRV - [2012.01.18 06:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)
DRV - [2012.01.18 06:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2011.07.15 19:13:12 | 000,135,680 | ---- | M] (Oracle Corporation) [Kernel | Auto | Running] -- C:\Programme\YouWave_Android\vb\VBoxDrv.sys -- (VBoxDrv)
DRV - [2011.06.02 06:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011.06.02 06:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus)
DRV - [2011.06.02 06:47:22 | 000,114,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadserd.sys -- (ssadserd)
DRV - [2011.06.02 06:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV - [2010.12.21 06:55:02 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadadb.sys -- (androidusb)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.08.12 12:07:48 | 000,298,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009.07.14 01:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.13 23:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009.03.25 16:48:00 | 000,114,728 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdm.sys -- (s1018mdm)
DRV - [2009.03.25 16:48:00 | 000,109,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018unic.sys -- (s1018unic)
DRV - [2009.03.25 16:48:00 | 000,106,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mgmt.sys -- (s1018mgmt)
DRV - [2009.03.25 16:48:00 | 000,104,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018obex.sys -- (s1018obex)
DRV - [2009.03.25 16:48:00 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018bus.sys -- (s1018bus)
DRV - [2009.03.25 16:48:00 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018nd5.sys -- (s1018nd5)
DRV - [2009.03.25 16:48:00 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdfl.sys -- (s1018mdfl)
DRV - [2009.03.18 15:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008.12.11 06:56:14 | 000,013,056 | ---- | M] (ROCCAT Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Kone.sys -- (KoneFltr)
DRV - [2007.06.29 13:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 CD 5A 32 B0 36 CD 01  [binary data]
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - No CLSID value found
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\..\SearchScopes\{501742C8-F9AD-4454-9D83-7C8421F36C11}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-3171171593-1227741318-2359526494-1003\..\SearchScopes,DefaultScope =
 
========== FireFox ==========
 
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.google.de/"
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: thumbnailZoom%40dadler.github.com:2.3
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.11
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Speedy\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.20 19:18:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.20 19:18:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.20 19:18:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.20 19:18:54 | 000,000,000 | ---D | M]
 
[2012.03.09 21:25:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\Extensions
[2012.11.20 19:58:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\Firefox\Profiles\y62tegp8.default\extensions
[2012.11.01 17:47:53 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Speedy\AppData\Roaming\mozilla\Firefox\Profiles\y62tegp8.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.09.16 10:05:03 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Speedy\AppData\Roaming\mozilla\Firefox\Profiles\y62tegp8.default\extensions\ich@maltegoetz.de
[2012.09.12 17:52:47 | 000,136,064 | ---- | M] () (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\firefox\profiles\y62tegp8.default\extensions\thumbnailZoom@dadler.github.com.xpi
[2012.11.20 12:16:22 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\firefox\profiles\y62tegp8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.11.20 19:18:53 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.20 19:18:58 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.10.24 23:03:12 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.24 23:03:11 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.10.24 23:03:12 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.10.24 23:03:12 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.10.24 23:03:12 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.10.24 23:03:11 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001\..\Toolbar\WebBrowser: (no name) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - No CLSID value found.
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKU\S-1-5-21-3171171593-1227741318-2359526494-1001..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3171171593-1227741318-2359526494-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26B6D775-CE96-4455-A637-EDB8C0760B43}: NameServer = 192.168.178.1
O18 - Protocol\Handler\linkscanner - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\browse~1\23765~1.24\{16cdf~1\browse~1.dll) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a2eb0f05-95c8-11e1-84cb-00262d2f260d}\Shell - "" = AutoRun
O33 - MountPoints2\{a2eb0f05-95c8-11e1-84cb-00262d2f260d}\Shell\AutoRun\command - "" = I:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^Users^Speedy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - C:\Programme\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
MsConfig - StartUpReg: EPSON Stylus Photo R240 Series - hkey= - key= -  File not found
MsConfig - StartUpReg: EPSON Stylus Photo R240 Series (Kopie 1) - hkey= - key= -  File not found
MsConfig - StartUpReg: Facebook Update - hkey= - key= - C:\Users\Speedy\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
MsConfig - StartUpReg: KiesAirMessage - hkey= - key= -  File not found
MsConfig - StartUpReg: KiesHelper - hkey= - key= - C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung)
MsConfig - StartUpReg: KiesPDLR - hkey= - key= - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
MsConfig - StartUpReg: KiesTrayAgent - hkey= - key= - C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
MsConfig - StartUpReg: LogMeIn Hamachi Ui - hkey= - key= -  File not found
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig - StartUpReg: Skype - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig - StartUpReg: Sony Ericsson PC Companion - hkey= - key= - C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson Mobile Communications AB)
MsConfig - State: "startup" - 2
MsConfig - State: "bootini" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.21 18:48:36 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Speedy\Desktop\OTL.exe
[2012.11.21 11:50:42 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\{0C6AB336-B336-4C8D-84CC-1154B694F224}
[2012.11.20 19:32:35 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Alt.Binz
[2012.11.20 19:18:53 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.11.20 15:25:02 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012.11.20 15:22:06 | 000,000,000 | ---D | C] -- C:\Program Files\Bloson
[2012.11.20 15:22:06 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\Apple Computer
[2012.11.20 15:22:02 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\MozillaFirefoxPackages
[2012.11.20 14:57:04 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2012.11.20 14:35:11 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.11.20 10:47:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.18 13:57:09 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\BioWare
[2012.11.15 23:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam
[2012.11.15 22:12:50 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\rdpvideominiport.sys
[2012.11.15 22:12:50 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
[2012.11.15 22:12:49 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\TsUsbFlt.sys
[2012.11.15 22:12:49 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
[2012.11.15 22:12:49 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RdpGroupPolicyExtension.dll
[2012.11.15 22:12:48 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2012.11.15 22:12:48 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TSWbPrxy.exe
[2012.11.15 22:12:48 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsRdpWebAccess.dll
[2012.11.15 22:12:48 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2012.11.15 22:12:48 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbGDCoInstaller.dll
[2012.11.15 22:12:48 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprtPS.dll
[2012.11.15 22:12:47 | 002,739,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorets.dll
[2012.11.15 22:12:47 | 000,317,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprt.exe
[2012.11.15 22:12:47 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpudd.dll
[2012.11.15 22:12:47 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpendp_winip.dll
[2012.11.15 22:06:26 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2012.11.15 22:06:26 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2012.11.15 22:05:54 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2012.11.15 22:05:53 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2012.11.15 22:05:52 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2012.11.15 22:05:24 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.11.15 22:05:24 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.11.15 22:05:23 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.11.15 22:05:23 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.11.15 22:05:23 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.11.15 22:05:22 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.11.15 22:05:22 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.11.15 22:05:21 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.11.15 22:03:47 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.11.15 21:58:16 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.11.15 21:58:15 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2012.11.15 21:58:13 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netcorehc.dll
[2012.11.15 21:58:13 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncsi.dll
[2012.11.15 21:58:13 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2012.11.15 21:58:08 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcore6.dll
[2012.11.15 21:58:08 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll
[2012.11.14 21:42:37 | 000,267,112 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\System32\hpinksts5412LM.dll
[2012.11.14 21:42:37 | 000,213,864 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\System32\hpinkcoi5412.dll
[2012.11.14 19:02:27 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\FLT
[2012.11.14 16:01:57 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Programs
[2012.11.13 02:33:38 | 010,837,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys
[2012.11.13 02:33:38 | 007,697,768 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll
[2012.11.13 02:33:38 | 002,574,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll
[2012.11.13 02:33:38 | 001,867,112 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll
[2012.11.13 02:33:38 | 000,888,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispgenco32.dll
[2012.11.13 02:33:38 | 000,149,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvhda32v.sys
[2012.11.13 02:33:38 | 000,028,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvhdap32.dll
[2012.11.13 02:33:37 | 019,906,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll
[2012.11.13 02:33:37 | 017,559,912 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll
[2012.11.13 02:33:37 | 015,309,160 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll
[2012.11.13 02:33:37 | 006,127,464 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvopencl.dll
[2012.11.13 00:10:32 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\AVG2013
[2012.11.13 00:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013
[2012.11.13 00:00:59 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\MFAData
[2012.11.13 00:00:59 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Avg2013
[2012.11.11 22:52:43 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\Doomsday
[2012.11.10 22:09:33 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\FUSSBALL MANAGER 13
[2012.11.10 22:06:06 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\FIFA MANAGER 13
[2012.11.07 19:39:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Agent Hugo - Hula Holiday
[2012.11.07 19:39:26 | 000,000,000 | ---D | C] -- C:\Program Files\Agent Hugo - Hula Holiday
[2012.11.07 11:44:42 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012.11.07 11:44:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.11.07 11:44:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.11.05 23:23:21 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Freelancer
[2012.11.04 21:16:42 | 000,125,440 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\System32\hpf3l02t.dll
[2012.11.04 21:15:07 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\HP
[2012.11.02 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\Rovio
[2012.11.02 21:33:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rovio
[2012.10.31 00:35:19 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\MOHW_DayOnePatch_PC
[2012.10.29 17:42:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2012.10.29 17:42:23 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.10.29 17:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite
[2012.10.28 20:13:09 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Desktop\BVB
[2012.10.24 15:10:45 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\Lucius
[2012.05.27 17:49:17 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe79B7.dll
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.21 18:51:55 | 000,016,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.21 18:51:55 | 000,016,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.21 18:51:25 | 000,707,088 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.21 18:51:25 | 000,660,706 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.21 18:51:25 | 000,152,680 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.21 18:51:25 | 000,124,896 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.21 18:48:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Speedy\Desktop\OTL.exe
[2012.11.21 18:46:54 | 000,000,278 | ---- | M] () -- C:\Windows\tasks\CheckDriveBackgroundGuard.job
[2012.11.21 18:46:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.21 18:46:44 | 2415,316,992 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.21 18:46:42 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2012.11.21 18:44:54 | 000,543,531 | ---- | M] () -- C:\Users\Speedy\Desktop\adwcleaner.exe
[2012.11.21 18:11:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.21 17:48:01 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3171171593-1227741318-2359526494-1001UA.job
[2012.11.20 15:25:03 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.11.20 15:16:50 | 003,712,296 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.20 14:35:12 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.11.14 21:26:25 | 000,024,822 | ---- | M] () -- C:\Users\Speedy\Desktop\refarat.odt
[2012.11.14 16:06:20 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\System32\OpenAL32.dll
[2012.11.14 16:05:00 | 000,000,636 | ---- | M] () -- C:\Users\Public\Desktop\F1 Race Stars.lnk
[2012.11.13 00:22:13 | 000,013,718 | ---- | M] () -- C:\Users\Speedy\Desktop\320100_225139290875085_734531555_n.jpg
[2012.11.13 00:08:27 | 000,000,951 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012.11.12 12:02:58 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.11.12 12:02:58 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.11.11 22:52:43 | 000,000,081 | ---- | M] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.11.10 14:24:58 | 000,003,592 | ---- | M] () -- C:\Users\Speedy\AppData\Local\HH.SAV
[2012.11.07 19:39:37 | 000,002,715 | ---- | M] () -- C:\Users\Public\Desktop\Agent Hugo Hula Holiday.lnk
[2012.11.07 11:44:42 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.11.05 20:12:33 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.11.05 20:12:33 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012.11.03 09:36:15 | 000,000,697 | ---- | M] () -- C:\Users\Speedy\Documents\Bus für Essen Syburg.rtf
[2012.11.02 21:33:13 | 000,000,712 | ---- | M] () -- C:\Users\Public\Desktop\Angry Birds Space.lnk
[2012.11.02 08:48:01 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3171171593-1227741318-2359526494-1001Core.job
[2012.10.31 00:41:31 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.10.31 00:41:25 | 000,280,600 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2012.10.31 00:35:27 | 000,280,600 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2012.10.29 17:42:51 | 000,001,900 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.10.29 17:42:23 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.10.29 16:00:43 | 000,001,761 | ---- | M] () -- C:\Users\Speedy\Documents\Road stop.rtf
[2012.10.29 14:09:29 | 000,000,430 | ---- | M] () -- C:\Users\Speedy\Documents\runrig.rtf
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.21 18:44:54 | 000,543,531 | ---- | C] () -- C:\Users\Speedy\Desktop\adwcleaner.exe
[2012.11.20 15:25:03 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.11.20 15:16:24 | 003,712,296 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.20 14:35:12 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.11.15 22:06:27 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 22:05:52 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.14 16:05:00 | 000,000,636 | ---- | C] () -- C:\Users\Public\Desktop\F1 Race Stars.lnk
[2012.11.13 00:22:12 | 000,013,718 | ---- | C] () -- C:\Users\Speedy\Desktop\320100_225139290875085_734531555_n.jpg
[2012.11.13 00:08:27 | 000,000,951 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012.11.11 22:52:43 | 000,000,081 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.11.07 19:40:44 | 000,003,592 | ---- | C] () -- C:\Users\Speedy\AppData\Local\HH.SAV
[2012.11.07 19:39:37 | 000,002,715 | ---- | C] () -- C:\Users\Public\Desktop\Agent Hugo Hula Holiday.lnk
[2012.11.07 17:14:13 | 000,024,822 | ---- | C] () -- C:\Users\Speedy\Desktop\refarat.odt
[2012.11.05 20:12:33 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012.11.05 20:12:33 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012.11.02 21:33:13 | 000,000,712 | ---- | C] () -- C:\Users\Public\Desktop\Angry Birds Space.lnk
[2012.10.30 10:43:01 | 000,000,697 | ---- | C] () -- C:\Users\Speedy\Documents\Bus für Essen Syburg.rtf
[2012.10.29 17:42:51 | 000,001,900 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.10.29 16:00:43 | 000,001,761 | ---- | C] () -- C:\Users\Speedy\Documents\Road stop.rtf
[2012.10.29 14:09:29 | 000,000,430 | ---- | C] () -- C:\Users\Speedy\Documents\runrig.rtf
[2012.10.04 13:47:19 | 000,484,352 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2012.09.29 08:38:21 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.06.27 00:08:07 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.06.27 00:08:01 | 000,138,904 | ---- | C] () -- C:\Users\Speedy\AppData\Roaming\PnkBstrK.sys
[2012.06.27 00:07:39 | 000,280,600 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2012.06.27 00:07:38 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2012.06.21 09:37:14 | 003,166,792 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2012.05.23 17:49:34 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.05.23 17:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2012.05.23 17:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2012.05.23 17:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2012.05.23 17:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2012.03.10 17:24:30 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.03.10 17:23:44 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.03.10 09:51:36 | 000,000,094 | ---- | C] () -- C:\Users\Speedy\AppData\Local\fusioncache.dat
[2012.03.09 20:20:53 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.01.18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012.01.18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012.01.18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2012.01.18 06:22:54 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:512E1728

< End of report >
Code:
OTL Extras logfile created on: 21.11.2012 18:51:26 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Speedy\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,07 Gb Available Physical Memory | 69,06% Memory free
6,00 Gb Paging File | 5,02 Gb Available in Paging File | 83,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,58 Gb Total Space | 60,78 Gb Free Space | 62,28% Space Free | Partition Type: NTFS
Drive G: | 833,83 Gb Total Space | 171,65 Gb Free Space | 20,59% Space Free | Partition Type: NTFS
 
Computer Name: SPEEDY-PC | User Name: Speedy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3171171593-1227741318-2359526494-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02308BA4-6036-4E6D-9632-BB3041179CC5}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{056DD9AA-93BA-41DB-9DE5-7F588057B2E9}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{06D270DA-D214-40E1-B987-6E7055CC24F7}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{16B16BF1-7E6B-4AE3-8440-275CA028090F}" = rport=10243 | protocol=6 | dir=out | app=system |
"{1E2D5A9F-8064-4767-92B8-DC0D6777BEA0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2F223B2D-3470-4B7C-BC1E-E9072979EB78}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{316461FB-571D-401C-8F0E-E119F51A2EEC}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{3A237EEB-3C94-4BFA-97E3-6E791AB455BF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3AC83A56-720A-41C7-BD20-5EC9F585C259}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{44C1B728-9712-49DF-9F40-8A430F883B60}" = rport=138 | protocol=17 | dir=out | app=system |
"{4F747A71-270C-453F-A21C-15267242BEDB}" = rport=139 | protocol=6 | dir=out | app=system |
"{50DBE3F8-A74B-4D14-BF9A-16746FF8A552}" = rport=137 | protocol=17 | dir=out | app=system |
"{54DF51BD-4437-440C-AD7A-21CEC181EC42}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5A1FECCE-33A5-4028-B647-FB9FFDE9F26F}" = lport=137 | protocol=17 | dir=in | app=system |
"{8643605D-1814-427D-BD53-58D1749933AC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{886E232B-302A-488D-92FE-0CE145CB4588}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{91385F84-0B61-4810-9B8B-B5306FB0D29B}" = rport=445 | protocol=6 | dir=out | app=system |
"{977BC5F3-697F-4613-A0A8-8A86A8D742FF}" = lport=445 | protocol=6 | dir=in | app=system |
"{9A37ED87-9866-499D-9609-0B43FB6F2AC3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A4E87CE8-B2D7-4F26-A04A-257C6D2BE395}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A795427A-E328-4D42-8D88-6D31099158CB}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{A7DE9151-483A-4E53-B319-43AA5FE0E372}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{AA8C540F-2D4B-4126-B400-633D113DDABF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{B3BE41EE-9305-4F93-B8E2-3214EF731994}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B5F3402F-2BED-4F35-9F2C-0447BC5EE23A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DA732A11-7896-493C-B787-F1FC4599C3C3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E2E17E41-EB5D-4613-9AEC-3A828D8AFE3A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E86A0FB9-66D1-4AFD-85B8-8F2AF5FBB776}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EF8041DD-349E-4879-8816-623165FC4654}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F0C83230-8A7B-464E-9553-3487F52B379F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F1D81B53-5CDE-4DF0-8BC5-122CF6E7AA7E}" = lport=139 | protocol=6 | dir=in | app=system |
"{FD1A3F0C-C865-4210-AE4D-0F73D350F197}" = lport=10243 | protocol=6 | dir=in | app=system |
"{FF4370B6-0D5E-4E97-9FF0-D930E87E1F69}" = lport=138 | protocol=17 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{012822C3-1337-4EB2-A3C8-F0CEE7244220}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{01BD8136-814E-43D3-8E65-4546FACEBB68}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0254D31B-EEF7-4CE1-AC2C-4225C27A8F8F}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{04BFC668-E391-487E-A488-B2BC338712C6}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{05774FB7-7377-4E32-BEDF-1ECA189B682B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{060E97F7-EBFF-44F1-87B0-830B61072564}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{0A344321-A99E-4BA0-A116-7ACC934F825F}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{0F4D5284-4044-4098-BEC1-B20AEA694CE9}" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"{1A42A20C-30E1-449C-8D95-088DBA1B6B24}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{1AC4F700-26D0-4CF1-91E5-58ECD06C1360}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{225F5B24-06FD-4E01-A45E-8B410ECA202C}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{26F55243-4C77-41A8-812F-FDA9182C86F5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{30257B2E-47EB-4C8F-8C03-46B28F047A3E}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{338F3F73-EBB9-4D92-A625-E12069E3D5C3}" = protocol=17 | dir=in | app=g:\diablo\diablo iii\diablo iii.exe |
"{34B1A32B-AF3B-4651-8822-99B522F1D1CC}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgmfapx.exe |
"{3ACCB0FB-144E-421B-A04C-20739EFB76E7}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{3CD89BDC-340E-4971-B6D6-952810EA73B1}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{3E7A17A9-446D-4CB2-B439-255E1C76DEBF}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{4594BC72-C9DF-4AD2-9658-36040742DF08}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{45C92F1D-3AD9-402C-A93C-59F51C04CD46}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4C6C51FB-834F-407B-99F3-795D8797E62D}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{51D0886F-A642-46FA-A44E-A77E7984337C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{520F461C-7DBD-4519-9C75-85A91CA47B6C}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{55AC0B85-549A-43FE-A3B3-823963343D1A}" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"{55D6B8FB-CFAE-4BA1-B439-512F32E37ADB}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{58164D6E-2A5A-4A4F-9480-AA82A32208B9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{598B96EA-120E-4708-8AD7-F2ECD56AD6DB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5DBA8771-62C6-4AB1-87CF-5B74351592BF}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{64B9DBB6-C5DE-409B-9176-9A957D19A748}" = protocol=6 | dir=in | app=c:\program files\avg\avg2013\avgnsx.exe |
"{6541DD19-7755-46E5-ABD2-3AC42EBAAE9C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{683A8BA7-A0DC-405C-9D7A-7286D9B16815}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{76EF8B06-D7FE-4E5D-A05A-ECBBC6FAB96C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{8898F9B0-B33D-4527-806B-A6FB98E90B62}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{8AE16721-1B97-4E73-816C-57B388FD3168}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{8D575FB4-52DD-4F80-B02B-5581B4C65B67}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{8EAF4834-505F-4726-AEA2-0D209EC3B86C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{928B1568-342A-4841-B7BA-A86E9C4147CD}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{97BDEAA3-CF98-4BE1-BEDA-E1042DB9A2F4}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{98F577B0-F378-4260-A0D1-6C41D900495C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{9C1A520A-1D73-46F8-BA98-1BA474695C34}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"{A3123426-9336-4D03-925F-2C5159F23C99}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgdiagex.exe |
"{A3D59C57-6C54-457D-B4A2-FB35BA0CB7C7}" = protocol=58 | dir=in | app=system |
"{AD268826-0549-4CEA-9B62-1CF201B49D1D}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{B10CAE72-8B03-4140-AF34-8E7265F6ECBE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B5A33731-EA75-457B-BBBA-5DDA8904211C}" = dir=out | app=g:\fifa 13\fifa 13\game\fifa13.exe |
"{B72CC29C-FEE7-4389-9E46-0A051BEFDCB9}" = dir=in | app=g:\fifa 13\fifa 13\game\fifa13.exe |
"{C388734D-0A57-47F0-A66A-BBA1BBA673DD}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{C40B6595-0BE7-443B-8FC2-53DA2922FC05}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |
"{C62DC913-C10C-458F-9DAC-4CD68CC2A92C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CC653AE0-A4FF-429D-BA76-BCB956332BEA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D05B8088-6AEF-4EBF-B298-6266DED22D7E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D3CAAFDE-EC5A-44B3-9203-61D75B7B791B}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{DA717BF5-9B4F-4DDF-A39E-8A80FD10ED28}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"{E0B32036-C132-4BF5-B554-BBD3D56BF639}" = dir=in | app=c:\users\speedy\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{E213A5B6-DA1E-4FFB-A90D-E944554721CC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{EEB8097C-3597-47FD-B397-B2A039935E84}" = protocol=17 | dir=in | app=c:\program files\avg\avg2013\avgemcx.exe |
"{F5B1B547-8C7F-47B0-83AF-42C075AA2513}" = protocol=6 | dir=in | app=g:\diablo\diablo iii\diablo iii.exe |
"{F890E6D5-A929-497E-8FF2-4925D7ADA4F7}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{FB14DC9F-965A-4E98-9FF0-E6110F3A95DC}" = protocol=6 | dir=out | app=system |
"TCP Query User{0A8B2324-8E65-40E9-B6B2-27F74D3A076F}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{0D2FBB09-4EA5-4E46-B0E1-4C3426AD6C8D}C:\program files\youwave_android\vb\vboxsdl.exe" = protocol=6 | dir=in | app=c:\program files\youwave_android\vb\vboxsdl.exe |
"TCP Query User{8021DD1D-98DD-49DF-B115-E8C7A2986A1C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{C847D43E-3E39-4845-B3C2-9ACA60AE2388}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{DEAF593D-7E37-4768-87CD-951ED8045857}C:\program files\youwave_android\vb\vboxsdl.exe" = protocol=6 | dir=in | app=c:\program files\youwave_android\vb\vboxsdl.exe |
"UDP Query User{2EEC7905-B974-459C-8EB7-AD00F1520FAB}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{476DE7D1-E919-4490-9E78-97E712BA6494}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{C03899BA-978E-4C05-9F19-3A3067F089C8}C:\program files\youwave_android\vb\vboxsdl.exe" = protocol=17 | dir=in | app=c:\program files\youwave_android\vb\vboxsdl.exe |
"UDP Query User{D54530F5-520B-4810-891C-4B4408C85DAE}C:\program files\youwave_android\vb\vboxsdl.exe" = protocol=17 | dir=in | app=c:\program files\youwave_android\vb\vboxsdl.exe |
"UDP Query User{FBB042B2-6A6B-45A5-820D-E4A25BC16A4A}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1633AF4C-47DC-4922-8539-7CA48592ABBF}" = Bloson
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 9
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F2A323E-60C4-41E8-8CCB-9715D1D750C3}" = Angry Birds Space
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{446472DE-79C0-4708-B06E-0F8FAFDA6918}" = AVG 2013
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{732A67B6-2581-4434-AE64-9A34CCF943D1}" = Jagd Simulator 2011
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE1746-9EFF-3C9C-8755-81EA8903AC34}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A8D93648-9F7F-407D-915C-62044644C3DA}" = MSI to redistribute MS VS2005 CRT libraries
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ADD07D8C-A626-44B6-82B7-B42AAB221C55}" = Agent Hugo - Hula Holiday
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE7CB214-DB11-4B5D-A6AF-3B4ED47C68B7}" = Microsoft Game Studios Common Redistributables Pack 1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.5.1 Game
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DE5EB975-946C-4ADF-ABCC-3609BCEBF978}" = AVG 2013
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 1.60.13
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Alt.Binz" = Alt.Binz 0.39.4
"Ashampoo Burning Studio 2012_is1" = Ashampoo Burning Studio 2012 v.10.0.15
"AVG" = AVG 2013
"CCleaner" = CCleaner
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III" = Diablo III
"DVD Shrink DE_is1" = DVD Shrink 3.2 deutsch (DeCSS-frei)
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"F1 Race Stars_is1" = F1 Race Stars
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 2.2
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.0.4 (Basic)
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mozilla Firefox 17.0 (x86 de)" = Mozilla Firefox 17.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCLauncher_GameForge" = NC Launcher (GameForge)
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"PunkBusterSvc" = PunkBuster Services
"QuickPar" = QuickPar 0.9
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 7" = TeamViewer 7
"VLC media player" = VLC media player 2.0.0
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.11 (32-Bit)
"World of Warcraft" = World of Warcraft
"YouWave" = YouWave for Android
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3171171593-1227741318-2359526494-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox Packages" = Mozilla Firefox Packages
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 16.11.2012 14:03:59 | Computer Name = Speedy-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 16.11.2012 18:09:16 | Computer Name = Speedy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: t6mp.exe, Version: 1.0.0.1, Zeitstempel:
 0x509a7625  Name des fehlerhaften Moduls: t6mp.exe, Version: 1.0.0.1, Zeitstempel:
 0x509a7625  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0063c5d0  ID des fehlerhaften Prozesses:
 0x1640  Startzeit der fehlerhaften Anwendung: 0x01cdc44703a27140  Pfad der fehlerhaften
 Anwendung: G:\Black Ops 2\Call of Duty Black Ops II\t6mp.exe  Pfad des fehlerhaften
 Moduls: G:\Black Ops 2\Call of Duty Black Ops II\t6mp.exe  Berichtskennung: 4292b720-303a-11e2-aa91-00262d2f260d
 
Error - 15.11.2012 18:12:26 | Computer Name = Speedy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: t6sp.exe, Version: 1.0.0.1, Zeitstempel:
 0x509a7621  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0012fd4c  ID des fehlerhaften Prozesses:
 0x1520  Startzeit der fehlerhaften Anwendung: 0x01cdc37e44769490  Pfad der fehlerhaften
 Anwendung: G:\Black Ops 2\Call of Duty Black Ops II\t6sp.exe  Pfad des fehlerhaften
 Moduls: unknown  Berichtskennung: 89b24db0-2f71-11e2-aa92-00262d2f260d
 
Error - 15.11.2012 18:16:57 | Computer Name = Speedy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: t6sp.exe, Version: 1.0.0.1, Zeitstempel:
 0x509a7621  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0012fd4c  ID des fehlerhaften Prozesses:
 0x1500  Startzeit der fehlerhaften Anwendung: 0x01cdc37eec343b10  Pfad der fehlerhaften
 Anwendung: G:\Black Ops 2\Call of Duty Black Ops II\t6sp.exe  Pfad des fehlerhaften
 Moduls: unknown  Berichtskennung: 2aafdd90-2f72-11e2-aa92-00262d2f260d
 
Error - 15.11.2012 18:22:58 | Computer Name = Speedy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: t6sp.exe, Version: 1.0.0.1, Zeitstempel:
 0x509a7621  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel:
 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0012eb30  ID des fehlerhaften Prozesses:
 0xf40  Startzeit der fehlerhaften Anwendung: 0x01cdc37faf65e570  Pfad der fehlerhaften
 Anwendung: G:\Black Ops 2\Call of Duty Black Ops II\t6sp.exe  Pfad des fehlerhaften
 Moduls: unknown  Berichtskennung: 01d810d0-2f73-11e2-aa92-00262d2f260d
 
Error - 17.11.2012 20:01:23 | Computer Name = Speedy-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 18.11.2012 09:12:25 | Computer Name = Speedy-PC | Source = VSS | ID = 8194
Description =
 
Error - 19.11.2012 10:50:11 | Computer Name = Speedy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MassEffect.exe, Version: 1.2.20608.0,
 Zeitstempel: 0x4a55fea1  Name des fehlerhaften Moduls: MassEffect.exe, Version: 1.2.20608.0,
 Zeitstempel: 0x4a55fea1  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000004c9  ID des fehlerhaften
 Prozesses: 0x1570  Startzeit der fehlerhaften Anwendung: 0x01cdc6527e305ca8  Pfad der
 fehlerhaften Anwendung: G:\Mass Effect Deluxe Edition\Binaries\MassEffect.exe  Pfad
 des fehlerhaften Moduls: G:\Mass Effect Deluxe Edition\Binaries\MassEffect.exe  Berichtskennung:
 6ab33ef8-3258-11e2-85c3-00262d2f260d
 
Error - 19.11.2012 10:55:18 | Computer Name = Speedy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MassEffect.exe, Version: 1.2.20608.0,
 Zeitstempel: 0x4a55fea1  Name des fehlerhaften Moduls: MassEffect.exe, Version: 1.2.20608.0,
 Zeitstempel: 0x4a55fea1  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000004c9  ID des fehlerhaften
 Prozesses: 0x1724  Startzeit der fehlerhaften Anwendung: 0x01cdc66546400268  Pfad der
 fehlerhaften Anwendung: G:\Mass Effect Deluxe Edition\Binaries\MassEffect.exe  Pfad
 des fehlerhaften Moduls: G:\Mass Effect Deluxe Edition\Binaries\MassEffect.exe  Berichtskennung:
 21d4a798-3259-11e2-85c3-00262d2f260d
 
Error - 19.11.2012 19:35:48 | Computer Name = Speedy-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: MassEffect.exe, Version: 1.2.20608.0,
 Zeitstempel: 0x4a55fea1  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0xea95d55d  ID des fehlerhaften
 Prozesses: 0x1fb0  Startzeit der fehlerhaften Anwendung: 0x01cdc6aaae300edc  Pfad der
 fehlerhaften Anwendung: G:\Mass Effect Deluxe Edition\Binaries\MassEffect.exe  Pfad
 des fehlerhaften Moduls: unknown  Berichtskennung: d896be9c-32a1-11e2-85c3-00262d2f260d
 
[ System Events ]
Error - 26.06.2012 16:32:36 | Computer Name = Speedy-PC | Source = Microsoft-Windows-Application-Experience | ID = 205
Description = Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht
 initialisieren.
 
Error - 02.07.2012 13:09:50 | Computer Name = Speedy-PC | Source = volsnap | ID = 393232
Description = Die Schattenkopien von Volume "K:" wurden verworfen, weil die Bereitsstellungaufhebung
 von Volume "K:", das einen Schattenkopiespeicher für diese Schattenkopie enthält,
 erzwungen wurde.
 
Error - 06.07.2012 04:40:21 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 06.07.2012 04:40:21 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1069
 
Error - 07.07.2012 06:15:58 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 07.07.2012 06:15:58 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1069
 
Error - 07.07.2012 07:13:26 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 07.07.2012 07:13:26 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1069
 
Error - 07.07.2012 08:24:54 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
 mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:  %%1330    Vergewissern
 Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
 Management Console (MMC).
 
Error - 07.07.2012 08:24:54 | Computer Name = Speedy-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1069
 
 
< End of report >
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 19:00 on 21/11/2012 (Speedy)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-11-21 19:02:25
-----------------------------
19:02:25.201    OS Version: Windows 6.1.7601 Service Pack 1
19:02:25.201    Number of processors: 2 586 0x602
19:02:25.201    ComputerName: SPEEDY-PC  UserName: Speedy
19:02:25.841    Initialize success
19:04:21.771    AVAST engine defs: 12112100
19:04:35.562    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-5
19:04:35.562    Disk 0 Vendor: SAMSUNG_HD103SI 1AG01118 Size: 953869MB BusType: 11
19:04:35.577    Disk 0 MBR read successfully
19:04:35.593    Disk 0 MBR scan
19:04:35.609    Disk 0 Windows 7 default MBR code
19:04:35.624    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        99924 MB offset 206848
19:04:35.640    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      853842 MB offset 204851200
19:04:35.640    Disk 0 scanning sectors +1953519616
19:04:35.702    Disk 0 scanning C:\Windows\system32\drivers
19:04:44.345    Service scanning
19:05:03.720    Modules scanning
19:05:07.698    Disk 0 trace - called modules:
19:05:07.713    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys
19:05:08.228    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x865e4a58]
19:05:08.244    3 CLASSPNP.SYS[8b9b359e] -> nt!IofCallDriver -> [0x864f9c10]
19:05:08.259    5 ACPI.sys[8b3b93d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-5[0x85738030]
19:05:08.852    AVAST engine scan C:\Windows
19:05:10.131    AVAST engine scan C:\Windows\system32
19:07:28.363    AVAST engine scan C:\Windows\system32\drivers
19:07:39.408    AVAST engine scan C:\Users\Speedy
19:10:03.099    AVAST engine scan C:\ProgramData
19:11:40.256    Scan finished successfully
19:14:57.300    Disk 0 MBR has been saved successfully to "C:\Users\Speedy\Desktop\wichtig\MBR.dat"
19:14:57.315    The log file has been saved successfully to "C:\Users\Speedy\Desktop\wichtig\aswMBR.txt"

Diabolo 21.11.2012 19:29
bei TDSSKiller.exe wurde nix gefunden, habe aber den report mal als Anhang dabei gemacht...

M-K-D-B 21.11.2012 19:55
Servus,


führe bitte JRT und ComboFix aus und berichte, ob du anschließend immer noch Probleme bei Google hast.
Wenn ja, gib mir auch Bescheid, in welchem Browser das Problem auftritt.



Schritt 1
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
http://imageshack.us/a/img841/7292/thisisujrt.gif Bitte lade Junkware Removal Tool auf Deinen Desktop.
  • Starte das Tool mit Doppelklick. Vista und 7 Nutzer bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Das Tool wird sich öffnen und mit dem Scan beginnen.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.





Schritt 2
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.







Bitte poste mit deiner nächsten Antwort
  • die Logdatei von JRT,
  • die Logdatei von ComboFix,
  • eine kurze Rückmeldung.

Diabolo 22.11.2012 00:04
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 3.4.1 (11.21.2012)
OS: Windows 7 Ultimate x86
Ran by Speedy on 21.11.2012 at 23:46:49,55
Blog: hxxp://thisisudax.blogspot.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\windows nt\currentversion\windows\\AppInit_DLLs



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Speedy\AppData\Roaming\dvdvideosoft"
Successfully deleted: [Folder] "C:\Program Files\conduit"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.11.2012 at 23:48:54,25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ComboFix 12-11-21.01 - Speedy 21.11.2012  23:55:24.2.2 - x86
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.3071.1988 [GMT 1:00]
ausgeführt von:: c:\users\Speedy\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\hpe79B7.dll
c:\windows\RazorDOX
c:\windows\RazorDOX\RazorDOX.dll
c:\windows\RazorDOX\RazorDOX.ini
c:\windows\system32\muzapp.exe
c:\windows\system32\tmpD56B.tmp
c:\windows\system32\tmpD57B.tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-10-21 bis 2012-11-21  ))))))))))))))))))))))))))))))
.
.
2012-11-21 23:01 . 2012-11-21 23:01        --------        d-----w-        c:\users\Speedy\AppData\Local\temp
2012-11-21 23:01 . 2012-11-21 23:01        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2012-11-21 23:01 . 2012-11-21 23:01        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-11-21 22:46 . 2012-11-21 22:46        --------        d-----w-        c:\windows\ERUNT
2012-11-21 22:46 . 2012-11-21 22:46        --------        d-----w-        C:\JRT
2012-11-20 18:32 . 2012-11-20 18:33        --------        d-----w-        c:\users\Speedy\AppData\Local\Alt.Binz
2012-11-20 14:25 . 2012-11-21 10:50        --------        d-----w-        c:\program files\Mozilla Maintenance Service
2012-11-20 14:22 . 2012-11-20 14:22        --------        d-----w-        c:\users\Speedy\AppData\Roaming\Apple Computer
2012-11-20 14:22 . 2012-11-20 14:22        --------        d-----w-        c:\program files\Bloson
2012-11-20 14:22 . 2012-11-20 14:22        --------        d-----w-        c:\users\Speedy\AppData\Roaming\MozillaFirefoxPackages
2012-11-20 13:57 . 2012-11-20 18:31        --------        d-----w-        c:\program files\GridinSoft Trojan Killer
2012-11-20 13:35 . 2012-11-20 13:35        --------        d-----w-        c:\program files\CCleaner
2012-11-20 09:47 . 2012-11-20 09:47        --------        d-----w-        c:\programdata\Malwarebytes
2012-11-15 22:21 . 2012-11-15 22:21        --------        d-----w-        c:\program files\Common Files\Steam
2012-11-15 21:06 . 2012-07-26 03:39        526952        ----a-w-        c:\windows\system32\drivers\Wdf01000.sys
2012-11-15 21:06 . 2012-07-26 03:39        47720        ----a-w-        c:\windows\system32\drivers\WdfLdr.sys
2012-11-15 21:06 . 2012-07-26 02:46        9728        ----a-w-        c:\windows\system32\Wdfres.dll
2012-11-15 21:03 . 2012-08-24 17:05        136560        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2012-11-15 21:03 . 2012-08-24 17:02        369856        ----a-w-        c:\windows\system32\drivers\cng.sys
2012-11-15 21:03 . 2012-08-24 16:57        247808        ----a-w-        c:\windows\system32\schannel.dll
2012-11-15 21:03 . 2012-08-24 16:57        220160        ----a-w-        c:\windows\system32\ncrypt.dll
2012-11-15 21:03 . 2012-08-24 16:56        1039360        ----a-w-        c:\windows\system32\lsasrv.dll
2012-11-15 20:58 . 2012-10-18 17:59        2345984        ----a-w-        c:\windows\system32\win32k.sys
2012-11-15 20:58 . 2012-09-25 22:47        78336        ----a-w-        c:\windows\system32\synceng.dll
2012-11-15 20:58 . 2012-10-03 16:58        1293680        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-11-15 20:58 . 2012-10-03 16:42        52224        ----a-w-        c:\windows\system32\nlaapi.dll
2012-11-15 20:58 . 2012-10-03 16:42        242176        ----a-w-        c:\windows\system32\nlasvc.dll
2012-11-15 20:58 . 2012-10-03 16:42        18944        ----a-w-        c:\windows\system32\netevent.dll
2012-11-15 20:58 . 2012-10-03 16:42        175104        ----a-w-        c:\windows\system32\netcorehc.dll
2012-11-15 20:58 . 2012-10-03 16:42        156672        ----a-w-        c:\windows\system32\ncsi.dll
2012-11-15 20:58 . 2012-10-03 16:40        499712        ----a-w-        c:\windows\system32\iphlpsvc.dll
2012-11-15 20:58 . 2012-10-03 15:21        35328        ----a-w-        c:\windows\system32\drivers\tcpipreg.sys
2012-11-15 20:58 . 2012-10-09 17:40        44032        ----a-w-        c:\windows\system32\dhcpcsvc6.dll
2012-11-15 20:58 . 2012-10-09 17:40        193536        ----a-w-        c:\windows\system32\dhcpcore6.dll
2012-11-14 20:42 . 2010-11-17 00:15        267112        ----a-w-        c:\windows\system32\hpinksts5412LM.dll
2012-11-14 20:42 . 2010-11-17 00:15        213864        ----a-w-        c:\windows\system32\hpinkcoi5412.dll
2012-11-14 18:02 . 2012-11-14 18:02        --------        d-----w-        c:\users\Speedy\AppData\Local\FLT
2012-11-14 15:01 . 2012-11-14 15:01        --------        d-----w-        c:\users\Speedy\AppData\Local\Programs
2012-11-13 01:33 . 2012-10-02 22:20        888168        ----a-w-        c:\windows\system32\nvdispgenco32.dll
2012-11-13 01:33 . 2012-10-02 22:20        7697768        ----a-w-        c:\windows\system32\nvcuda.dll
2012-11-13 01:33 . 2012-10-02 22:20        2574696        ----a-w-        c:\windows\system32\nvcuvid.dll
2012-11-13 01:33 . 2012-10-02 22:20        1867112        ----a-w-        c:\windows\system32\nvcuvenc.dll
2012-11-13 01:33 . 2012-10-02 22:20        10837352        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys
2012-11-13 01:33 . 2012-07-03 15:25        28008        ----a-w-        c:\windows\system32\nvhdap32.dll
2012-11-13 01:33 . 2012-07-03 15:25        149352        ----a-w-        c:\windows\system32\drivers\nvhda32v.sys
2012-11-13 01:33 . 2012-10-02 22:20        6127464        ----a-w-        c:\windows\system32\nvopencl.dll
2012-11-13 01:33 . 2012-10-02 22:20        19906920        ----a-w-        c:\windows\system32\nvoglv32.dll
2012-11-13 01:33 . 2012-10-02 22:20        17559912        ----a-w-        c:\windows\system32\nvcompiler.dll
2012-11-13 01:33 . 2012-10-02 22:20        15309160        ----a-w-        c:\windows\system32\nvd3dum.dll
2012-11-12 23:10 . 2012-11-12 23:10        --------        d-----w-        c:\users\Speedy\AppData\Roaming\AVG2013
2012-11-12 23:07 . 2012-11-12 23:08        --------        d-----w-        c:\programdata\AVG2013
2012-11-12 23:00 . 2012-11-13 00:12        --------        d-----w-        c:\users\Speedy\AppData\Local\Avg2013
2012-11-12 23:00 . 2012-11-12 23:00        --------        d-----w-        c:\users\Speedy\AppData\Local\MFAData
2012-11-11 21:52 . 2012-11-11 21:52        --------        d-----w-        c:\users\Speedy\AppData\Roaming\Doomsday
2012-11-07 18:39 . 2012-11-07 18:39        --------        d-----w-        c:\program files\Agent Hugo - Hula Holiday
2012-11-07 10:44 . 2012-11-07 10:44        --------        d-----w-        c:\program files\Common Files\Skype
2012-11-07 10:44 . 2012-11-07 10:44        --------        d-----r-        c:\program files\Skype
2012-11-05 22:23 . 2012-11-05 22:23        --------        d-----w-        c:\users\Speedy\AppData\Local\Freelancer
2012-11-04 20:16 . 2010-05-14 13:56        319488        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\hpfpp02t.dll
2012-11-04 20:16 . 2010-05-14 13:56        125440        ----a-w-        c:\windows\system32\hpf3l02t.dll
2012-11-04 20:15 . 2012-11-04 20:15        --------        d-----w-        c:\users\Speedy\AppData\Local\HP
2012-11-02 20:33 . 2012-11-19 19:16        --------        d-----w-        c:\users\Speedy\AppData\Roaming\Rovio
2012-10-29 16:42 . 2012-10-29 16:42        242240        ----a-w-        c:\windows\system32\drivers\dtsoftbus01.sys
2012-10-29 16:42 . 2012-10-29 16:42        --------        d-----w-        c:\program files\DAEMON Tools Lite
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-14 15:06 . 2012-08-13 11:42        109080        ----a-w-        c:\windows\system32\OpenAL32.dll
2012-11-12 11:02 . 2012-04-02 10:28        697272        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-11-12 11:02 . 2012-03-09 20:43        73656        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-30 23:41 . 2012-06-26 23:08        139128        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys
2012-10-30 23:41 . 2012-06-26 23:31        280600        ----a-w-        c:\windows\system32\PnkBstrB.xtr
2012-10-30 23:41 . 2012-06-26 23:07        280600        ----a-w-        c:\windows\system32\PnkBstrB.exe
2012-10-30 23:35 . 2012-06-26 23:07        280600        ----a-w-        c:\windows\system32\PnkBstrB.ex0
2012-10-22 12:02 . 2012-10-22 12:02        179936        ----a-w-        c:\windows\system32\drivers\avgidsdriverx.sys
2012-10-15 02:48 . 2012-10-15 02:48        55776        ----a-w-        c:\windows\system32\drivers\avgidshx.sys
2012-10-05 02:32 . 2012-10-05 02:32        93536        ----a-w-        c:\windows\system32\drivers\avgmfx86.sys
2012-10-02 22:20 . 2012-02-09 20:43        1009512        ----a-w-        c:\windows\system32\nvdispco32.dll
2012-10-02 22:20 . 2011-05-21 05:01        2428776        ----a-w-        c:\windows\system32\nvapi.dll
2012-10-02 22:20 . 2011-05-21 05:01        12501352        ----a-w-        c:\windows\system32\nvwgf2um.dll
2012-10-02 19:29 . 2012-03-09 19:19        645992        ----a-w-        c:\windows\system32\nvvsvc.exe
2012-10-02 19:29 . 2012-03-09 19:19        62312        ----a-w-        c:\windows\system32\nvshext.dll
2012-10-02 19:29 . 2012-03-09 19:19        2557288        ----a-w-        c:\windows\system32\nvsvcr.dll
2012-10-02 19:29 . 2012-03-09 19:19        108392        ----a-w-        c:\windows\system32\nvmctray.dll
2012-10-02 19:29 . 2012-03-09 19:19        2853224        ----a-w-        c:\windows\system32\nvsvc.dll
2012-10-02 19:28 . 2012-03-09 19:19        3965288        ----a-w-        c:\windows\system32\nvcpl.dll
2012-10-02 12:15 . 2012-10-02 12:15        430952        ----a-w-        c:\windows\system32\nvStreaming.exe
2012-10-02 02:30 . 2012-10-02 02:30        159712        ----a-w-        c:\windows\system32\drivers\avgldx86.sys
2012-09-24 21:16 . 2012-10-21 16:01        93672        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2012-09-21 02:46 . 2012-09-21 02:46        164832        ----a-w-        c:\windows\system32\drivers\avgtdix.sys
2012-09-21 02:46 . 2012-09-21 02:46        177376        ----a-w-        c:\windows\system32\drivers\avglogx.sys
2012-09-21 02:45 . 2012-09-21 02:45        19936        ----a-w-        c:\windows\system32\drivers\avgidsshimx.sys
2012-09-19 17:06 . 2012-08-13 11:42        19131904        ----a-w-        c:\windows\system32\rapture3d_oal.dll
2012-09-14 18:28 . 2012-10-10 11:58        2048        ----a-w-        c:\windows\system32\tzres.dll
2012-09-14 02:05 . 2012-09-14 02:05        35552        ----a-w-        c:\windows\system32\drivers\avgrkx86.sys
2012-09-05 21:58 . 2012-03-09 20:46        821736        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-09-05 21:58 . 2012-03-09 20:46        746984        ----a-w-        c:\windows\system32\deployJava1.dll
2012-08-31 17:18 . 2012-10-10 11:58        1211760        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2012-08-30 17:12 . 2012-10-10 11:58        3968880        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-10 11:58        3914096        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-08-24 16:57 . 2012-10-10 11:58        172544        ----a-w-        c:\windows\system32\wintrust.dll
2012-11-20 18:18 . 2012-11-20 18:18        262112        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-06 3143800]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Users^Speedy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
path=c:\users\Speedy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51        919008        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-08-28 13:52        3671904        ----a-w-        c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R240 Series]
2005-04-25 02:00        98304        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIAHE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R240 Series (Kopie 1)]
2005-04-25 02:00        98304        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIAHE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-07-30 06:43        138096        ----atw-        c:\users\Speedy\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2012-03-09 20:36        127040        ----a-w-        c:\program files\ICQ7.7\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesHelper]
2012-06-08 02:02        958392        ----a-w-        c:\program files\Samsung\Kies\KiesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR]
2012-06-08 02:02        21432        ----a-w-        c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2012-06-08 02:02        3521464        ----a-w-        c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2012-03-08 16:50        4280184        ----a-w-        c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-10-19 16:00        17875120        ----a-r-        c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Companion]
2009-12-08 12:51        774144        ----a-w-        c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
.
R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 ALSysIO;ALSysIO;c:\users\Speedy\AppData\Local\Temp\ALSysIO.sys [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [x]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [x]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [x]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [x]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [x]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [x]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [x]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S2 VBoxDrv;VBox Support Driver;c:\program files\YouWave_Android\vb\VBoxDrv.sys [x]
S3 KoneFltr;ROCCAT Kone;c:\windows\system32\drivers\Kone.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 90692238
*NewlyCreated* - ASWMBR
*Deregistered* - 90692238
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
GPSvcGroup        REG_MULTI_SZ          GPSvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 11:02]
.
2012-11-02 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3171171593-1227741318-2359526494-1001Core.job
- c:\users\Speedy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-30 06:43]
.
2012-11-21 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3171171593-1227741318-2359526494-1001UA.job
- c:\users\Speedy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-30 06:43]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe
TCP: Interfaces\{26B6D775-CE96-4455-A637-EDB8C0760B43}: NameServer = 192.168.178.1
FF - ProfilePath - c:\users\Speedy\AppData\Roaming\Mozilla\Firefox\Profiles\y62tegp8.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - ExtSQL: 2012-11-20 12:16; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Speedy\AppData\Roaming\Mozilla\Firefox\Profiles\y62tegp8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{7e111a5c-3d11-4f56-9463-5310c3c69025} - (no file)
WebBrowser-{7E111A5C-3D11-4F56-9463-5310C3C69025} - (no file)
MSConfigStartUp-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe
MSConfigStartUp-LogMeIn Hamachi Ui - c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3171171593-1227741318-2359526494-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FB0C4053-6BBD-11ED-9269-E0EE3C1EA788}*]
"iaapolngekfklmblia"=hex:6a,61,65,6f,6b,6f,65,6e,66,6a,69,61,6f,68,69,6a,6a,61,
  66,70,00,00
"haopehnidajfokpk"=hex:6a,61,65,6f,68,6f,62,6e,69,63,66,6f,6c,62,6b,6e,66,65,
  65,6b,00,00
"iaeagehjkicfoncoml"=hex:63,61,70,6e,6b,70,00,00
"dblogollnpfnhpoeflbgfceififibamanbbeklip"=hex:68,61,6c,62,65,6c,64,65,68,6e,
  62,67,62,65,67,65,00,00
"jblogollnpfnhpoeflbgedahckmkkncebihnfjcgfnkijenkmpdi"=hex:68,61,6c,62,65,6c,
  64,65,68,6e,62,67,62,65,67,65,00,00
"dblogollnpfnhpoeflbggdhhpmgbbkejoapkojed"=hex:62,61,6f,6e,00,00
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-11-22  00:02:07
ComboFix-quarantined-files.txt  2012-11-21 23:02
.
Vor Suchlauf: 8 Verzeichnis(se), 65.445.490.688 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 69.767.401.472 Bytes frei
.
- - End Of File - - A91768FFB3A1121ED2EEC2540FD5FC80
also bis jetzt ist ruhe bei google.. aber ich warte auf das OK von euch...

M-K-D-B 22.11.2012 17:48
Servus,




Code:
c:\users\Speedy\AppData\Roaming\*.
  • Schließe bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Scan Button.
  • Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Diabolo 22.11.2012 18:05
Servus,

Code:
OTL logfile created on: 22.11.2012 18:00:16 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Speedy\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,65 Gb Available Physical Memory | 55,09% Memory free
6,00 Gb Paging File | 4,47 Gb Available in Paging File | 74,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97,58 Gb Total Space | 64,82 Gb Free Space | 66,43% Space Free | Partition Type: NTFS
Drive G: | 833,83 Gb Total Space | 155,85 Gb Free Space | 18,69% Space Free | Partition Type: NTFS
Drive H: | 3,69 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: SPEEDY-PC | User Name: Speedy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.21 18:48:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Speedy\Desktop\OTL.exe
PRC - [2012.11.06 19:00:32 | 003,143,800 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgui.exe
PRC - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgidsagent.exe
PRC - [2012.10.30 04:59:56 | 000,726,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgrsx.exe
PRC - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgwdsvc.exe
PRC - [2012.10.22 13:04:32 | 001,116,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgnsx.exe
PRC - [2012.10.22 13:03:52 | 000,796,792 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgemcx.exe
PRC - [2012.10.22 13:03:46 | 000,440,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG2013\avgcsrvx.exe
PRC - [2012.10.02 23:20:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.10.02 20:29:14 | 000,864,616 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2012.10.02 20:28:55 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.08.31 15:02:02 | 002,754,984 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2012.08.28 14:52:46 | 002,608,992 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Lite\DTShellHlp.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.03.05 16:00:00 | 002,065,920 | ---- | M] (Rdl) -- C:\Programme\Alt.Binz\altbinz.exe
PRC - [2012.01.18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 13:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.30 10:23:26 | 000,090,112 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.17 20:55:35 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.11.20 19:18:58 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.11.12 12:02:58 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.11.06 19:00:04 | 005,814,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012.10.22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2012.10.19 16:56:30 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.10.02 23:20:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.08.31 15:02:02 | 002,754,984 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.03.10 18:07:26 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012.03.07 11:09:32 | 004,033,024 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2012.01.18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.04.30 10:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Speedy\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Speedy\AppData\Local\Temp\ALSysIO.sys -- (ALSysIO)
DRV - [2012.10.29 17:42:23 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2012.10.22 13:02:46 | 000,179,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2012.10.15 03:48:52 | 000,055,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012.10.05 03:32:50 | 000,093,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2012.10.02 23:20:00 | 010,837,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012.10.02 03:30:38 | 000,159,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012.09.21 03:46:06 | 000,164,832 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012.09.21 03:46:00 | 000,177,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\avglogx.sys -- (Avglogx)
DRV - [2012.09.21 03:45:54 | 000,019,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2012.09.14 03:05:20 | 000,035,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2012.08.23 15:44:32 | 000,014,848 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2012.08.23 15:40:25 | 000,049,664 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2012.07.03 16:25:17 | 000,149,352 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2012.04.01 18:42:23 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2012.04.01 18:42:23 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggflt.sys -- (ggflt)
DRV - [2012.01.18 06:44:52 | 004,332,960 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC)
DRV - [2012.01.18 06:44:28 | 000,312,096 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2011.07.15 19:13:12 | 000,135,680 | ---- | M] (Oracle Corporation) [Kernel | Auto | Running] -- C:\Programme\YouWave_Android\vb\VBoxDrv.sys -- (VBoxDrv)
DRV - [2011.06.02 06:47:22 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2011.06.02 06:47:22 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus)
DRV - [2011.06.02 06:47:22 | 000,114,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadserd.sys -- (ssadserd)
DRV - [2011.06.02 06:47:22 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl)
DRV - [2010.12.21 06:55:02 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadadb.sys -- (androidusb)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.08.12 12:07:48 | 000,298,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009.07.14 01:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.13 23:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009.03.25 16:48:00 | 000,114,728 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdm.sys -- (s1018mdm)
DRV - [2009.03.25 16:48:00 | 000,109,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018unic.sys -- (s1018unic)
DRV - [2009.03.25 16:48:00 | 000,106,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mgmt.sys -- (s1018mgmt)
DRV - [2009.03.25 16:48:00 | 000,104,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018obex.sys -- (s1018obex)
DRV - [2009.03.25 16:48:00 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018bus.sys -- (s1018bus)
DRV - [2009.03.25 16:48:00 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018nd5.sys -- (s1018nd5)
DRV - [2009.03.25 16:48:00 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdfl.sys -- (s1018mdfl)
DRV - [2009.03.18 15:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008.12.11 06:56:14 | 000,013,056 | ---- | M] (ROCCAT Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Kone.sys -- (KoneFltr)
DRV - [2007.06.29 13:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 CD 5A 32 B0 36 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{501742C8-F9AD-4454-9D83-7C8421F36C11}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.google.de/"
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: thumbnailZoom%40dadler.github.com:2.3
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.12
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Speedy\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.20 19:18:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.20 19:18:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.11.20 19:18:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 17.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.11.20 19:18:54 | 000,000,000 | ---D | M]
 
[2012.03.09 21:25:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\Extensions
[2012.11.21 23:49:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\Firefox\Profiles\y62tegp8.default\extensions
[2012.11.21 23:49:24 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Speedy\AppData\Roaming\mozilla\Firefox\Profiles\y62tegp8.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.09.16 10:05:03 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Speedy\AppData\Roaming\mozilla\Firefox\Profiles\y62tegp8.default\extensions\ich@maltegoetz.de
[2012.09.12 17:52:47 | 000,136,064 | ---- | M] () (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\firefox\profiles\y62tegp8.default\extensions\thumbnailZoom@dadler.github.com.xpi
[2012.11.21 23:35:30 | 000,804,737 | ---- | M] () (No name found) -- C:\Users\Speedy\AppData\Roaming\mozilla\firefox\profiles\y62tegp8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.11.20 19:18:53 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.11.20 19:18:58 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.10.24 23:03:12 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.10.24 23:03:11 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.10.24 23:03:12 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.10.24 23:03:12 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.10.24 23:03:12 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.10.24 23:03:11 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.11.22 00:01:11 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Programme\ICQ7.7\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.9.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26B6D775-CE96-4455-A637-EDB8C0760B43}: NameServer = 192.168.178.1
O18 - Protocol\Handler\linkscanner - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2012.11.21 17:51:08 | 000,000,082 | R--- | M] () - H:\Autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.22 15:49:38 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\{7BEFFE58-4230-4442-A5AE-6E6424A61A5A}
[2012.11.22 12:58:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision
[2012.11.22 00:02:10 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.11.22 00:02:09 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.11.22 00:02:09 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\temp
[2012.11.21 23:52:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.11.21 23:52:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.11.21 23:52:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.11.21 23:51:52 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.11.21 23:51:41 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.11.21 23:51:08 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\{AFA18C07-0383-430F-9133-001A7272B202}
[2012.11.21 23:49:49 | 005,004,435 | R--- | C] (Swearware) -- C:\Users\Speedy\Desktop\ComboFix.exe
[2012.11.21 23:46:48 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2012.11.21 23:46:27 | 000,000,000 | ---D | C] -- C:\JRT
[2012.11.21 19:15:28 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Speedy\Desktop\tdsskiller.exe
[2012.11.21 19:01:45 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\Speedy\Desktop\aswMBR.exe
[2012.11.21 18:59:06 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Desktop\wichtig
[2012.11.21 18:48:36 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Speedy\Desktop\OTL.exe
[2012.11.21 11:50:42 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\{0C6AB336-B336-4C8D-84CC-1154B694F224}
[2012.11.20 19:32:35 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Alt.Binz
[2012.11.20 19:18:53 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.11.20 15:25:02 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012.11.20 15:22:06 | 000,000,000 | ---D | C] -- C:\Program Files\Bloson
[2012.11.20 15:22:06 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\Apple Computer
[2012.11.20 15:22:02 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\MozillaFirefoxPackages
[2012.11.20 14:57:04 | 000,000,000 | ---D | C] -- C:\Program Files\GridinSoft Trojan Killer
[2012.11.20 14:35:11 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.11.20 10:47:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.18 13:57:09 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\BioWare
[2012.11.15 23:21:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam
[2012.11.15 22:12:50 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\rdpvideominiport.sys
[2012.11.15 22:12:50 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
[2012.11.15 22:12:49 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\TsUsbFlt.sys
[2012.11.15 22:12:49 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
[2012.11.15 22:12:49 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RdpGroupPolicyExtension.dll
[2012.11.15 22:12:48 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2012.11.15 22:12:48 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TSWbPrxy.exe
[2012.11.15 22:12:48 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsRdpWebAccess.dll
[2012.11.15 22:12:48 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2012.11.15 22:12:48 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbGDCoInstaller.dll
[2012.11.15 22:12:48 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprtPS.dll
[2012.11.15 22:12:47 | 002,739,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorets.dll
[2012.11.15 22:12:47 | 000,317,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprt.exe
[2012.11.15 22:12:47 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpudd.dll
[2012.11.15 22:12:47 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpendp_winip.dll
[2012.11.15 22:06:26 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2012.11.15 22:06:26 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2012.11.15 22:05:54 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2012.11.15 22:05:53 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2012.11.15 22:05:52 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2012.11.15 22:05:24 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.11.15 22:05:24 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.11.15 22:05:23 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.11.15 22:05:23 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.11.15 22:05:23 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.11.15 22:05:22 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.11.15 22:05:22 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.11.15 22:05:21 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.11.15 22:03:47 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.11.15 21:58:16 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.11.15 21:58:15 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2012.11.15 21:58:13 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netcorehc.dll
[2012.11.15 21:58:13 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncsi.dll
[2012.11.15 21:58:13 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2012.11.15 21:58:08 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcore6.dll
[2012.11.15 21:58:08 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll
[2012.11.14 21:42:37 | 000,267,112 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\System32\hpinksts5412LM.dll
[2012.11.14 21:42:37 | 000,213,864 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\System32\hpinkcoi5412.dll
[2012.11.14 19:02:27 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\FLT
[2012.11.14 16:01:57 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Programs
[2012.11.13 02:33:38 | 010,837,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys
[2012.11.13 02:33:38 | 007,697,768 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll
[2012.11.13 02:33:38 | 002,574,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll
[2012.11.13 02:33:38 | 001,867,112 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll
[2012.11.13 02:33:38 | 000,888,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispgenco32.dll
[2012.11.13 02:33:38 | 000,149,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvhda32v.sys
[2012.11.13 02:33:38 | 000,028,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvhdap32.dll
[2012.11.13 02:33:37 | 019,906,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll
[2012.11.13 02:33:37 | 017,559,912 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll
[2012.11.13 02:33:37 | 015,309,160 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll
[2012.11.13 02:33:37 | 006,127,464 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvopencl.dll
[2012.11.13 00:10:32 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\AVG2013
[2012.11.13 00:07:14 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013
[2012.11.13 00:00:59 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\MFAData
[2012.11.13 00:00:59 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Avg2013
[2012.11.11 22:52:43 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\Doomsday
[2012.11.10 22:09:33 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\FUSSBALL MANAGER 13
[2012.11.10 22:06:06 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\FIFA MANAGER 13
[2012.11.07 19:39:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Agent Hugo - Hula Holiday
[2012.11.07 19:39:26 | 000,000,000 | ---D | C] -- C:\Program Files\Agent Hugo - Hula Holiday
[2012.11.07 11:44:42 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2012.11.07 11:44:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.11.07 11:44:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.11.05 23:23:21 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\Freelancer
[2012.11.04 21:16:42 | 000,125,440 | ---- | C] (Hewlett-Packard Company) -- C:\Windows\System32\hpf3l02t.dll
[2012.11.04 21:15:07 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Local\HP
[2012.11.02 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Speedy\AppData\Roaming\Rovio
[2012.11.02 21:33:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rovio
[2012.10.31 00:35:19 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\MOHW_DayOnePatch_PC
[2012.10.29 17:42:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2012.10.29 17:42:23 | 000,242,240 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.10.29 17:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite
[2012.10.28 20:13:09 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Desktop\BVB
[2012.10.24 15:10:45 | 000,000,000 | ---D | C] -- C:\Users\Speedy\Documents\Lucius
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.22 17:48:01 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3171171593-1227741318-2359526494-1001UA.job
[2012.11.22 17:11:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.22 12:58:25 | 000,000,896 | ---- | M] () -- C:\Users\Public\Desktop\Family Guy Back to the Multiverse.lnk
[2012.11.22 09:12:04 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2012.11.22 09:05:49 | 000,707,088 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.22 09:05:49 | 000,660,706 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.22 09:05:49 | 000,152,680 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.22 09:05:49 | 000,124,896 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.22 09:04:58 | 000,016,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.22 09:04:58 | 000,016,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.22 08:59:51 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.22 08:59:49 | 2415,316,992 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.22 00:01:11 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.11.21 23:50:03 | 005,004,435 | R--- | M] (Swearware) -- C:\Users\Speedy\Desktop\ComboFix.exe
[2012.11.21 23:46:04 | 000,896,956 | ---- | M] () -- C:\Users\Speedy\Desktop\JRT.exe
[2012.11.21 19:15:30 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Speedy\Desktop\tdsskiller.exe
[2012.11.21 19:02:14 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\Speedy\Desktop\aswMBR.exe
[2012.11.21 19:00:27 | 000,000,156 | ---- | M] () -- C:\Users\Speedy\defogger_reenable
[2012.11.21 18:58:53 | 000,050,477 | ---- | M] () -- C:\Users\Speedy\Desktop\Defogger.exe
[2012.11.21 18:48:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Speedy\Desktop\OTL.exe
[2012.11.21 18:44:54 | 000,543,531 | ---- | M] () -- C:\Users\Speedy\Desktop\adwcleaner.exe
[2012.11.20 15:25:03 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.11.20 15:16:50 | 003,712,296 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.20 14:35:12 | 000,000,969 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.11.14 21:26:25 | 000,024,822 | ---- | M] () -- C:\Users\Speedy\Desktop\refarat.odt
[2012.11.14 16:06:20 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\System32\OpenAL32.dll
[2012.11.14 16:05:00 | 000,000,636 | ---- | M] () -- C:\Users\Public\Desktop\F1 Race Stars.lnk
[2012.11.13 00:22:13 | 000,013,718 | ---- | M] () -- C:\Users\Speedy\Desktop\320100_225139290875085_734531555_n.jpg
[2012.11.13 00:08:27 | 000,000,951 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012.11.12 12:02:58 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.11.12 12:02:58 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.11.11 22:52:43 | 000,000,081 | ---- | M] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.11.10 14:24:58 | 000,003,592 | ---- | M] () -- C:\Users\Speedy\AppData\Local\HH.SAV
[2012.11.07 19:39:37 | 000,002,715 | ---- | M] () -- C:\Users\Public\Desktop\Agent Hugo Hula Holiday.lnk
[2012.11.07 11:44:42 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012.11.05 20:12:33 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.11.05 20:12:33 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012.11.03 09:36:15 | 000,000,697 | ---- | M] () -- C:\Users\Speedy\Documents\Bus für Essen Syburg.rtf
[2012.11.02 21:33:13 | 000,000,712 | ---- | M] () -- C:\Users\Public\Desktop\Angry Birds Space.lnk
[2012.11.02 08:48:01 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3171171593-1227741318-2359526494-1001Core.job
[2012.10.31 00:41:31 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.10.31 00:41:25 | 000,280,600 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2012.10.31 00:35:27 | 000,280,600 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2012.10.29 17:42:51 | 000,001,900 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.10.29 17:42:23 | 000,242,240 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2012.10.29 16:00:43 | 000,001,761 | ---- | M] () -- C:\Users\Speedy\Documents\Road stop.rtf
[2012.10.29 14:09:29 | 000,000,430 | ---- | M] () -- C:\Users\Speedy\Documents\runrig.rtf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.22 12:58:25 | 000,000,896 | ---- | C] () -- C:\Users\Public\Desktop\Family Guy Back to the Multiverse.lnk
[2012.11.21 23:52:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.11.21 23:52:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.11.21 23:52:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.11.21 23:52:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.11.21 23:52:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.11.21 23:46:02 | 000,896,956 | ---- | C] () -- C:\Users\Speedy\Desktop\JRT.exe
[2012.11.21 19:00:26 | 000,000,156 | ---- | C] () -- C:\Users\Speedy\defogger_reenable
[2012.11.21 18:58:52 | 000,050,477 | ---- | C] () -- C:\Users\Speedy\Desktop\Defogger.exe
[2012.11.21 18:44:54 | 000,543,531 | ---- | C] () -- C:\Users\Speedy\Desktop\adwcleaner.exe
[2012.11.20 15:25:03 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.11.20 15:16:24 | 003,712,296 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.20 14:35:12 | 000,000,969 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.11.15 22:06:27 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 22:05:52 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.14 16:05:00 | 000,000,636 | ---- | C] () -- C:\Users\Public\Desktop\F1 Race Stars.lnk
[2012.11.13 00:22:12 | 000,013,718 | ---- | C] () -- C:\Users\Speedy\Desktop\320100_225139290875085_734531555_n.jpg
[2012.11.13 00:08:27 | 000,000,951 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2012.11.11 22:52:43 | 000,000,081 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.11.07 19:40:44 | 000,003,592 | ---- | C] () -- C:\Users\Speedy\AppData\Local\HH.SAV
[2012.11.07 19:39:37 | 000,002,715 | ---- | C] () -- C:\Users\Public\Desktop\Agent Hugo Hula Holiday.lnk
[2012.11.07 17:14:13 | 000,024,822 | ---- | C] () -- C:\Users\Speedy\Desktop\refarat.odt
[2012.11.05 20:12:33 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012.11.05 20:12:33 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012.11.02 21:33:13 | 000,000,712 | ---- | C] () -- C:\Users\Public\Desktop\Angry Birds Space.lnk
[2012.10.30 10:43:01 | 000,000,697 | ---- | C] () -- C:\Users\Speedy\Documents\Bus für Essen Syburg.rtf
[2012.10.29 17:42:51 | 000,001,900 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
[2012.10.29 16:00:43 | 000,001,761 | ---- | C] () -- C:\Users\Speedy\Documents\Road stop.rtf
[2012.10.29 14:09:29 | 000,000,430 | ---- | C] () -- C:\Users\Speedy\Documents\runrig.rtf
[2012.10.04 13:47:19 | 000,484,352 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2012.09.29 08:38:21 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2012.06.27 00:08:07 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.06.27 00:08:01 | 000,138,904 | ---- | C] () -- C:\Users\Speedy\AppData\Roaming\PnkBstrK.sys
[2012.06.27 00:07:39 | 000,280,600 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2012.06.27 00:07:38 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2012.06.21 09:37:14 | 003,166,792 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2012.05.23 17:49:34 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.05.23 17:49:32 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2012.05.23 17:49:32 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2012.05.23 17:49:32 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2012.05.23 17:49:32 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2012.03.10 17:24:30 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.03.10 17:23:44 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.03.10 09:51:36 | 000,000,094 | ---- | C] () -- C:\Users\Speedy\AppData\Local\fusioncache.dat
[2012.03.09 20:20:53 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.01.18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012.01.18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012.01.18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2012.01.18 06:22:54 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011.09.28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Custom Scans ==========
 
< c:\users\Speedy\AppData\Roaming\*. >
[2012.04.19 20:36:00 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\.minecraft
[2012.05.27 13:59:09 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Acreon
[2012.06.12 19:02:37 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Adobe
[2012.04.08 14:06:14 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Alawar
[2012.06.25 20:20:20 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Amaranth Games
[2012.11.20 15:22:06 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Apple Computer
[2012.03.24 20:45:19 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Artogon
[2012.09.21 16:56:07 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Ashampoo
[2012.11.13 00:10:32 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\AVG2013
[2012.08.07 21:04:47 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Awem
[2012.04.02 21:01:37 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Azuaz Games
[2012.03.15 14:26:19 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Bioshock
[2012.03.16 11:55:36 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Bioshock2
[2012.03.28 00:25:57 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\calibre
[2012.06.26 13:09:20 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Canneverbe Limited
[2012.04.02 21:45:12 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\casualArts
[2012.11.22 12:54:05 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\DAEMON Tools Lite
[2012.11.11 22:52:43 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Doomsday
[2012.08.07 11:11:27 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\dvdcss
[2012.07.07 12:09:50 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Ekoti
[2012.04.05 23:12:06 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\FreeAudioPack
[2012.04.05 23:14:05 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\FreeCDRipper
[2012.05.19 15:30:25 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\GO Games
[2012.11.05 22:51:51 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\ICQ
[2012.03.09 20:09:52 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Identities
[2012.03.09 21:43:56 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Macromedia
[2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Media Center Programs
[2012.11.20 15:02:56 | 000,000,000 | --SD | M] -- c:\users\Speedy\AppData\Roaming\Microsoft
[2012.03.10 10:30:16 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Mozilla
[2012.11.20 15:22:02 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\MozillaFirefoxPackages
[2012.04.19 21:00:00 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\NVIDIA
[2012.03.16 12:29:35 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\OpenOffice.org
[2012.04.02 21:32:06 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\ProtectDISC
[2012.11.19 20:16:52 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Rovio
[2012.06.25 20:49:51 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Samsung
[2012.05.27 11:05:48 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\ShamanGS
[2012.11.11 21:51:45 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Skype
[2012.05.27 17:49:48 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Sony
[2012.05.07 14:26:14 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Sony Setup
[2012.10.14 13:36:06 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\TeamViewer
[2012.11.12 21:45:50 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\TS3Client
[2012.06.26 23:58:59 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\Ubisoft
[2012.11.22 11:27:39 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\vlc
[2012.03.09 21:46:22 | 000,000,000 | ---D | M] -- c:\users\Speedy\AppData\Roaming\WinRAR
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:512E1728

< End of report >
Bitte Schön...

M-K-D-B 22.11.2012 19:59
Servus,



Schritt 1

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:
:OTL
IE - HKCU\..\SearchScopes\{501742C8-F9AD-4454-9D83-7C8421F36C11}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
@Alternate Data Stream - 190 bytes -> C:\ProgramData\TEMP:512E1728

:commands
[Emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread






Schritt 2
Downloade Dir bitte Malwarebytes' Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.





Schritt 3

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset







Schritt 4
Downloade Dir bitte SecurityCheck
  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS- Box.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Wenn der Scan beendet wurde sollte sich ein Textdokument ( checkup.txt ) öffnen.
Poste den Inhalt bitte hier.





Bitte poste mit deiner nächsten Antwort
  • die Logdatei von OTL,
  • die Logdatei von MBAM,
  • die Logdatei von ESET,
  • die Logdatei von SecurityCheck.

Diabolo 23.11.2012 00:08
Code:
All processes killed
========== OTL ==========
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{501742C8-F9AD-4454-9D83-7C8421F36C11}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{501742C8-F9AD-4454-9D83-7C8421F36C11}\ not found.
ADS C:\ProgramData\TEMP:512E1728 deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Speedy
->Temp folder emptied: 100529 bytes
->Temporary Internet Files folder emptied: 7976026 bytes
->Java cache emptied: 8303957 bytes
->FireFox cache emptied: 78274728 bytes
->Flash cache emptied: 4568 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 106818 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 91,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 11222012_210302

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Code:
Malwarebytes Anti-Malware (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.22.10

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Speedy :: SPEEDY-PC [Administrator]

Schutz: Deaktiviert

22.11.2012 21:08:17
mbam-log-2012-11-22 (21-08-17).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 217575
Laufzeit: 4 Minute(n), 16 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
Results of screen317's Security Check version 0.99.54 
 Windows 7 Service Pack 1 x86 (UAC is enabled) 
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````
AVG Anti-Virus Free Edition 2013 
 Antivirus up to date!  (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.65.1.1000 
 CCleaner   
 JavaFX 2.1.1   
 Java(TM) 6 Update 31 
 Java 7 Update 9 
 Adobe Flash Player        11.5.502.110 
 Adobe Reader X (10.1.4)
 Mozilla Firefox (17.0)
````````Process Check: objlist.exe by Laurent```````` 
 AVG avgwdsvc.exe
 AVG avgrsx.exe
 AVG avgnsx.exe
 AVG avgemc.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
die Log datei vom ESET habe ich zufrüh gelösch(nach2std scannen) -.- also das Programm zufrüh gelöscht... aber die Log hatte nur 2 Einträge vom 2 spielen dll.. ist aber normal das manche scanner da anschlagen..

P.s wenn du sie trozdem brauchst dann reiche ich sie nach...

sooo nun zum 2. der Log zu ESET

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=1211b1a665f2094facaac42b0fa8398e
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-11-23 01:23:06
# local_time=2012-11-23 02:23:06 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1024 16777215 100 0 868025 868025 0 0
# compatibility_mode=5893 16776574 100 94 22228095 105257236 0 0
# compatibility_mode=8192 67108863 100 0 3749 3749 0 0
# scanned=155075
# found=2
# cleaned=0
# scan_time=7740
G:\FUSSBALL MANAGER 13\rld.dll        a variant of Win32/Packed.VMProtect.AAH trojan (unable to clean)        00000000000000000000000000000000        I
G:\Games!!!\Assassins Creed Sammlung\Assassins Creed II\sr-acii.iso        a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean)        00000000000000000000000000000000        I

M-K-D-B 23.11.2012 19:37
Servus,



Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.



Schritt 1
  • Folge folgendem Pfad: Start -> Systemsteuerung -> Software / Programme deinstallieren
  • Suche in der Liste Software mit dem folgenden Namen
    • Java(TM) 6 Update 31
    und deinstalliere das Programm.
  • Solltest du am Ende der Deinstallation zu einem Neustart aufgefordert werden, so führe diesen durch.
  • Sollte es Probleme mit der Deinstallation geben, so lass es mich bitte wissen.





Schritt 2
Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software / Programme deinstallieren--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome.





Schritt 3
Starte DeFogger und klicke auf Re-enable.
Gegebenenfalls muss dein Rechner neu gestartet werden.





Schritt 4
Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.
Code:
Combofix /Uninstall
http://larusso.trojaner-board.de/Images/CFuninstall.jpg

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.





Schritt 5
Downloade dir bitte delfix auf deinen Desktop.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Schließe die sich öffnende Textdatei.
  • Klicke abschließend auf Deinstallation.
  • Bestätige mit Ja.





Schritt 6
Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles, nur weil es Dich dazu auffordert und schön bunt ist.
  • Verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe.
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.



Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Diabolo 24.11.2012 22:05
Hey

soo ist alles Top und erledigt. ich bedanke mich bei euch für die schnelle und sehr Hilfreiche Hilfe, ihr macht wirklich einen Super Job hier...

M-K-D-B 25.11.2012 13:12
Ich bin froh, dass wir helfen konnten :abklatsch:

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:21 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58