Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   avira findet 24 viren (https://www.trojaner-board.de/121791-avira-findet-24-viren.html)

fux89 11.08.2012 08:35
avira findet 24 viren
 
Liste der Anhänge anzeigen (Anzahl: 1)
hallo,

ich habe folgendes problem: bei einem routinemäßigem scan hat avira 24 viren gefunden, warnmeldungen oder ähnliches gab es nicht.
auch sonst gibt es keinerlei beeinträchtigungen, alles läuft normal wie immer, von dem befall ist nix zu merken.

hier das scan-ergebnis:

Code:


Avira Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 7. August 2012  15:46

Es wird nach 4068576 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Engelmann
Computername  : ENGELMANN-PC

Versionsinformationen:
BUILD.DAT      : 12.0.0.1125          Bytes  02.05.2012 16:34:00
AVSCAN.EXE    : 12.3.0.15    466896 Bytes  08.05.2012 09:08:23
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  08.05.2012 09:08:23
LUKE.DLL      : 12.3.0.15      68304 Bytes  08.05.2012 09:08:35
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  09.05.2012 20:45:27
AVREG.DLL      : 12.3.0.17    232200 Bytes  11.05.2012 06:46:02
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 09:07:39
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 06:41:21
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 13:02:35
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 12:16:43
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 08:52:56
VBASE006.VDF  : 7.11.34.117    2048 Bytes  29.06.2012 08:52:56
VBASE007.VDF  : 7.11.34.118    2048 Bytes  29.06.2012 08:52:57
VBASE008.VDF  : 7.11.34.119    2048 Bytes  29.06.2012 08:52:57
VBASE009.VDF  : 7.11.34.120    2048 Bytes  29.06.2012 08:52:57
VBASE010.VDF  : 7.11.34.121    2048 Bytes  29.06.2012 08:52:58
VBASE011.VDF  : 7.11.34.122    2048 Bytes  29.06.2012 08:52:58
VBASE012.VDF  : 7.11.34.123    2048 Bytes  29.06.2012 08:52:58
VBASE013.VDF  : 7.11.34.124    2048 Bytes  29.06.2012 08:52:58
VBASE014.VDF  : 7.11.38.18  2554880 Bytes  30.07.2012 18:02:11
VBASE015.VDF  : 7.11.38.70    556032 Bytes  31.07.2012 18:02:13
VBASE016.VDF  : 7.11.38.143  171008 Bytes  02.08.2012 09:50:27
VBASE017.VDF  : 7.11.38.221  178176 Bytes  06.08.2012 18:33:59
VBASE018.VDF  : 7.11.38.222    2048 Bytes  06.08.2012 18:33:59
VBASE019.VDF  : 7.11.38.223    2048 Bytes  06.08.2012 18:34:00
VBASE020.VDF  : 7.11.38.224    2048 Bytes  06.08.2012 18:34:00
VBASE021.VDF  : 7.11.38.225    2048 Bytes  06.08.2012 18:34:00
VBASE022.VDF  : 7.11.38.226    2048 Bytes  06.08.2012 18:34:01
VBASE023.VDF  : 7.11.38.227    2048 Bytes  06.08.2012 18:34:01
VBASE024.VDF  : 7.11.38.228    2048 Bytes  06.08.2012 18:34:01
VBASE025.VDF  : 7.11.38.229    2048 Bytes  06.08.2012 18:34:01
VBASE026.VDF  : 7.11.38.230    2048 Bytes  06.08.2012 18:34:02
VBASE027.VDF  : 7.11.38.231    2048 Bytes  06.08.2012 18:34:02
VBASE028.VDF  : 7.11.38.232    2048 Bytes  06.08.2012 18:34:02
VBASE029.VDF  : 7.11.38.233    2048 Bytes  06.08.2012 18:34:03
VBASE030.VDF  : 7.11.38.234    2048 Bytes  06.08.2012 18:34:03
VBASE031.VDF  : 7.11.38.250    67072 Bytes  06.08.2012 18:34:03
Engineversion  : 8.2.10.126
AEVDF.DLL      : 8.1.2.10      102772 Bytes  10.07.2012 11:28:07
AESCRIPT.DLL  : 8.1.4.38      455033 Bytes  04.08.2012 09:50:39
AESCN.DLL      : 8.1.8.2      131444 Bytes  28.01.2012 08:03:05
AESBX.DLL      : 8.2.5.12      606578 Bytes  15.06.2012 18:50:02
AERDL.DLL      : 8.1.9.15      639348 Bytes  08.09.2011 21:16:06
AEPACK.DLL    : 8.3.0.18      807287 Bytes  27.07.2012 18:16:00
AEOFFICE.DLL  : 8.1.2.42      201083 Bytes  24.07.2012 08:31:48
AEHEUR.DLL    : 8.1.4.84    5112182 Bytes  04.08.2012 09:50:39
AEHELP.DLL    : 8.1.23.2      258422 Bytes  30.06.2012 08:53:13
AEGEN.DLL      : 8.1.5.34      434548 Bytes  24.07.2012 08:31:42
AEEXP.DLL      : 8.1.0.74      86387 Bytes  04.08.2012 09:50:40
AEEMU.DLL      : 8.1.3.2      393587 Bytes  10.07.2012 11:28:06
AECORE.DLL    : 8.1.27.2      201078 Bytes  10.07.2012 11:28:05
AEBB.DLL      : 8.1.1.0        53618 Bytes  01.09.2011 21:46:01
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  08.05.2012 09:08:13
AVPREF.DLL    : 12.3.0.15      51920 Bytes  08.05.2012 09:08:23
AVREP.DLL      : 12.3.0.15    179208 Bytes  09.05.2012 20:45:26
AVARKT.DLL    : 12.3.0.15    211408 Bytes  08.05.2012 09:08:19
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  08.05.2012 09:08:21
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  08.05.2012 09:08:37
AVSMTP.DLL    : 12.3.0.15      63440 Bytes  08.05.2012 09:08:24
NETNT.DLL      : 12.3.0.15      17104 Bytes  08.05.2012 09:08:35
RCIMAGE.DLL    : 12.3.0.15    4447952 Bytes  08.05.2012 09:08:15
RCTEXT.DLL    : 12.3.0.15      98512 Bytes  08.05.2012 09:08:15

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Dienstag, 7. August 2012  15:46

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxext.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'EgisUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxsrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'UIExec.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerTray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PLFSetI.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LManager.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'ForceField.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'PmmUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAAnotif.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Users\Engelmann\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\1c01299d-5fb5a2b7
  [0] Archivtyp: ZIP
  --> Atomic.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.BQ
  --> Fat.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.BT.3
  --> Oinc.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.BD
  --> Puk.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lama.AC.1
  --> Rami.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.BU.4
  --> Rode.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/5353.AI.5.A
  --> Secmui.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.BV.4.A
  --> Sinaval.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.BE
  --> Third.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2010-0840.CI.1
  --> Tomi.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.CH.2
  --> Vii.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.BT

Die Registry wurde durchsucht ( '1095' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Acer>
C:\Users\Engelmann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KSZTUZ8\IE9-win7[1].msu
  [WARNUNG]  Aus diesem Archiv können keine weiteren Dateien ausgepackt werden. Das Archiv wird geschlossen.
C:\Users\Engelmann\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KSZTUZ8\theme[1].zip
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Engelmann\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\1c01299d-5fb5a2b7
  [0] Archivtyp: ZIP
  --> Atomic.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.BQ
  --> Fat.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.BT.3
  --> Oinc.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.BD
  --> Puk.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lama.AC.1
  --> Rami.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.BU.4
  --> Rode.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/5353.AI.5.A
  --> Secmui.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.BV.4.A
  --> Sinaval.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.BE
  --> Third.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2010-0840.CI.1
  --> Tomi.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.CH.2
  --> Vii.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.BT
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.

Beginne mit der Desinfektion:
Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations> wurde erfolgreich entfernt.
C:\Users\Engelmann\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\1c01299d-5fb5a2b7
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/0507.BT.3
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55849e5b.qua' verschoben!
  [HINWEIS]  Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations> wurde erfolgreich repariert.
  [HINWEIS]  Der Registrierungseintrag <HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations> wurde erfolgreich repariert.


Ende des Suchlaufs: Dienstag, 7. August 2012  18:13
Benötigte Zeit:  2:21:14 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  19928 Verzeichnisse wurden überprüft
 297371 Dateien wurden geprüft
    24 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 297347 Dateien ohne Befall
  2667 Archive wurden durchsucht
      2 Warnungen
      1 Hinweise
defogger:

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 08:00 on 10/08/2012 (Engelmann)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
hier die logs von otl:

OTL Logfile:
Code:
OTL logfile created on: 10.08.2012 08:05:04 - Run 1
OTL by OldTimer - Version 3.2.56.0    Folder = C:\Users\Engelmann\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1013,10 Mb Total Physical Memory | 207,48 Mb Available Physical Memory | 20,48% Memory free
1,99 Gb Paging File | 0,65 Gb Available in Paging File | 32,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 219,78 Gb Total Space | 176,18 Gb Free Space | 80,16% Space Free | Partition Type: NTFS
 
Computer Name: ENGELMANN-PC | User Name: Engelmann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.10 08:04:26 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL.exe
PRC - [2012.08.08 20:34:27 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.05.22 08:38:56 | 000,160,872 | ---- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2012.05.08 11:08:37 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 11:08:24 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.08 11:08:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.03 14:10:02 | 002,446,872 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe
PRC - [2012.05.03 14:07:06 | 000,073,360 | ---- | M] (Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\zatray.exe
PRC - [2012.04.30 21:05:22 | 000,497,280 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe
PRC - [2012.04.30 21:04:28 | 000,738,944 | ---- | M] (Check Point Software Technologies) -- C:\Programme\CheckPoint\ZAForceField\ForceField.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.04.07 10:29:14 | 000,247,608 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.08 11:45:16 | 000,253,264 | ---- | M] () -- C:\Programme\1&1 Surf-Stick\AssistantServices.exe
PRC - [2010.12.08 11:45:16 | 000,139,088 | ---- | M] () -- C:\Programme\1&1 Surf-Stick\UIExec.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.06.05 21:44:12 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010.04.08 06:18:40 | 000,908,368 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LManager.exe
PRC - [2010.04.08 06:18:40 | 000,312,400 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\dsiwmis.exe
PRC - [2010.04.08 06:18:40 | 000,298,064 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LMworker.exe
PRC - [2010.04.01 09:26:44 | 000,027,224 | ---- | M] (Atheros Communications) -- C:\Programme\Bluetooth Suite\AdminService.exe
PRC - [2010.03.11 07:11:56 | 000,407,920 | ---- | M] (Egis Technology Inc.) -- C:\Programme\EgisTec IPS\PmmUpdate.exe
PRC - [2010.03.11 07:11:42 | 000,201,584 | ---- | M] (Egis Technology Inc.) -- C:\Programme\EgisTec IPS\EgisUpdate.exe
PRC - [2010.02.05 20:23:14 | 000,735,776 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe
PRC - [2010.02.05 20:23:14 | 000,715,296 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerTray.exe
PRC - [2010.02.05 20:23:12 | 000,469,536 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerEvent.exe
PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer VCM\RS_Service.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Registration\GREGsvc.exe
PRC - [2009.07.14 03:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe
PRC - [2009.06.05 04:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.12.08 11:45:16 | 000,139,088 | ---- | M] () -- C:\Programme\1&1 Surf-Stick\UIExec.exe
MOD - [2010.06.05 21:44:12 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
MOD - [2009.05.20 08:02:04 | 000,072,200 | ---- | M] () -- C:\Programme\Launch Manager\CdDirIo.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.08.05 11:34:57 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.04 13:18:42 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.08 11:08:37 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 11:08:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.03 14:10:02 | 002,446,872 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2012.04.30 21:05:22 | 000,497,280 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe -- (IswSvc)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.04.07 10:29:14 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.12.08 11:45:16 | 000,253,264 | ---- | M] () [Auto | Running] -- C:\Programme\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.04.17 07:56:48 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Programme\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.04.08 06:18:40 | 000,312,400 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Programme\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.04.01 09:26:44 | 000,027,224 | ---- | M] (Atheros Communications) [Auto | Running] -- C:\Programme\Bluetooth Suite\AdminService.exe -- (AtherosSvc)
SRV - [2010.02.05 20:23:14 | 000,735,776 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2006.10.26 23:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.05.08 11:08:39 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 11:08:39 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.30 21:05:40 | 000,027,016 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2012.01.09 18:59:32 | 000,468,272 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2012.01.09 18:59:30 | 000,133,208 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\kl1.sys -- (KL1)
DRV - [2012.01.09 18:59:30 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV - [2011.12.09 13:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.10.15 09:17:37 | 000,232,512 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011.05.07 18:51:28 | 000,455,256 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.04.21 09:47:36 | 000,068,208 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)
DRV - [2010.04.07 04:04:42 | 001,792,512 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010.03.30 19:15:44 | 000,047,144 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AthDfu.sys -- (ATHDFU)
DRV - [2010.03.30 19:11:24 | 000,230,952 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btfilter.sys -- (BtFilter)
DRV - [2010.03.30 19:11:18 | 000,048,168 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV - [2010.03.30 19:11:08 | 000,177,704 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV - [2010.03.30 19:11:00 | 000,038,440 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)
DRV - [2010.03.30 19:10:44 | 000,141,992 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV - [2010.03.30 19:10:30 | 000,257,064 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV - [2010.03.30 19:10:22 | 000,028,200 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)
DRV - [2010.03.02 08:23:36 | 000,082,384 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EUCR6SK.sys -- (EUCR)
DRV - [2009.10.29 20:28:24 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009.10.29 20:28:24 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009.10.29 20:28:24 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2009.10.29 20:28:24 | 000,009,216 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.06.03 04:15:40 | 000,060,976 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV - [2009.06.03 04:15:38 | 000,016,432 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2009.06.03 04:15:34 | 000,018,992 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008.03.17 11:05:30 | 000,101,632 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod260&r=27b51010n665l0454wwl5w56l2t541
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod260&r=27b51010n665l0454wwl5w56l2t541
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod260&r=27b51010n665l0454wwl5w56l2t541
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{3FA3C207-B09C-425C-BAA9-0412E405ABD3}: "URL" = hxxp://de.search.yahoo.com/search?fr=mcafee&p={SearchTerms}
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd_ut
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE403
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm-Sicherheit Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=2&q="
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2012.05.23 09:41:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.05 11:34:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.14 10:08:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.05 11:34:59 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.14 10:08:31 | 000,000,000 | ---D | M]
 
[2010.10.25 17:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Engelmann\AppData\Roaming\mozilla\Extensions
[2012.07.26 20:20:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Engelmann\AppData\Roaming\mozilla\Firefox\Profiles\8jkginwg.default\extensions
[2011.12.05 16:53:30 | 000,000,943 | ---- | M] () -- C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\conduit.xml
[2012.08.08 13:51:18 | 000,001,052 | ---- | M] () -- C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\icqplugin.xml
[2011.04.27 21:33:57 | 000,001,583 | ---- | M] () -- C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\web-search.xml
[2011.12.24 08:10:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.08.05 11:35:01 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files\mozilla firefox\components\Scriptff.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.04.02 08:07:24 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.02 08:07:24 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.04.02 08:07:24 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.02 08:07:24 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.01.05 14:39:24 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2012.04.02 08:07:24 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.02 08:07:24 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - No CLSID value found.
O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [UIExec] C:\Program Files\1&1 Surf-Stick\UIExec.exe ()
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D69447C-F67C-49F5-8C98-406F015C4C1E}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\Shell - "" = AutoRun
O33 - MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.10 08:03:45 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL.exe
[2012.08.08 08:30:36 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\AppData\Roaming\Malwarebytes
[2012.08.08 08:30:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.08 08:30:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.08 08:30:07 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.08 08:30:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.07 18:29:12 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Engelmann\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.06 10:26:00 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\Desktop\Windows XP Professional (German)
[2012.08.06 10:00:27 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\AppData\Roaming\e-academy Inc
[2012.08.06 10:00:27 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\AppData\Local\e-academy Inc
[1 C:\Users\Engelmann\Desktop\*.tmp files -> C:\Users\Engelmann\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.10 08:18:08 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.10 08:04:26 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL.exe
[2012.08.10 08:01:54 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.10 08:00:53 | 000,000,000 | ---- | M] () -- C:\Users\Engelmann\defogger_reenable
[2012.08.10 07:59:57 | 000,050,477 | ---- | M] () -- C:\Users\Engelmann\Desktop\Defogger.exe
[2012.08.10 07:56:27 | 000,029,556 | ---- | M] () -- C:\Users\Engelmann\Desktop\avira update.png
[2012.08.10 07:56:11 | 000,019,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 07:56:11 | 000,019,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 07:47:42 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.10 07:46:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.10 07:46:00 | 796,733,440 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.08 08:30:13 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.07 18:30:06 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Engelmann\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.06 10:02:52 | 000,000,183 | ---- | M] () -- C:\Users\Engelmann\Desktop\100097109516.sdx
[2012.08.06 10:00:28 | 000,003,167 | ---- | M] () -- C:\Users\Engelmann\Desktop\Secure Download Manager.lnk
[2012.08.06 09:56:59 | 000,718,336 | ---- | M] () -- C:\Users\Engelmann\Desktop\SDM_DE.msi
[2012.08.01 20:25:07 | 000,909,754 | ---- | M] () -- C:\Users\Engelmann\Desktop\VL9_Trends_in_der_Logistik.pdf
[2012.07.24 14:51:06 | 000,654,400 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.24 14:51:06 | 000,616,242 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.24 14:51:06 | 000,130,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.24 14:51:06 | 000,106,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.14 20:59:23 | 000,332,824 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Users\Engelmann\Desktop\*.tmp files -> C:\Users\Engelmann\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.10 08:00:53 | 000,000,000 | ---- | C] () -- C:\Users\Engelmann\defogger_reenable
[2012.08.10 07:59:23 | 000,050,477 | ---- | C] () -- C:\Users\Engelmann\Desktop\Defogger.exe
[2012.08.10 07:56:26 | 000,029,556 | ---- | C] () -- C:\Users\Engelmann\Desktop\avira update.png
[2012.08.08 08:30:13 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.06 10:01:06 | 000,000,183 | ---- | C] () -- C:\Users\Engelmann\Desktop\100097109516.sdx
[2012.08.06 10:00:28 | 000,003,167 | ---- | C] () -- C:\Users\Engelmann\Desktop\Secure Download Manager.lnk
[2012.08.06 09:56:14 | 000,718,336 | ---- | C] () -- C:\Users\Engelmann\Desktop\SDM_DE.msi
[2012.08.01 20:25:07 | 000,909,754 | ---- | C] () -- C:\Users\Engelmann\Desktop\VL9_Trends_in_der_Logistik.pdf
[2012.06.17 11:28:22 | 000,007,623 | ---- | C] () -- C:\Users\Engelmann\AppData\Local\Resmon.ResmonCfg
[2011.06.29 13:56:00 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.10.25 17:37:07 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.05.03 05:26:42 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2012.05.07 08:34:15 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\CheckPoint
[2011.04.13 11:35:19 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\DAEMON Tools Lite
[2012.08.06 10:00:27 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\e-academy Inc
[2012.01.12 16:55:44 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\ICQ
[2012.04.24 21:46:21 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\LolClient
[2012.06.19 15:47:43 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\pdfforge
[2010.10.26 17:11:40 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Vodafone
[2012.06.06 16:14:23 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:AB689DEA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:93DE1838
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E36F5B57
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E1F04E8D
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0B9176C0
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:4D066AD2

< End of report >
--- --- ---


OTL Logfile:
Code:
OTL Extras logfile created on: 10.08.2012 08:05:04 - Run 1
OTL by OldTimer - Version 3.2.56.0    Folder = C:\Users\Engelmann\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1013,10 Mb Total Physical Memory | 207,48 Mb Available Physical Memory | 20,48% Memory free
1,99 Gb Paging File | 0,65 Gb Available in Paging File | 32,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 219,78 Gb Total Space | 176,18 Gb Free Space | 80,16% Space Free | Partition Type: NTFS
 
Computer Name: ENGELMANN-PC | User Name: Engelmann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04DCA562-E09F-4950-9FDC-6DB114014027}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2AEF2929-4D32-4F73-A412-B4C79E2B11B9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{3D44265B-978C-41C8-A5CF-C3361BDD6EE0}" = lport=57301 | protocol=17 | dir=in | name=pando media booster |
"{8A4D3C54-8FF9-4D6E-9E12-A8209C61C976}" = lport=57301 | protocol=17 | dir=in | name=pando media booster |
"{A87BDA7A-D207-4EF3-915C-642CBA79A455}" = lport=57301 | protocol=6 | dir=in | name=pando media booster |
"{F39AFBDB-A077-4290-9C73-F809DF7D6BF5}" = lport=57301 | protocol=6 | dir=in | name=pando media booster |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0003FD70-F56A-4F4C-B0EE-70698A911418}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{013F2B5A-13E2-400A-BF67-61F85A337DA3}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{01BB92E4-8EE9-4524-ACFC-A581E91BFC75}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{033A4880-205D-44ED-89FB-263577F8E934}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{06887E16-6D70-47DF-A706-C894DD13C1E8}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{12BEA766-D265-4AC0-81D6-884B2322A668}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{1C7C84A3-84C7-49B7-A38C-290D84D4738C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{2A946F55-0BBD-4117-80C2-4953315F98D9}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{2F59C8E2-ECC1-45B2-AC49-2AF97C8786F0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{310D9817-70BF-4D7C-8EEB-C2CCB3FC94D8}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{37F5AA0F-9B85-4B75-93E9-D82397073E53}" = dir=in | app=c:\program files\acer\acer vcm\rs_service.exe |
"{47E92B87-136C-4B27-B375-FD61A7E40EB4}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{55B2A60B-3C1E-4357-8B5A-EF0623C3756E}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe |
"{592FDD14-B32F-4A98-9FDF-05E02F83163D}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{6627EACD-EAD3-4895-95C5-A3D4A3E2C48C}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{6F655821-EEEA-4634-B9DE-C193E5C15F02}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{86F997AB-8C6C-4AC7-9E80-E7FE96EC492C}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{8E307C5D-9E94-4AAD-82FA-50377C0D0810}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{9537D01D-8888-462F-BCDB-43964F1BB932}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{96227849-5CC3-4B54-A372-7AC568ABB935}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{97C7CD57-B889-4A5C-A88F-119B30B663AF}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{9F97B7BC-FEB3-4F62-AAB3-142A53A301C9}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{A40FE211-10B0-4B05-AAF1-A65A0161B44F}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{B14A5DAC-6577-4FF7-8E86-0FBEF039A64C}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{D4ABB8E1-167D-4E05-8CDD-1E88C51C5A3F}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{F45D1766-41DA-4E4C-B452-CF7D08367E7E}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{101A497C-7EF6-4001-834D-E5FA1C70FEFA}" = Bluetooth Win7 Suite
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 26
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2D13FC7D-42A8-4BF1-AF0C-B3DC68C59448}_is1" = Atheros_7.0.2.13_patch2_32
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AD62673-EBC3-4DAC-961C-73EB35F03A72}_is1" = Atheros BT update 32
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5884CB45-C54B-4550-BAD5-3E060FD75D17}" = ZoneAlarm Firewall
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{62F7DA7E-CCCB-439C-A760-00C3926E761F}" = Microsoft Works
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.6.0
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}" = Chicken Invaders 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110300453}" = Spin & Win
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}" = Granny In Paradise
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}" = Amazonia
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}" = Heroes of Hellas
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2007
"{90120000-0017-0407-0000-0000000FF1CE}_OMUI.de-de_{2733AA87-26FC-41B0-9D2F-3092345BC370}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_GROOVE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_OMUI.de-de_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_PRJPRO_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_GROOVE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_OMUI.de-de_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_PRJPRO_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_GROOVE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_OMUI.de-de_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_PRJPRO_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_GROOVE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_OMUI.de-de_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_PRJPRO_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2007
"{90120000-003B-0000-0000-0000000FF1CE}_PRJPRO_{8446EB22-A746-46DC-B1BD-E0DFA1F3CDDA}" = Microsoft Office Project 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_GROOVE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_OMUI.de-de_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_PRJPRO_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00B4-0407-0000-0000000FF1CE}" = Microsoft Office Project MUI (German) 2007
"{90120000-00B4-0407-0000-0000000FF1CE}_PRJPRO_{C8D442F2-CF33-486E-8079-A704A2E80A39}" = Microsoft Office Project 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_GROOVE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2007
"{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2007
"{90120000-0101-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9268B41D-6045-4F5F-A14E-3F8E51CD2666}" = Secure Download Manager
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3E8FC19-2107-49DA-967F-23E1B5210D9C}" = ZoneAlarm Security
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = 1&1 Surf-Stick
"{ABEE079E-648E-488B-8301-0C3DB48C1BCE}_is1" = Acer GameZone Console
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.5.1 MUI
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}" = Acer Crystal Eye webcam Ver:1.1.143.1229
"{D3A80508-CD83-4CA3-8671-914A1BC78B61}" = Microsoft Sync Framework 2.0 Provider Services (x86) ENU
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F012A635-8E2C-4AF2-BD46-C508D00289B2}" = ZoneAlarm Antivirus
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF63121D-91C6-42CC-B341-F1AA729728E7}" = Microsoft Sync Framework 2.0 Core Components (x86) ENU
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"DAEMON Tools Lite" = DAEMON Tools Lite
"F3C7F6463C419D1D216961B5B81E2FE534986562" = ENE USB Card Reader Driver
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"Identity Card" = Identity Card
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OMUI.de-de" = Microsoft Office Language Pack 2007 - German/Deutsch
"PIXO RESCUE_is1" = PIXO RESCUE Version 1.0
"PRJPRO" = Microsoft Office Project Professional 2007
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinLiveSuite_Wave3" = Windows Live Essentials
"ZoneAlarm Free Antivirus + Firewall" = ZoneAlarm Free Antivirus + Firewall
"ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 20.11.2011 17:00:58 | Computer Name = Engelmann-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 20.11.2011 17:03:24 | Computer Name = Engelmann-PC | Source = VSS | ID = 8194
Description =
 
Error - 21.11.2011 17:35:18 | Computer Name = Engelmann-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 21.11.2011 17:37:48 | Computer Name = Engelmann-PC | Source = VSS | ID = 8194
Description =
 
Error - 21.11.2011 19:51:59 | Computer Name = Engelmann-PC | Source = VMCService | ID = 0
Description = System.Runtime.InteropServices.COMException (0x80080005)    bei System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)    bei System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()

  bei System.Management.ManagementObjectCollection.get_Count()    bei VMC.WindowsService.Core.WMIClasses.GetLoggedOnUser_Orig(String&
 domain, String& user)    bei VMC.WindowsService.Core.WindowsServiceCore.DeviceEvent_Orig()

  bei VMC.WindowsService.Core.WindowsServiceCore.Checking()
 
Error - 22.11.2011 05:59:28 | Computer Name = Engelmann-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 22.11.2011 06:02:08 | Computer Name = Engelmann-PC | Source = VSS | ID = 8194
Description =
 
Error - 22.11.2011 06:55:31 | Computer Name = Engelmann-PC | Source = VMCService | ID = 0
Description = System.Runtime.InteropServices.COMException (0x80080005)    bei System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
 errorCode, IntPtr errorInfo)    bei System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()

  bei System.Management.ManagementObjectCollection.get_Count()    bei VMC.WindowsService.Core.WMIClasses.GetLoggedOnUser_Orig(String&
 domain, String& user)    bei VMC.WindowsService.Core.WindowsServiceCore.DeviceEvent_Orig()

  bei VMC.WindowsService.Core.WindowsServiceCore.Checking()
 
Error - 22.11.2011 15:45:58 | Computer Name = Engelmann-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue
 
Error - 22.11.2011 15:48:24 | Computer Name = Engelmann-PC | Source = VSS | ID = 8194
Description =
 
[ OSession Events ]
Error - 24.11.2010 10:29:56 | Computer Name = Engelmann-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session
lasted 6537 seconds with 3720 seconds of active time.  This session ended with a
 crash.
 
[ System Events ]
Error - 07.08.2012 15:39:45 | Computer Name = Engelmann-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst ShellHWDetection erreicht.
 
Error - 08.08.2012 02:13:17 | Computer Name = Engelmann-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 08.08.2012 07:48:24 | Computer Name = Engelmann-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst ShellHWDetection erreicht.
 
Error - 08.08.2012 14:17:05 | Computer Name = Engelmann-PC | Source = DCOM | ID = 10005
Description =
 
Error - 08.08.2012 14:17:05 | Computer Name = Engelmann-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Google Update Service (gupdate)" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%109
 
Error - 09.08.2012 14:46:52 | Computer Name = Engelmann-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
Error - 09.08.2012 14:50:10 | Computer Name = Engelmann-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows Media Player-Netzwerkfreigabedienst erreicht.
 
Error - 09.08.2012 14:50:10 | Computer Name = Engelmann-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund
 folgenden Fehlers nicht gestartet:  %%1053
 
Error - 09.08.2012 16:57:24 | Computer Name = Engelmann-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
 von Dienst Netman erreicht.
 
Error - 10.08.2012 01:46:23 | Computer Name = Engelmann-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden.    Modulpfad:
 C:\Windows\system32\athExt.dll  Fehlercode: 126 
 
 
< End of report >
--- --- ---


von gmer kann nich leider nix zeigen, da es probleme beim scan gibt. ich hab es dreimal veruscht. beim ersten und dritten mal kam eine fehlermeldung (siehe anhang), beim zweiten versuch ist das netbook eingefroren.

ich hab aber malwarebytes durchlaufen lasse, allerdings schon vor defogger, otl und dem gmer-versuch. dabei wurde ein infiziertes objekt gefunden, hab ich in die quarantäne verschoben.

hier das log:
Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.08.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Engelmann :: ENGELMANN-PC [Administrator]

Schutz: Aktiviert

08.08.2012 08:33:31
mbam-log-2012-08-08 (10-40-32).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 286566
Laufzeit: 2 Stunde(n), 1 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\$Recycle.Bin\S-1-5-21-3419424104-2474502219-4126263772-1000\$RMGWLDG.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt.

(Ende)
ich hoffe ihr könnt mir helfen, vielen dank schonmal im vorraus.

cosinus 14.08.2012 16:26
Ist das ein Zweit-PC von dir? => http://www.trojaner-board.de/121246-...tml#post883357

:wtf:

Code:
(Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe
ZoneAlarm bitte umgehend deinstallieren

fux89 14.08.2012 16:51
Zitat:
Zitat von cosinus (Beitrag 892181)
Ist das ein Zweit-PC von dir? => http://www.trojaner-board.de/121246-...tml#post883357

:wtf:
ja -.-
ich weis auch nich, jahre lang ohne probleme unterwegs und dann kommt alles auf einmal^^

Zitat:
Code:
(Check Point Software Technologies LTD) -- C:\Programme\CheckPoint\ZoneAlarm\vsmon.exe
ZoneAlarm bitte umgehend deinstallieren
ist erledigt

cosinus 14.08.2012 17:09
Bitte nun routinemäßig einen neuen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

fux89 15.08.2012 00:34
hier das neue log von malwarybytes:

Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.14.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Engelmann :: ENGELMANN-PC [Administrator]

Schutz: Aktiviert

14.08.2012 19:31:37
mbam-log-2012-08-14 (19-31-37).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 286522
Laufzeit: 1 Stunde(n), 25 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\$Recycle.Bin\S-1-5-21-3419424104-2474502219-4126263772-1000\$RMGWLDG.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
und das ergebnis von eset:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=18e3ca75f5cf2d4297efcfe9725d47ab
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-14 09:50:44
# local_time=2012-08-14 11:50:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 21383967 21383967 0 0
# compatibility_mode=5893 16776574 100 94 8361 96603934 0 0
# compatibility_mode=8192 67108863 100 0 1257 1257 0 0
# scanned=110474
# found=0
# cleaned=0
# scan_time=8302

cosinus 15.08.2012 13:42
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

fux89 15.08.2012 18:07
das kam dabei raus:

Code:
# AdwCleaner v1.801 - Logfile created 08/15/2012 at 19:05:39
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : Engelmann - ENGELMANN-PC
# Boot Mode : Normal
# Running from : C:\Users\Engelmann\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\ENGELM~1\AppData\Local\Temp\boost_interprocess
Folder Found : C:\Users\Engelmann\AppData\LocalLow\Conduit
Folder Found : C:\Users\Engelmann\AppData\Roaming\pdfforge
Folder Found : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\ConduitCommon
Folder Found : C:\ProgramData\boost_interprocess
Folder Found : C:\ProgramData\Partner
File Found : C:\Users\ENGELM~1\AppData\Local\Temp\Uninstall.exe
File Found : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\Conduit.xml
File Found : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\web-search.xml

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2613550
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\Softonic

***** [Registre - GUID] *****

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\prefs.js

Found : user_pref("CT2613550..clientLogIsEnabled", true);
Found : user_pref("CT2613550..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT2613550..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT2613550.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT2613550.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT2613550.CTID", "CT2613550");
Found : user_pref("CT2613550.CurrentServerDate", "12-12-2011");
Found : user_pref("CT2613550.DSInstall", true);
Found : user_pref("CT2613550.DialogsAlignMode", "LTR");
Found : user_pref("CT2613550.DialogsGetterLastCheckTime", "Sun Dec 11 2011 23:02:59 GMT+0100");
Found : user_pref("CT2613550.DownloadReferralCookieData", "");
Found : user_pref("CT2613550.EMailNotifierPollDate", "Sun Dec 11 2011 23:02:58 GMT+0100");
Found : user_pref("CT2613550.FirstServerDate", "12-12-2011");
Found : user_pref("CT2613550.FirstTime", true);
Found : user_pref("CT2613550.FirstTimeFF3", true);
Found : user_pref("CT2613550.FixPageNotFoundErrors", true);
Found : user_pref("CT2613550.GroupingServerCheckInterval", 1440);
Found : user_pref("CT2613550.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT2613550.HPInstall", false);
Found : user_pref("CT2613550.HasUserGlobalKeys", true);
Found : user_pref("CT2613550.HomePageProtectorEnabled", false);
Found : user_pref("CT2613550.HomepageBeforeUnload", "www.google.de");
Found : user_pref("CT2613550.Initialize", true);
Found : user_pref("CT2613550.InitializeCommonPrefs", true);
Found : user_pref("CT2613550.InstallationAndCookieDataSentCount", 1);
Found : user_pref("CT2613550.InstallationType", "UnknownIntegration");
Found : user_pref("CT2613550.InstalledDate", "Sun Dec 11 2011 23:03:03 GMT+0100");
Found : user_pref("CT2613550.IsGrouping", false);
Found : user_pref("CT2613550.IsInitSetupIni", true);
Found : user_pref("CT2613550.IsMulticommunity", false);
Found : user_pref("CT2613550.IsOpenThankYouPage", false);
Found : user_pref("CT2613550.IsOpenUninstallPage", true);
Found : user_pref("CT2613550.IsProtectorsInit", true);
Found : user_pref("CT2613550.LanguagePackLastCheckTime", "Sun Dec 11 2011 23:03:03 GMT+0100");
Found : user_pref("CT2613550.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT2613550.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT2613550.LastLogin_3.8.1.0", "Sun Dec 11 2011 23:03:04 GMT+0100");
Found : user_pref("CT2613550.LatestVersion", "3.8.1.0");
Found : user_pref("CT2613550.Locale", "de-de");
Found : user_pref("CT2613550.MCDetectTooltipHeight", "83");
Found : user_pref("CT2613550.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2613550.MCDetectTooltipWidth", "295");
Found : user_pref("CT2613550.MyStuffEnabledAtInstallation", false);
Found : user_pref("CT2613550.OriginalFirstVersion", "3.8.1.0");
Found : user_pref("CT2613550.SearchCaption", "ZoneAlarm-Sicherheit Customized Web Search");
Found : user_pref("CT2613550.SearchEngineBeforeUnload", "ZoneAlarm-Sicherheit Customized Web Search");
Found : user_pref("CT2613550.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2613550.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT261[...]
Found : user_pref("CT2613550.SearchInNewTabEnabled", true);
Found : user_pref("CT2613550.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT2613550.SearchInNewTabLastCheckTime", "Sun Dec 11 2011 23:03:04 GMT+0100");
Found : user_pref("CT2613550.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT2613550.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Found : user_pref("CT2613550.SearchProtectorEnabled", true);
Found : user_pref("CT2613550.SearchProtectorToolbarDisabled", false);
Found : user_pref("CT2613550.SendProtectorDataViaLogin", true);
Found : user_pref("CT2613550.ServiceMapLastCheckTime", "Sun Dec 11 2011 23:02:57 GMT+0100");
Found : user_pref("CT2613550.SettingsLastCheckTime", "Sun Dec 11 2011 23:02:57 GMT+0100");
Found : user_pref("CT2613550.SettingsLastUpdate", "1321973076");
Found : user_pref("CT2613550.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13");
Found : user_pref("CT2613550.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT2613550.ThirdPartyComponentsLastCheck", "Sun Dec 11 2011 23:02:57 GMT+0100");
Found : user_pref("CT2613550.ThirdPartyComponentsLastUpdate", "1255344657");
Found : user_pref("CT2613550.ToolbarShrinkedFromSetup", false);
Found : user_pref("CT2613550.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2613550");
Found : user_pref("CT2613550.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Found : user_pref("CT2613550.UserID", "UN03572800424797751");
Found : user_pref("CT2613550.alertChannelId", "1006347");
Found : user_pref("CT2613550.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Found : user_pref("CT2613550.globalFirstTimeInfoLastCheckTime", "Sun Dec 11 2011 23:03:00 GMT+0100");
Found : user_pref("CT2613550.homepageProtectorEnableByLogin", true);
Found : user_pref("CT2613550.initDone", true);
Found : user_pref("CT2613550.isAppTrackingManagerOn", true);
Found : user_pref("CT2613550.myStuffEnabled", true);
Found : user_pref("CT2613550.myStuffPublihserMinWidth", 400);
Found : user_pref("CT2613550.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT2613550.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT2613550.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT2613550.revertSettingsEnabled", true);
Found : user_pref("CT2613550.searchProtectorDialogDelayInSec", 10);
Found : user_pref("CT2613550.searchProtectorEnableByLogin", true);
Found : user_pref("CT2613550.testingCtid", "");
Found : user_pref("CT2613550.toolbarAppMetaDataLastCheckTime", "Sun Dec 11 2011 23:02:58 GMT+0100");
Found : user_pref("CT2613550.toolbarContextMenuLastCheckTime", "Sun Dec 11 2011 23:03:03 GMT+0100");
Found : user_pref("CT2613550.usagesFlag", 1);
Found : user_pref("CommunityToolbar.ConduitSearchList", "ZoneAlarm-Sicherheit Customized Web Search");
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2613550/CT2613550[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2613550", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2613550",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/50/261/CT2613550/Images/6340849712463612[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"[...]
Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Engelmann\\AppData\\Roaming\\Mozill[...]
Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.8.1.0");
Found : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.icq.com/search/afe_results[...]
Found : user_pref("CommunityToolbar.ToolbarsList", "CT2613550");
Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2613550");
Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2613550");
Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Dec 11 2011 23:03:03 GMT+0100");
Found : user_pref("CommunityToolbar.globalUserId", "747f393e-93a3-4a06-83c3-055f996e4558");
Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2613550");
Found : user_pref("CommunityToolbar.originalHomepage", "www.google.de");
Found : user_pref("CommunityToolbar.originalSearchEngine", "Google");
Found : user_pref("browser.search.defaultthis.engineName", "ZoneAlarm-Sicherheit Customized Web Search");
Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&Sea[...]
Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=2&q=[...]

*************************

AdwCleaner[R1].txt - [10978 octets] - [15/08/2012 19:05:39]

########## EOF - C:\AdwCleaner[R1].txt - [11107 octets] ##########

cosinus 16.08.2012 08:27
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

fux89 16.08.2012 08:42
hier das ergebnis:

Code:
# AdwCleaner v1.801 - Logfile created 08/16/2012 at 09:38:25
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (32 bits)
# User : Engelmann - ENGELMANN-PC
# Boot Mode : Normal
# Running from : C:\Users\Engelmann\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\ENGELM~1\AppData\Local\Temp\boost_interprocess
Folder Deleted : C:\Users\Engelmann\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Engelmann\AppData\Roaming\pdfforge
Folder Deleted : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\ConduitCommon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\ProgramData\Partner
File Deleted : C:\Users\ENGELM~1\AppData\Local\Temp\Uninstall.exe
File Deleted : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\Conduit.xml
File Deleted : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\web-search.xml

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2613550
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\Softonic

***** [Registre - GUID] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\prefs.js

Deleted : user_pref("CT2613550..clientLogIsEnabled", true);
Deleted : user_pref("CT2613550..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2613550..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2613550.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2613550.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2613550.CTID", "CT2613550");
Deleted : user_pref("CT2613550.CurrentServerDate", "12-12-2011");
Deleted : user_pref("CT2613550.DSInstall", true);
Deleted : user_pref("CT2613550.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2613550.DialogsGetterLastCheckTime", "Sun Dec 11 2011 23:02:59 GMT+0100");
Deleted : user_pref("CT2613550.DownloadReferralCookieData", "");
Deleted : user_pref("CT2613550.EMailNotifierPollDate", "Sun Dec 11 2011 23:02:58 GMT+0100");
Deleted : user_pref("CT2613550.FirstServerDate", "12-12-2011");
Deleted : user_pref("CT2613550.FirstTime", true);
Deleted : user_pref("CT2613550.FirstTimeFF3", true);
Deleted : user_pref("CT2613550.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2613550.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2613550.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2613550.HPInstall", false);
Deleted : user_pref("CT2613550.HasUserGlobalKeys", true);
Deleted : user_pref("CT2613550.HomePageProtectorEnabled", false);
Deleted : user_pref("CT2613550.HomepageBeforeUnload", "www.google.de");
Deleted : user_pref("CT2613550.Initialize", true);
Deleted : user_pref("CT2613550.InitializeCommonPrefs", true);
Deleted : user_pref("CT2613550.InstallationAndCookieDataSentCount", 1);
Deleted : user_pref("CT2613550.InstallationType", "UnknownIntegration");
Deleted : user_pref("CT2613550.InstalledDate", "Sun Dec 11 2011 23:03:03 GMT+0100");
Deleted : user_pref("CT2613550.IsGrouping", false);
Deleted : user_pref("CT2613550.IsInitSetupIni", true);
Deleted : user_pref("CT2613550.IsMulticommunity", false);
Deleted : user_pref("CT2613550.IsOpenThankYouPage", false);
Deleted : user_pref("CT2613550.IsOpenUninstallPage", true);
Deleted : user_pref("CT2613550.IsProtectorsInit", true);
Deleted : user_pref("CT2613550.LanguagePackLastCheckTime", "Sun Dec 11 2011 23:03:03 GMT+0100");
Deleted : user_pref("CT2613550.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2613550.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2613550.LastLogin_3.8.1.0", "Sun Dec 11 2011 23:03:04 GMT+0100");
Deleted : user_pref("CT2613550.LatestVersion", "3.8.1.0");
Deleted : user_pref("CT2613550.Locale", "de-de");
Deleted : user_pref("CT2613550.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2613550.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2613550.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2613550.MyStuffEnabledAtInstallation", false);
Deleted : user_pref("CT2613550.OriginalFirstVersion", "3.8.1.0");
Deleted : user_pref("CT2613550.SearchCaption", "ZoneAlarm-Sicherheit Customized Web Search");
Deleted : user_pref("CT2613550.SearchEngineBeforeUnload", "ZoneAlarm-Sicherheit Customized Web Search");
Deleted : user_pref("CT2613550.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2613550.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT261[...]
Deleted : user_pref("CT2613550.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2613550.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2613550.SearchInNewTabLastCheckTime", "Sun Dec 11 2011 23:03:04 GMT+0100");
Deleted : user_pref("CT2613550.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2613550.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Deleted : user_pref("CT2613550.SearchProtectorEnabled", true);
Deleted : user_pref("CT2613550.SearchProtectorToolbarDisabled", false);
Deleted : user_pref("CT2613550.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT2613550.ServiceMapLastCheckTime", "Sun Dec 11 2011 23:02:57 GMT+0100");
Deleted : user_pref("CT2613550.SettingsLastCheckTime", "Sun Dec 11 2011 23:02:57 GMT+0100");
Deleted : user_pref("CT2613550.SettingsLastUpdate", "1321973076");
Deleted : user_pref("CT2613550.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13");
Deleted : user_pref("CT2613550.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2613550.ThirdPartyComponentsLastCheck", "Sun Dec 11 2011 23:02:57 GMT+0100");
Deleted : user_pref("CT2613550.ThirdPartyComponentsLastUpdate", "1255344657");
Deleted : user_pref("CT2613550.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2613550.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2613550");
Deleted : user_pref("CT2613550.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2613550.UserID", "UN03572800424797751");
Deleted : user_pref("CT2613550.alertChannelId", "1006347");
Deleted : user_pref("CT2613550.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2613550.globalFirstTimeInfoLastCheckTime", "Sun Dec 11 2011 23:03:00 GMT+0100");
Deleted : user_pref("CT2613550.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2613550.initDone", true);
Deleted : user_pref("CT2613550.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2613550.myStuffEnabled", true);
Deleted : user_pref("CT2613550.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2613550.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2613550.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2613550.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2613550.revertSettingsEnabled", true);
Deleted : user_pref("CT2613550.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2613550.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2613550.testingCtid", "");
Deleted : user_pref("CT2613550.toolbarAppMetaDataLastCheckTime", "Sun Dec 11 2011 23:02:58 GMT+0100");
Deleted : user_pref("CT2613550.toolbarContextMenuLastCheckTime", "Sun Dec 11 2011 23:03:03 GMT+0100");
Deleted : user_pref("CT2613550.usagesFlag", 1);
Deleted : user_pref("CommunityToolbar.ConduitSearchList", "ZoneAlarm-Sicherheit Customized Web Search");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2613550/CT2613550[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2613550", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2613550",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/50/261/CT2613550/Images/6340849712463612[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Engelmann\\AppData\\Roaming\\Mozill[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.8.1.0");
Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "hxxp://search.icq.com/search/afe_results[...]
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2613550");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2613550");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2613550");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Sun Dec 11 2011 23:03:03 GMT+0100");
Deleted : user_pref("CommunityToolbar.globalUserId", "747f393e-93a3-4a06-83c3-055f996e4558");
Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2613550");
Deleted : user_pref("CommunityToolbar.originalHomepage", "www.google.de");
Deleted : user_pref("CommunityToolbar.originalSearchEngine", "Google");
Deleted : user_pref("browser.search.defaultthis.engineName", "ZoneAlarm-Sicherheit Customized Web Search");
Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&Sea[...]
Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=2&q=[...]

*************************

AdwCleaner[R1].txt - [11109 octets] - [15/08/2012 19:05:39]
AdwCleaner[S1].txt - [11293 octets] - [16/08/2012 09:38:25]

########## EOF - C:\AdwCleaner[S1].txt - [11422 octets] ##########

cosinus 16.08.2012 10:55
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

fux89 16.08.2012 13:15
es läuft alles so wie sonst auch, also keinerleich beeinträchtigungenen und es fehlen auch keine dateien oder ordner. scheint soweit alles ok zu sein

cosinus 16.08.2012 14:11
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

fux89 16.08.2012 17:09
das neue otl-log:

OTL Logfile:
Code:
OTL logfile created on: 16.08.2012 17:07:10 - Run 2
OTL by OldTimer - Version 3.2.57.0    Folder = C:\Users\Engelmann\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1013,10 Mb Total Physical Memory | 340,18 Mb Available Physical Memory | 33,58% Memory free
1,99 Gb Paging File | 1,03 Gb Available in Paging File | 51,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 219,78 Gb Total Space | 176,95 Gb Free Space | 80,51% Space Free | Partition Type: NTFS
 
Computer Name: ENGELMANN-PC | User Name: Engelmann | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.16 17:05:56 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL(1).exe
PRC - [2012.08.08 20:34:27 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.05.22 08:38:56 | 000,160,872 | ---- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2012.05.08 11:08:37 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 11:08:24 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.08 11:08:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.04.07 10:29:14 | 000,247,608 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.12.08 11:45:16 | 000,253,264 | ---- | M] () -- C:\Programme\1&1 Surf-Stick\AssistantServices.exe
PRC - [2010.12.08 11:45:16 | 000,139,088 | ---- | M] () -- C:\Programme\1&1 Surf-Stick\UIExec.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.06.05 21:44:12 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010.04.08 06:18:40 | 000,908,368 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LManager.exe
PRC - [2010.04.08 06:18:40 | 000,312,400 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\dsiwmis.exe
PRC - [2010.04.08 06:18:40 | 000,298,064 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LMworker.exe
PRC - [2010.04.01 09:26:44 | 000,027,224 | ---- | M] (Atheros Communications) -- C:\Programme\Bluetooth Suite\AdminService.exe
PRC - [2010.03.11 07:11:56 | 000,407,920 | ---- | M] (Egis Technology Inc.) -- C:\Programme\EgisTec IPS\PmmUpdate.exe
PRC - [2010.03.11 07:11:42 | 000,201,584 | ---- | M] (Egis Technology Inc.) -- C:\Programme\EgisTec IPS\EgisUpdate.exe
PRC - [2010.02.05 20:23:14 | 000,735,776 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe
PRC - [2010.02.05 20:23:14 | 000,715,296 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerTray.exe
PRC - [2010.02.05 20:23:12 | 000,469,536 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerEvent.exe
PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer VCM\RS_Service.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Registration\GREGsvc.exe
PRC - [2009.06.05 04:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.12.08 11:45:16 | 000,139,088 | ---- | M] () -- C:\Programme\1&1 Surf-Stick\UIExec.exe
MOD - [2010.06.05 21:44:12 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
MOD - [2009.05.20 08:02:04 | 000,072,200 | ---- | M] () -- C:\Programme\Launch Manager\CdDirIo.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.08.15 20:18:47 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.05 11:34:57 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.05.08 11:08:37 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 11:08:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.04.07 10:29:14 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.12.08 11:45:16 | 000,253,264 | ---- | M] () [Auto | Running] -- C:\Programme\1&1 Surf-Stick\AssistantServices.exe -- (UI Assistant Service)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.04.17 07:56:48 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Programme\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010.04.08 06:18:40 | 000,312,400 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Programme\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.04.01 09:26:44 | 000,027,224 | ---- | M] (Atheros Communications) [Auto | Running] -- C:\Programme\Bluetooth Suite\AdminService.exe -- (AtherosSvc)
SRV - [2010.02.05 20:23:14 | 000,735,776 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.06.05 04:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON)
SRV - [2006.10.26 23:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.05.08 11:08:39 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 11:08:39 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.09 13:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.10.15 09:17:37 | 000,232,512 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.04.21 09:47:36 | 000,068,208 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)
DRV - [2010.04.07 04:04:42 | 001,792,512 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2010.03.30 19:15:44 | 000,047,144 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AthDfu.sys -- (ATHDFU)
DRV - [2010.03.30 19:11:24 | 000,230,952 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btfilter.sys -- (BtFilter)
DRV - [2010.03.30 19:11:18 | 000,048,168 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV - [2010.03.30 19:11:08 | 000,177,704 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV - [2010.03.30 19:11:00 | 000,038,440 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)
DRV - [2010.03.30 19:10:44 | 000,141,992 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV - [2010.03.30 19:10:30 | 000,257,064 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV - [2010.03.30 19:10:22 | 000,028,200 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)
DRV - [2010.03.02 08:23:36 | 000,082,384 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EUCR6SK.sys -- (EUCR)
DRV - [2009.10.29 20:28:24 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2009.10.29 20:28:24 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2009.10.29 20:28:24 | 000,105,088 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2009.10.29 20:28:24 | 000,009,216 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.06.03 04:15:40 | 000,060,976 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV - [2009.06.03 04:15:38 | 000,016,432 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV - [2009.06.03 04:15:34 | 000,018,992 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008.03.17 11:05:30 | 000,101,632 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod260&r=27b51010n665l0454wwl5w56l2t541
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod260&r=27b51010n665l0454wwl5w56l2t541
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod260&r=27b51010n665l0454wwl5w56l2t541
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No CLSID value found
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\SearchScopes\{3FA3C207-B09C-425C-BAA9-0412E405ABD3}: "URL" = hxxp://de.search.yahoo.com/search?fr=mcafee&p={SearchTerms}
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd_ut
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE403
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.05 11:34:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.14 10:08:31 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.05 11:34:59 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.14 10:08:31 | 000,000,000 | ---D | M]
 
[2010.10.25 17:37:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Engelmann\AppData\Roaming\mozilla\Extensions
[2012.07.26 20:20:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Engelmann\AppData\Roaming\mozilla\Firefox\Profiles\8jkginwg.default\extensions
[2012.08.15 19:05:53 | 000,001,052 | ---- | M] () -- C:\Users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\searchplugins\icqplugin.xml
[2011.12.24 08:10:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.08.05 11:35:01 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.04.14 14:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files\mozilla firefox\components\Scriptff.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.04.02 08:07:24 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.02 08:07:24 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.04.02 08:07:24 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.02 08:07:24 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.01.05 14:39:24 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2012.04.02 08:07:24 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.02 08:07:24 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O3 - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\Toolbar\WebBrowser: (no name) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - No CLSID value found.
O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] C:\Program Files\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ISW]  File not found
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [UIExec] C:\Program Files\1&1 Surf-Stick\UIExec.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx (WRC Class)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D69447C-F67C-49F5-8C98-406F015C4C1E}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\Shell - "" = AutoRun
O33 - MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk - C:\Programme\Acer\Acer VCM\AcerVCM.exe - (Acer Incorporated)
MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AthBtTray - hkey= - key= - C:\Program Files\Bluetooth Suite\AthBtTray.exe (Atheros Communications)
MsConfig - StartUpReg: AtherosBtStack - hkey= - key= - C:\Program Files\Bluetooth Suite\BtvStack.exe (Atheros Communications)
MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
MsConfig - StartUpReg: GrooveMonitor - hkey= - key= -  File not found
MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.)
MsConfig - StartUpReg: MobileConnect - hkey= - key= -  File not found
MsConfig - StartUpReg: mwlDaemon - hkey= - key= - C:\Programme\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
MsConfig - StartUpReg: NortonOnlineBackupReminder - hkey= - key= -  File not found
MsConfig - StartUpReg: PDFPrint - hkey= - key= - C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
MsConfig - StartUpReg: SuiteTray - hkey= - key= - C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: swg - hkey= - key= -  File not found
MsConfig - StartUpReg: SynTPEnh - hkey= - key= -  File not found
MsConfig - State: "startup" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MCODS - Reg Error: Value error.
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: MCODS - Reg Error: Value error.
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.16 17:05:54 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL(1).exe
[2012.08.14 21:11:26 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.08.14 21:09:57 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Engelmann\Desktop\esetsmartinstaller_enu.exe
[2012.08.14 19:03:24 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.08.10 08:03:45 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL.exe
[2012.08.08 08:30:36 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\AppData\Roaming\Malwarebytes
[2012.08.08 08:30:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.08 08:30:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.08 08:30:07 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.08.08 08:30:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.08.07 18:29:12 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Engelmann\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.06 10:26:00 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\Desktop\Windows XP Professional (German)
[2012.08.06 10:00:27 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\AppData\Roaming\e-academy Inc
[2012.08.06 10:00:27 | 000,000,000 | ---D | C] -- C:\Users\Engelmann\AppData\Local\e-academy Inc
[1 C:\Users\Engelmann\Desktop\*.tmp files -> C:\Users\Engelmann\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.16 17:18:06 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.16 17:05:56 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL(1).exe
[2012.08.16 17:01:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.16 17:00:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.16 15:03:53 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.16 13:41:30 | 000,654,400 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.08.16 13:41:30 | 000,616,242 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.08.16 13:41:30 | 000,130,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.08.16 13:41:30 | 000,106,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.08.16 09:48:16 | 000,019,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 09:48:16 | 000,019,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.16 09:39:38 | 796,733,440 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.15 19:05:21 | 000,618,227 | ---- | M] () -- C:\Users\Engelmann\Desktop\adwcleaner.exe
[2012.08.14 21:10:33 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Engelmann\Desktop\esetsmartinstaller_enu.exe
[2012.08.10 09:52:51 | 000,172,962 | ---- | M] () -- C:\Users\Engelmann\Desktop\gmer.jpg
[2012.08.10 08:55:03 | 000,302,592 | ---- | M] () -- C:\Users\Engelmann\Desktop\qperqepg.exe
[2012.08.10 08:54:20 | 000,302,592 | ---- | M] () -- C:\Users\Engelmann\Desktop\37nobjkw.exe.part
[2012.08.10 08:04:26 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Engelmann\Desktop\OTL.exe
[2012.08.10 08:00:53 | 000,000,000 | ---- | M] () -- C:\Users\Engelmann\defogger_reenable
[2012.08.10 07:59:57 | 000,050,477 | ---- | M] () -- C:\Users\Engelmann\Desktop\Defogger.exe
[2012.08.10 07:56:27 | 000,029,556 | ---- | M] () -- C:\Users\Engelmann\Desktop\avira update.png
[2012.08.08 08:30:13 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.07 18:30:06 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Engelmann\Desktop\mbam-setup-1.62.0.1300.exe
[2012.08.06 10:02:52 | 000,000,183 | ---- | M] () -- C:\Users\Engelmann\Desktop\100097109516.sdx
[2012.08.06 10:00:28 | 000,003,167 | ---- | M] () -- C:\Users\Engelmann\Desktop\Secure Download Manager.lnk
[2012.08.06 09:56:59 | 000,718,336 | ---- | M] () -- C:\Users\Engelmann\Desktop\SDM_DE.msi
[2012.08.01 20:25:07 | 000,909,754 | ---- | M] () -- C:\Users\Engelmann\Desktop\VL9_Trends_in_der_Logistik.pdf
[1 C:\Users\Engelmann\Desktop\*.tmp files -> C:\Users\Engelmann\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.15 19:05:15 | 000,618,227 | ---- | C] () -- C:\Users\Engelmann\Desktop\adwcleaner.exe
[2012.08.10 09:52:50 | 000,172,962 | ---- | C] () -- C:\Users\Engelmann\Desktop\gmer.jpg
[2012.08.10 08:54:50 | 000,302,592 | ---- | C] () -- C:\Users\Engelmann\Desktop\qperqepg.exe
[2012.08.10 08:54:14 | 000,302,592 | ---- | C] () -- C:\Users\Engelmann\Desktop\37nobjkw.exe.part
[2012.08.10 08:00:53 | 000,000,000 | ---- | C] () -- C:\Users\Engelmann\defogger_reenable
[2012.08.10 07:59:23 | 000,050,477 | ---- | C] () -- C:\Users\Engelmann\Desktop\Defogger.exe
[2012.08.10 07:56:26 | 000,029,556 | ---- | C] () -- C:\Users\Engelmann\Desktop\avira update.png
[2012.08.08 08:30:13 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.08.06 10:01:06 | 000,000,183 | ---- | C] () -- C:\Users\Engelmann\Desktop\100097109516.sdx
[2012.08.06 10:00:28 | 000,003,167 | ---- | C] () -- C:\Users\Engelmann\Desktop\Secure Download Manager.lnk
[2012.08.06 09:56:14 | 000,718,336 | ---- | C] () -- C:\Users\Engelmann\Desktop\SDM_DE.msi
[2012.08.01 20:25:07 | 000,909,754 | ---- | C] () -- C:\Users\Engelmann\Desktop\VL9_Trends_in_der_Logistik.pdf
[2012.06.17 11:28:22 | 000,007,623 | ---- | C] () -- C:\Users\Engelmann\AppData\Local\Resmon.ResmonCfg
[2011.06.29 13:56:00 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.10.25 17:37:07 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.05.03 05:26:42 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== LOP Check ==========
 
[2012.05.07 08:34:15 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\CheckPoint
[2011.04.13 11:35:19 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\DAEMON Tools Lite
[2012.08.06 10:00:27 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\e-academy Inc
[2012.01.12 16:55:44 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\ICQ
[2012.04.24 21:46:21 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\LolClient
[2010.10.26 17:11:40 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Vodafone
[2012.08.14 18:12:08 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.10.25 12:11:57 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Adobe
[2011.12.11 10:39:16 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Avira
[2012.05.07 08:34:15 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\CheckPoint
[2011.04.13 11:35:19 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\DAEMON Tools Lite
[2012.08.06 10:00:27 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\e-academy Inc
[2010.10.25 17:26:29 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Google
[2012.01.12 16:55:44 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\ICQ
[2010.10.25 17:18:08 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Identities
[2012.04.24 21:46:21 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\LolClient
[2010.10.25 17:19:39 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Macromedia
[2012.08.08 08:30:36 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Malwarebytes
[2012.08.06 10:00:28 | 000,000,000 | --SD | M] -- C:\Users\Engelmann\AppData\Roaming\Microsoft
[2010.10.25 17:37:17 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Mozilla
[2010.10.26 17:11:40 | 000,000,000 | ---D | M] -- C:\Users\Engelmann\AppData\Roaming\Vodafone
 
< %APPDATA%\*.exe /s >
[2012.08.06 10:00:28 | 000,009,662 | R--- | M] () -- C:\Users\Engelmann\AppData\Roaming\Microsoft\Installer\{9268B41D-6045-4F5F-A14E-3F8E51CD2666}\_112D608FD02CD87FDC7735.exe
[2012.08.06 10:00:28 | 000,009,662 | R--- | M] () -- C:\Users\Engelmann\AppData\Roaming\Microsoft\Installer\{9268B41D-6045-4F5F-A14E-3F8E51CD2666}\_30C8F0A9D59F1A9A11FFC4.exe
[2012.08.06 10:00:28 | 000,009,662 | R--- | M] () -- C:\Users\Engelmann\AppData\Roaming\Microsoft\Installer\{9268B41D-6045-4F5F-A14E-3F8E51CD2666}\_853F67D554F05449430E7E.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTOR.SYS  >
[2009.06.05 03:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009.06.05 03:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009.06.05 03:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\drivers\iaStor.sys
[2009.06.05 03:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_c1f15fc3e546800a\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:AB689DEA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:93DE1838
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E36F5B57
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E1F04E8D
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0B9176C0
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:4D066AD2

< End of report >
--- --- ---

cosinus 17.08.2012 19:08
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No CLSID value found
IE - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd_ut
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O3 - HKU\S-1-5-21-3419424104-2474502219-4126263772-1000\..\Toolbar\WebBrowser: (no name) - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\Shell - "" = AutoRun
O33 - MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\Shell - "" = AutoRun
O33 - MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:AB689DEA
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:93DE1838
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E36F5B57
@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:E1F04E8D
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:798A3728
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:0B9176C0
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:4D066AD2
:Files
C:\Users\Engelmann\AppData\Roaming\CheckPoint
C:\ProgramData\FullRemove.exe
C:\Programme\ICQ6Toolbar
C:\Program Files\CheckPoint
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

fux89 17.08.2012 19:32
hat leider nicht geklappt.
unmittelbar nachdem der fix-prozess losging kam eine meldung (ich glaub von windows), dass ein kritischer fehler aufgetreten ist und der pc in einer minute neu gestartet wird. das hat er dann auch.
das fixen lief zwar noch bis zum neustart weiter, aber war natürlich noch nicht fertig.

edit: beim zweiten versuch hats geklappt. warscheinlich ging beim ersten mal iwas beim schließen von firefox schief, ka.

hier das log:
Code:
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-3419424104-2474502219-4126263772-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
Registry value HKEY_USERS\S-1-5-21-3419424104-2474502219-4126263772-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_USERS\S-1-5-21-3419424104-2474502219-4126263772-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}\ not found.
Registry key HKEY_USERS\S-1-5-21-3419424104-2474502219-4126263772-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@checkpoint.com/FFApi\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27B4851A-3207-45A2-B947-BE8AFE6163AB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{27B4851A-3207-45A2-B947-BE8AFE6163AB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
File C:\Programme\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.
Registry value HKEY_USERS\S-1-5-21-3419424104-2474502219-4126263772-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}\ not found.
Registry value HKEY_USERS\S-1-5-21-3419424104-2474502219-4126263772-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FC2B76FC-2132-4D80-A9A3-1F5C6E49066B}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File C:\autoexec.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4832f471-e112-11df-bdff-88ae1d0c9bf6}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4832f483-e112-11df-bdff-88ae1d0c9bf6}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4832f485-e112-11df-bdff-88ae1d0c9bf6}\ not found.
File E:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9838f85b-f6fd-11e0-a495-88ae1d0c9bf6}\ not found.
File D:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5c40194-0876-11e0-bff9-88ae1d0c9bf6}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a72b1484-8172-11e0-963b-88ae1d0c9bf6}\ not found.
File E:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a72b1486-8172-11e0-963b-88ae1d0c9bf6}\ not found.
File E:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ac2d6b5f-02c7-11e0-871e-62e400766974}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ac2d6b5f-02c7-11e0-871e-62e400766974}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ac2d6b5f-02c7-11e0-871e-62e400766974}\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D\ not found.
File D:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found.
File E:\setup_vmc_lite.exe /checkApplicationPresence not found.
Unable to delete ADS C:\ProgramData\TEMP:AB689DEA .
Unable to delete ADS C:\ProgramData\TEMP:93DE1838 .
Unable to delete ADS C:\ProgramData\TEMP:E36F5B57 .
Unable to delete ADS C:\ProgramData\TEMP:E1F04E8D .
Unable to delete ADS C:\ProgramData\TEMP:798A3728 .
Unable to delete ADS C:\ProgramData\TEMP:0B9176C0 .
Unable to delete ADS C:\ProgramData\TEMP:4D066AD2 .
========== FILES ==========
File\Folder C:\Users\Engelmann\AppData\Roaming\CheckPoint not found.
File\Folder C:\ProgramData\FullRemove.exe not found.
File\Folder C:\Programme\ICQ6Toolbar not found.
File\Folder C:\Program Files\CheckPoint not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Engelmann
->Temp folder emptied: 193181723 bytes
->Temporary Internet Files folder emptied: 40150330 bytes
->Java cache emptied: 677 bytes
->FireFox cache emptied: 395364795 bytes
->Flash cache emptied: 2696 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 982626423 bytes
RecycleBin emptied: 43418576 bytes
 
Total Files Cleaned = 1.578,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Engelmann
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.57.0 log created on 08172012_205906

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.

PendingFileRenameOperations files...
[2012.08.17 21:10:33 | 000,000,000 | ---- | M] () C:\Windows\temp\dsiwmis.log : Unable to obtain MD5

Registry entries deleted on Reboot...

cosinus 18.08.2012 11:37
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

fux89 18.08.2012 14:01
hier das log:

Code:
14:59:14.0387 3400  TDSS rootkit removing tool 2.8.6.0 Aug 13 2012 17:24:05
14:59:15.0089 3400  ============================================================
14:59:15.0089 3400  Current date / time: 2012/08/18 14:59:15.0089
14:59:15.0089 3400  SystemInfo:
14:59:15.0089 3400 
14:59:15.0089 3400  OS Version: 6.1.7601 ServicePack: 1.0
14:59:15.0089 3400  Product type: Workstation
14:59:15.0089 3400  ComputerName: ENGELMANN-PC
14:59:15.0105 3400  UserName: Engelmann
14:59:15.0105 3400  Windows directory: C:\Windows
14:59:15.0105 3400  System windows directory: C:\Windows
14:59:15.0105 3400  Processor architecture: Intel x86
14:59:15.0105 3400  Number of processors: 2
14:59:15.0105 3400  Page size: 0x1000
14:59:15.0105 3400  Boot type: Normal boot
14:59:15.0105 3400  ============================================================
14:59:17.0258 3400  Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
14:59:17.0258 3400  ============================================================
14:59:17.0258 3400  \Device\Harddisk0\DR0:
14:59:17.0258 3400  MBR partitions:
14:59:17.0258 3400  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1A03C22, BlocksNum 0x32FCD
14:59:17.0258 3400  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1A36BEF, BlocksNum 0x1B78E581
14:59:17.0258 3400  ============================================================
14:59:17.0305 3400  C: <-> \Device\Harddisk0\DR0\Partition2
14:59:17.0305 3400  ============================================================
14:59:17.0305 3400  Initialize success
14:59:17.0305 3400  ============================================================
14:59:30.0923 2504  ============================================================
14:59:30.0923 2504  Scan started
14:59:30.0923 2504  Mode: Manual; SigCheck; TDLFS;
14:59:30.0923 2504  ============================================================
14:59:32.0015 2504  ================ Scan services =============================
14:59:32.0296 2504  [ 1b133875b8aa8ac48969bd3458afe9f5 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
14:59:32.0624 2504  1394ohci - ok
14:59:32.0702 2504  [ cea80c80bed809aa0da6febc04733349 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
14:59:32.0764 2504  ACPI - ok
14:59:32.0827 2504  [ 1efbc664abff416d1d07db115dcb264f ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
14:59:32.0936 2504  AcpiPmi - ok
14:59:33.0061 2504  [ a9d3b95e8466bd58eeb8a1154654e162 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
14:59:33.0107 2504  AdobeFlashPlayerUpdateSvc - ok
14:59:33.0185 2504  [ 21e785ebd7dc90a06391141aac7892fb ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
14:59:33.0279 2504  adp94xx - ok
14:59:33.0341 2504  [ 0c676bc278d5b59ff5abd57bbe9123f2 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
14:59:33.0404 2504  adpahci - ok
14:59:33.0435 2504  [ 7c7b5ee4b7b822ec85321fe23a27db33 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
14:59:33.0482 2504  adpu320 - ok
14:59:33.0560 2504  [ 8b5eefeec1e6d1a72a06c526628ad161 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
14:59:33.0685 2504  AeLookupSvc - ok
14:59:33.0763 2504  [ 9ebbba55060f786f0fcaa3893bfa2806 ] AFD            C:\Windows\system32\drivers\afd.sys
14:59:33.0856 2504  AFD - ok
14:59:33.0919 2504  [ 507812c3054c21cef746b6ee3d04dd6e ] agp440          C:\Windows\system32\drivers\agp440.sys
14:59:33.0965 2504  agp440 - ok
14:59:33.0997 2504  [ 8b30250d573a8f6b4bd23195160d8707 ] aic78xx        C:\Windows\system32\drivers\djsvs.sys
14:59:34.0043 2504  aic78xx - ok
14:59:34.0121 2504  [ 18a54e132947cd98fea9accc57f98f13 ] ALG            C:\Windows\System32\alg.exe
14:59:34.0199 2504  ALG - ok
14:59:34.0262 2504  [ 0d40bcf52ea90fc7df2aeab6503dea44 ] aliide          C:\Windows\system32\drivers\aliide.sys
14:59:34.0309 2504  aliide - ok
14:59:34.0340 2504  [ 3c6600a0696e90a463771c7422e23ab5 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
14:59:34.0387 2504  amdagp - ok
14:59:34.0418 2504  [ cd5914170297126b6266860198d1d4f0 ] amdide          C:\Windows\system32\drivers\amdide.sys
14:59:34.0465 2504  amdide - ok
14:59:34.0527 2504  [ 00dda200d71bac534bf56a9db5dfd666 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
14:59:34.0605 2504  AmdK8 - ok
14:59:34.0636 2504  [ 3cbf30f5370fda40dd3e87df38ea53b6 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
14:59:34.0714 2504  AmdPPM - ok
14:59:34.0777 2504  [ d320bf87125326f996d4904fe24300fc ] amdsata        C:\Windows\system32\drivers\amdsata.sys
14:59:34.0823 2504  amdsata - ok
14:59:34.0870 2504  [ ea43af0c423ff267355f74e7a53bdaba ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
14:59:34.0917 2504  amdsbs - ok
14:59:34.0948 2504  [ 46387fb17b086d16dea267d5be23a2f2 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
14:59:34.0995 2504  amdxata - ok
14:59:35.0135 2504  [ 466a0d95960dad3222c896d2cea99993 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
14:59:35.0198 2504  AntiVirSchedulerService - ok
14:59:35.0276 2504  [ a489be6bb0aa1ff406b488b60542314b ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
14:59:35.0307 2504  AntiVirService - ok
14:59:35.0369 2504  [ aea177f783e20150ace5383ee368da19 ] AppID          C:\Windows\system32\drivers\appid.sys
14:59:35.0541 2504  AppID - ok
14:59:35.0588 2504  [ 62a9c86cb6085e20db4823e4e97826f5 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
14:59:35.0728 2504  AppIDSvc - ok
14:59:35.0775 2504  [ fb1959012294d6ad43e5304df65e3c26 ] Appinfo        C:\Windows\System32\appinfo.dll
14:59:35.0884 2504  Appinfo - ok
14:59:35.0993 2504  [ a45d184df6a8803da13a0b329517a64a ] AppMgmt        C:\Windows\System32\appmgmts.dll
14:59:36.0103 2504  AppMgmt - ok
14:59:36.0165 2504  [ 2932004f49677bd84dbc72edb754ffb3 ] arc            C:\Windows\system32\drivers\arc.sys
14:59:36.0212 2504  arc - ok
14:59:36.0259 2504  [ 5d6f36c46fd283ae1b57bd2e9feb0bc7 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
14:59:36.0305 2504  arcsas - ok
14:59:36.0337 2504  [ add2ade1c2b285ab8378d2daaf991481 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
14:59:36.0508 2504  AsyncMac - ok
14:59:36.0586 2504  [ 338c86357871c167a96ab976519bf59e ] atapi          C:\Windows\system32\drivers\atapi.sys
14:59:36.0617 2504  atapi - ok
14:59:36.0680 2504  [ dabc29dfcc82539fc18c1e79962afb6a ] AthBTPort      C:\Windows\system32\DRIVERS\btath_flt.sys
14:59:36.0758 2504  AthBTPort - ok
14:59:36.0789 2504  [ 70441751b1d988608e135d4f903aba5c ] ATHDFU          C:\Windows\system32\Drivers\AthDfu.sys
14:59:36.0836 2504  ATHDFU - ok
14:59:36.0867 2504  [ bb222284670ed3f67c55ec69eaa17535 ] AtherosSvc      C:\Program Files\Bluetooth Suite\adminservice.exe
14:59:36.0929 2504  AtherosSvc ( UnsignedFile.Multi.Generic ) - warning
14:59:36.0929 2504  AtherosSvc - detected UnsignedFile.Multi.Generic (1)
14:59:37.0023 2504  [ 8d6e8178ab4379c932c34a109d27c5a9 ] athr            C:\Windows\system32\DRIVERS\athr.sys
14:59:37.0195 2504  athr - ok
14:59:37.0273 2504  [ ce3b4e731638d2ef62fcb419be0d39f0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:59:37.0429 2504  AudioEndpointBuilder - ok
14:59:37.0460 2504  [ ce3b4e731638d2ef62fcb419be0d39f0 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
14:59:37.0569 2504  Audiosrv - ok
14:59:37.0631 2504  [ d5541f0afb767e85fc412fc609d96a74 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
14:59:37.0694 2504  avgntflt - ok
14:59:37.0725 2504  [ 7d967a682d4694df7fa57d63a2db01fe ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
14:59:37.0772 2504  avipbb - ok
14:59:37.0819 2504  [ 271cfd1a989209b1964e24d969552bf7 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
14:59:37.0850 2504  avkmgr - ok
14:59:37.0912 2504  [ 6e30d02aac9cac84f421622e3a2f6178 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
14:59:38.0053 2504  AxInstSV - ok
14:59:38.0131 2504  [ 1a231abec60fd316ec54c66715543cec ] b06bdrv        C:\Windows\system32\drivers\bxvbdx.sys
14:59:38.0209 2504  b06bdrv - ok
14:59:38.0271 2504  [ bd8869eb9cde6bbe4508d869929869ee ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
14:59:38.0349 2504  b57nd60x - ok
14:59:38.0396 2504  [ ee1e9c3bb8228ae423dd38db69128e71 ] BDESVC          C:\Windows\System32\bdesvc.dll
14:59:38.0521 2504  BDESVC - ok
14:59:38.0567 2504  [ 505506526a9d467307b3c393dedaf858 ] Beep            C:\Windows\system32\drivers\Beep.sys
14:59:38.0692 2504  Beep - ok
14:59:38.0770 2504  [ 1e2bac209d184bb851e1a187d8a29136 ] BFE            C:\Windows\System32\bfe.dll
14:59:38.0942 2504  BFE - ok
14:59:39.0004 2504  [ e585445d5021971fae10393f0f1c3961 ] BITS            C:\Windows\System32\qmgr.dll
14:59:39.0129 2504  BITS - ok
14:59:39.0176 2504  [ 2287078ed48fcfc477b05b20cf38f36f ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
14:59:39.0254 2504  blbdrive - ok
14:59:39.0301 2504  [ 8f2da3028d5fcbd1a060a3de64cd6506 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
14:59:39.0394 2504  bowser - ok
14:59:39.0410 2504  [ 9f9acc7f7ccde8a15c282d3f88b43309 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
14:59:39.0519 2504  BrFiltLo - ok
14:59:39.0581 2504  [ 56801ad62213a41f6497f96dee83755a ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
14:59:39.0644 2504  BrFiltUp - ok
14:59:39.0706 2504  [ 3daa727b5b0a45039b0e1c9a211b8400 ] Browser        C:\Windows\System32\browser.dll
14:59:39.0815 2504  Browser - ok
14:59:39.0862 2504  [ 845b8ce732e67f3b4133164868c666ea ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
14:59:39.0956 2504  Brserid - ok
14:59:40.0003 2504  [ 203f0b1e73adadbbb7b7b1fabd901f6b ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
14:59:40.0065 2504  BrSerWdm - ok
14:59:40.0096 2504  [ bd456606156ba17e60a04e18016ae54b ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
14:59:40.0159 2504  BrUsbMdm - ok
14:59:40.0190 2504  [ af72ed54503f717a43268b3cc5faec2e ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
14:59:40.0268 2504  BrUsbSer - ok
14:59:40.0315 2504  [ 5f9cdc9f3b48c997427fc4a1b1abe590 ] BTATH_A2DP      C:\Windows\system32\drivers\btath_a2dp.sys
14:59:40.0361 2504  BTATH_A2DP - ok
14:59:40.0408 2504  [ 1386d2a1e0bc3f95e5492272f6aaec29 ] BTATH_BUS      C:\Windows\system32\DRIVERS\btath_bus.sys
14:59:40.0455 2504  BTATH_BUS - ok
14:59:40.0486 2504  [ 4d4ce30cbc8048ba630b62e35b4bb020 ] BTATH_HCRP      C:\Windows\system32\DRIVERS\btath_hcrp.sys
14:59:40.0533 2504  BTATH_HCRP - ok
14:59:40.0611 2504  [ e04d373be39d00703f9fd54ae979fb26 ] BTATH_LWFLT    C:\Windows\system32\DRIVERS\btath_lwflt.sys
14:59:40.0642 2504  BTATH_LWFLT - ok
14:59:40.0673 2504  [ 9d617ec5905cca39f972e450ce9a8a3b ] BTATH_RCP      C:\Windows\system32\DRIVERS\btath_rcp.sys
14:59:40.0720 2504  BTATH_RCP - ok
14:59:40.0767 2504  [ 38110e60efd5513109d9b4c7292f836f ] BtFilter        C:\Windows\system32\DRIVERS\btfilter.sys
14:59:40.0829 2504  BtFilter - ok
14:59:40.0876 2504  [ 2865a5c8e98c70c605f417908cebb3a4 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
14:59:40.0985 2504  BthEnum - ok
14:59:41.0032 2504  [ ed3df7c56ce0084eb2034432fc56565a ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
14:59:41.0110 2504  BTHMODEM - ok
14:59:41.0173 2504  [ ad1872e5829e8a2c3b5b4b641c3eab0e ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
14:59:41.0235 2504  BthPan - ok
14:59:41.0297 2504  [ 1153de2e4f5941e10c399cb5592f78a1 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
14:59:41.0391 2504  BTHPORT - ok
14:59:41.0438 2504  [ 1df19c96eef6c29d1c3e1a8678e07190 ] bthserv        C:\Windows\system32\bthserv.dll
14:59:41.0563 2504  bthserv - ok
14:59:41.0609 2504  [ c81e9413a25a439f436b1d4b6a0cf9e9 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
14:59:41.0687 2504  BTHUSB - ok
14:59:41.0750 2504  [ 77ea11b065e0a8ab902d78145ca51e10 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
14:59:41.0859 2504  cdfs - ok
14:59:41.0921 2504  [ be167ed0fdb9c1fa1133953c18d5a6c9 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
14:59:41.0999 2504  cdrom - ok
14:59:42.0046 2504  [ 319c6b309773d063541d01df8ac6f55f ] CertPropSvc    C:\Windows\System32\certprop.dll
14:59:42.0171 2504  CertPropSvc - ok
14:59:42.0202 2504  [ 3fe3fe94a34df6fb06e6418d0f6a0060 ] circlass        C:\Windows\system32\drivers\circlass.sys
14:59:42.0265 2504  circlass - ok
14:59:42.0311 2504  [ 635181e0e9bbf16871bf5380d71db02d ] CLFS            C:\Windows\system32\CLFS.sys
14:59:42.0374 2504  CLFS - ok
14:59:42.0467 2504  [ d88040f816fda31c3b466f0fa0918f29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:59:42.0514 2504  clr_optimization_v2.0.50727_32 - ok
14:59:42.0639 2504  [ c5a75eb48e2344abdc162bda79e16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:59:42.0701 2504  clr_optimization_v4.0.30319_32 - ok
14:59:42.0733 2504  [ dea805815e587dad1dd2c502220b5616 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
14:59:42.0795 2504  CmBatt - ok
14:59:42.0842 2504  [ c537b1db64d495b9b4717b4d6d9edbf2 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
14:59:42.0889 2504  cmdide - ok
14:59:42.0951 2504  [ 247b4ce2dab1160cd422d532d5241e1f ] CNG            C:\Windows\system32\Drivers\cng.sys
14:59:43.0060 2504  CNG - ok
14:59:43.0107 2504  [ a6023d3823c37043986713f118a89bee ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
14:59:43.0154 2504  Compbatt - ok
14:59:43.0201 2504  [ cbe8c58a8579cfe5fccf809e6f114e89 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
14:59:43.0279 2504  CompositeBus - ok
14:59:43.0294 2504  COMSysApp - ok
14:59:43.0341 2504  [ 2c4ebcfc84a9b44f209dff6c6e6c61d1 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
14:59:43.0388 2504  crcdisk - ok
14:59:43.0435 2504  [ 06e771aa596b8761107ab57e99f128d7 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
14:59:43.0559 2504  CryptSvc - ok
14:59:43.0622 2504  [ 3c2177a897b4ca2788c6fb0c3fd81d4b ] CSC            C:\Windows\system32\drivers\csc.sys
14:59:43.0731 2504  CSC - ok
14:59:43.0793 2504  [ 15f93b37f6801943360d9eb42485d5d3 ] CscService      C:\Windows\System32\cscsvc.dll
14:59:43.0887 2504  CscService - ok
14:59:43.0934 2504  [ b5ecadf7708960f1818c7fa015f4c239 ] CVirtA          C:\Windows\system32\DRIVERS\CVirtA.sys
14:59:44.0012 2504  CVirtA - ok
14:59:44.0074 2504  [ 7660f01d3b38aca1747e397d21d790af ] DcomLaunch      C:\Windows\system32\rpcss.dll
14:59:44.0230 2504  DcomLaunch - ok
14:59:44.0293 2504  [ 8d6e10a2d9a5eed59562d9b82cf804e1 ] defragsvc      C:\Windows\System32\defragsvc.dll
14:59:44.0433 2504  defragsvc - ok
14:59:44.0480 2504  [ f024449c97ec1e464aaffda18593db88 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
14:59:44.0620 2504  DfsC - ok
14:59:44.0698 2504  [ e9e01eb683c132f7fa27cd607b8a2b63 ] Dhcp            C:\Windows\system32\dhcpcore.dll
14:59:44.0823 2504  Dhcp - ok
14:59:44.0854 2504  [ 1a050b0274bfb3890703d490f330c0da ] discache        C:\Windows\system32\drivers\discache.sys
14:59:44.0979 2504  discache - ok
14:59:45.0026 2504  [ 565003f326f99802e68ca78f2a68e9ff ] Disk            C:\Windows\system32\drivers\disk.sys
14:59:45.0073 2504  Disk - ok
14:59:45.0119 2504  [ b5aa5aa5ac327bd7c1aec0c58f0c1144 ] DNE            C:\Windows\system32\DRIVERS\dne2000.sys
14:59:45.0151 2504  DNE - ok
14:59:45.0213 2504  [ 33ef4861f19a0736b11314aad9ae28d0 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
14:59:45.0307 2504  Dnscache - ok
14:59:45.0353 2504  [ 366ba8fb4b7bb7435e3b9eacb3843f67 ] dot3svc        C:\Windows\System32\dot3svc.dll
14:59:45.0478 2504  dot3svc - ok
14:59:45.0525 2504  [ 8ec04ca86f1d68da9e11952eb85973d6 ] DPS            C:\Windows\system32\dps.dll
14:59:45.0650 2504  DPS - ok
14:59:45.0712 2504  [ b918e7c5f9bf77202f89e1a9539f2eb4 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
14:59:45.0775 2504  drmkaud - ok
14:59:45.0868 2504  [ e2b2853a0210d6edab2261870bd80c1a ] DsiWMIService  C:\Program Files\Launch Manager\dsiwmis.exe
14:59:45.0915 2504  DsiWMIService - ok
14:59:45.0993 2504  [ c0c7ceccb6c85994c2bc92d58e52d3f2 ] dtsoftbus01    C:\Windows\system32\DRIVERS\dtsoftbus01.sys
14:59:46.0040 2504  dtsoftbus01 - ok
14:59:46.0102 2504  [ 23f5d28378a160352ba8f817bd8c71cb ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
14:59:46.0211 2504  DXGKrnl - ok
14:59:46.0258 2504  [ 8600142fa91c1b96367d3300ad0f3f3a ] EapHost        C:\Windows\System32\eapsvc.dll
14:59:46.0383 2504  EapHost - ok
14:59:46.0508 2504  [ 024e1b5cac09731e4d868e64dbfb4ab0 ] ebdrv          C:\Windows\system32\drivers\evbdx.sys
14:59:46.0757 2504  ebdrv - ok
14:59:46.0789 2504  [ 81951f51e318aecc2d68559e47485cc4 ] EFS            C:\Windows\System32\lsass.exe
14:59:46.0882 2504  EFS - ok
14:59:46.0960 2504  [ a8c362018efc87beb013ee28f29c0863 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
14:59:47.0101 2504  ehRecvr - ok
14:59:47.0132 2504  [ d389bff34f80caede417bf9d1507996a ] ehSched        C:\Windows\ehome\ehsched.exe
14:59:47.0210 2504  ehSched - ok
14:59:47.0272 2504  [ 0ed67910c8c326796faa00b2bf6d9d3c ] elxstor        C:\Windows\system32\drivers\elxstor.sys
14:59:47.0335 2504  elxstor - ok
14:59:47.0459 2504  [ fc13ed47575a0788fc58d68549dd2a73 ] ePowerSvc      C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
14:59:47.0522 2504  ePowerSvc - ok
14:59:47.0553 2504  [ 8fc3208352dd3912c94367a206ab3f11 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
14:59:47.0631 2504  ErrDev - ok
14:59:47.0709 2504  [ d8e44d8daf4dac7dc6f8d14313eac823 ] EUCR            C:\Windows\system32\DRIVERS\EUCR6SK.SYS
14:59:47.0756 2504  EUCR - ok
14:59:47.0818 2504  [ f6916efc29d9953d5d0df06882ae8e16 ] EventSystem    C:\Windows\system32\es.dll
14:59:47.0959 2504  EventSystem - ok
14:59:47.0990 2504  [ 2dc9108d74081149cc8b651d3a26207f ] exfat          C:\Windows\system32\drivers\exfat.sys
14:59:48.0115 2504  exfat - ok
14:59:48.0146 2504  [ 7e0ab74553476622fb6ae36f73d97d35 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
14:59:48.0255 2504  fastfat - ok
14:59:48.0349 2504  [ 967ea5b213e9984cbe270205df37755b ] Fax            C:\Windows\system32\fxssvc.exe
14:59:48.0458 2504  Fax - ok
14:59:48.0505 2504  [ e817a017f82df2a1f8cfdbda29388b29 ] fdc            C:\Windows\system32\drivers\fdc.sys
14:59:48.0567 2504  fdc - ok
14:59:48.0629 2504  [ f3222c893bd2f5821a0179e5c71e88fb ] fdPHost        C:\Windows\system32\fdPHost.dll
14:59:48.0739 2504  fdPHost - ok
14:59:48.0770 2504  [ 7dbe8cbfe79efbdeb98c9fb08d3a9a5b ] FDResPub        C:\Windows\system32\fdrespub.dll
14:59:48.0910 2504  FDResPub - ok
14:59:48.0941 2504  [ 6cf00369c97f3cf563be99be983d13d8 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
14:59:48.0988 2504  FileInfo - ok
14:59:49.0035 2504  [ 42c51dc94c91da21cb9196eb64c45db9 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
14:59:49.0144 2504  Filetrace - ok
14:59:49.0191 2504  [ 87907aa70cb3c56600f1c2fb8841579b ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
14:59:49.0253 2504  flpydisk - ok
14:59:49.0285 2504  [ 7520ec808e0c35e0ee6f841294316653 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
14:59:49.0347 2504  FltMgr - ok
14:59:49.0425 2504  [ b3a5ec6b6b6673db7e87c2bcdbddc074 ] FontCache      C:\Windows\system32\FntCache.dll
14:59:49.0519 2504  FontCache - ok
14:59:49.0628 2504  [ e56f39f6b7fda0ac77a79b0fd3de1a2f ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
14:59:49.0675 2504  FontCache3.0.0.0 - ok
14:59:49.0737 2504  [ 1a16b57943853e598cff37fe2b8cbf1d ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
14:59:49.0784 2504  FsDepends - ok
14:59:49.0815 2504  [ 7dae5ebcc80e45d3253f4923dc424d05 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
14:59:49.0862 2504  Fs_Rec - ok
14:59:49.0924 2504  [ 8a73e79089b282100b9393b644cb853b ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
14:59:49.0987 2504  fvevol - ok
14:59:50.0033 2504  [ 65ee0c7a58b65e74ae05637418153938 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
14:59:50.0080 2504  gagp30kx - ok
14:59:50.0143 2504  [ e897eaf5ed6ba41e081060c9b447a673 ] gpsvc          C:\Windows\System32\gpsvc.dll
14:59:50.0314 2504  gpsvc - ok
14:59:50.0408 2504  [ 0191dee9b9eb7902af2cf4f67301095d ] GREGService    C:\Program Files\Acer\Registration\GREGsvc.exe
14:59:50.0470 2504  GREGService - ok
14:59:50.0548 2504  [ 8f0de4fef8201e306f9938b0905ac96a ] gupdate        C:\Program Files\Google\Update\GoogleUpdate.exe
14:59:50.0595 2504  gupdate - ok
14:59:50.0626 2504  [ 8f0de4fef8201e306f9938b0905ac96a ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
14:59:50.0673 2504  gupdatem - ok
14:59:50.0735 2504  [ c44e3c2bab6837db337ddee7544736db ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
14:59:50.0829 2504  hcw85cir - ok
14:59:50.0907 2504  [ a5ef29d5315111c80a5c1abad14c8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:59:50.0985 2504  HdAudAddService - ok
14:59:51.0016 2504  [ 9036377b8a6c15dc2eec53e489d159b5 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
14:59:51.0094 2504  HDAudBus - ok
14:59:51.0125 2504  [ 1d58a7f3e11a9731d0eaaaa8405acc36 ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
14:59:51.0188 2504  HidBatt - ok
14:59:51.0219 2504  [ 89448f40e6df260c206a193a4683ba78 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
14:59:51.0297 2504  HidBth - ok
14:59:51.0328 2504  [ cf50b4cf4a4f229b9f3c08351f99ca5e ] HidIr          C:\Windows\system32\drivers\hidir.sys
14:59:51.0391 2504  HidIr - ok
14:59:51.0453 2504  [ 2bc6f6a1992b3a77f5f41432ca6b3b6b ] hidserv        C:\Windows\system32\hidserv.dll
14:59:51.0578 2504  hidserv - ok
14:59:51.0656 2504  [ 10c19f8290891af023eaec0832e1eb4d ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
14:59:51.0718 2504  HidUsb - ok
14:59:51.0765 2504  [ 196b4e3f4cccc24af836ce58facbb699 ] hkmsvc          C:\Windows\system32\kmsvc.dll
14:59:51.0890 2504  hkmsvc - ok
14:59:51.0937 2504  [ 6658f4404de03d75fe3ba09f7aba6a30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:59:52.0046 2504  HomeGroupListener - ok
14:59:52.0093 2504  [ dbc02d918fff1cad628acbe0c0eaa8e8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:59:52.0202 2504  HomeGroupProvider - ok
14:59:52.0233 2504  [ 295fdc419039090eb8b49ffdbb374549 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
14:59:52.0280 2504  HpSAMD - ok
14:59:52.0358 2504  [ 871917b07a141bff43d76d8844d48106 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
14:59:52.0467 2504  HTTP - ok
14:59:52.0514 2504  [ 19e6885a061011d8dabe8f64498423fa ] hwdatacard      C:\Windows\system32\DRIVERS\ewusbmdm.sys
14:59:52.0592 2504  hwdatacard - ok
14:59:52.0639 2504  [ 0c4e035c7f105f1299258c90886c64c5 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
14:59:52.0685 2504  hwpolicy - ok
14:59:52.0748 2504  [ f151f0bdc47f4a28b1b20a0818ea36d6 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
14:59:52.0810 2504  i8042prt - ok
14:59:52.0935 2504  [ 7548066df68a8a1a56b043359f915f37 ] IAANTMON        C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
14:59:52.0997 2504  IAANTMON - ok
14:59:53.0060 2504  [ d483687eace0c065ee772481a96e05f5 ] iaStor          C:\Windows\system32\drivers\iaStor.sys
14:59:53.0122 2504  iaStor - ok
14:59:53.0169 2504  [ 5cd5f9a5444e6cdcb0ac89bd62d8b76e ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
14:59:53.0247 2504  iaStorV - ok
14:59:53.0325 2504  [ a8db82c2b6d8420de021876bf40969d2 ] ICQ Service    C:\Program Files\ICQ6Toolbar\ICQ Service.exe
14:59:53.0403 2504  ICQ Service - ok
14:59:53.0481 2504  [ c521d7eb6497bb1af6afa89e322fb43c ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:59:53.0559 2504  idsvc - ok
14:59:53.0762 2504  [ d0074897c6bc132f3980ea4654bf7fb9 ] igfx            C:\Windows\system32\DRIVERS\igdkmd32.sys
14:59:54.0121 2504  igfx - ok
14:59:54.0167 2504  [ 4173ff5708f3236cf25195fecd742915 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
14:59:54.0261 2504  iirsp - ok
14:59:54.0339 2504  [ f95622f161474511b8d80d6b093aa610 ] IKEEXT          C:\Windows\System32\ikeext.dll
14:59:54.0464 2504  IKEEXT - ok
14:59:54.0635 2504  [ 947318c01c648a054a05dbd1c7f73e3b ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
14:59:54.0885 2504  IntcAzAudAddService - ok
14:59:54.0947 2504  [ a0f12f2c9ba6c72f3987ce780e77c130 ] intelide        C:\Windows\system32\drivers\intelide.sys
14:59:54.0979 2504  intelide - ok
14:59:55.0057 2504  [ 3b514d27bfc4accb4037bc6685f766e0 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
14:59:55.0119 2504  intelppm - ok
14:59:55.0181 2504  [ acb364b9075a45c0736e5c47be5cae19 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
14:59:55.0306 2504  IPBusEnum - ok
14:59:55.0337 2504  [ 709d1761d3b19a932ff0238ea6d50200 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:59:55.0462 2504  IpFilterDriver - ok
14:59:55.0540 2504  [ 4d65a07b795d6674312f879d09aa7663 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
14:59:55.0681 2504  iphlpsvc - ok
14:59:55.0712 2504  [ 4bd7134618c1d2a27466a099062547bf ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
14:59:55.0774 2504  IPMIDRV - ok
14:59:55.0805 2504  [ a5fa468d67abcdaa36264e463a7bb0cd ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
14:59:55.0930 2504  IPNAT - ok
14:59:55.0977 2504  [ 42996cff20a3084a56017b7902307e9f ] IRENUM          C:\Windows\system32\drivers\irenum.sys
14:59:56.0071 2504  IRENUM - ok
14:59:56.0133 2504  [ 1f32bb6b38f62f7df1a7ab7292638a35 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
14:59:56.0180 2504  isapnp - ok
14:59:56.0242 2504  [ cb7a9abb12b8415bce5d74994c7ba3ae ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
14:59:56.0289 2504  iScsiPrt - ok
14:59:56.0336 2504  [ adef52ca1aeae82b50df86b56413107e ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
14:59:56.0398 2504  kbdclass - ok
14:59:56.0445 2504  [ 9e3ced91863e6ee98c24794d05e27a71 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
14:59:56.0507 2504  kbdhid - ok
14:59:56.0539 2504  [ 81951f51e318aecc2d68559e47485cc4 ] KeyIso          C:\Windows\system32\lsass.exe
14:59:56.0601 2504  KeyIso - ok
14:59:56.0648 2504  [ b7895b4182c0d16f6efadeb8081e8d36 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
14:59:56.0695 2504  KSecDD - ok
14:59:56.0741 2504  [ d30159ac9237519fbc62c6ec247d2d46 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
14:59:56.0788 2504  KSecPkg - ok
14:59:56.0851 2504  [ 89a7b9cc98d0d80c6f31b91c0a310fcd ] KtmRm          C:\Windows\system32\msdtckrm.dll
14:59:56.0975 2504  KtmRm - ok
14:59:57.0022 2504  [ b86270cc948ead6481ac487d65ddb462 ] L1C            C:\Windows\system32\DRIVERS\L1C62x86.sys
14:59:57.0069 2504  L1C - ok
14:59:57.0147 2504  [ d64af876d53eca3668bb97b51b4e70ab ] LanmanServer    C:\Windows\system32\srvsvc.dll
14:59:57.0287 2504  LanmanServer - ok
14:59:57.0319 2504  [ 58405e4f68ba8e4057c6e914f326aba2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:59:57.0459 2504  LanmanWorkstation - ok
14:59:57.0537 2504  [ f7611ec07349979da9b0ae1f18ccc7a6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
14:59:57.0646 2504  lltdio - ok
14:59:57.0693 2504  [ 5700673e13a2117fa3b9020c852c01e2 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
14:59:57.0818 2504  lltdsvc - ok
14:59:57.0849 2504  [ 55ca01ba19d0006c8f2639b6c045e08b ] lmhosts        C:\Windows\System32\lmhsvc.dll
14:59:57.0958 2504  lmhosts - ok
14:59:57.0989 2504  [ eb119a53ccf2acc000ac71b065b78fef ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
14:59:58.0052 2504  LSI_FC - ok
14:59:58.0083 2504  [ 8ade1c877256a22e49b75d1cc9161f9c ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
14:59:58.0130 2504  LSI_SAS - ok
14:59:58.0161 2504  [ dc9dc3d3daa0e276fd2ec262e38b11e9 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
14:59:58.0208 2504  LSI_SAS2 - ok
14:59:58.0223 2504  [ 0a036c7d7cab643a7f07135ac47e0524 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
14:59:58.0286 2504  LSI_SCSI - ok
14:59:58.0317 2504  [ 6703e366cc18d3b6e534f5cf7df39cee ] luafv          C:\Windows\system32\drivers\luafv.sys
14:59:58.0411 2504  luafv - ok
14:59:58.0504 2504  [ 59a2783aba6019bed0c843c706e10a6a ] massfilter      C:\Windows\system32\drivers\massfilter.sys
14:59:58.0582 2504  massfilter - ok
14:59:58.0645 2504  [ 6dfe7f2e8e8a337263aa5c92a215f161 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
14:59:58.0691 2504  MBAMProtector - ok
14:59:58.0754 2504  [ 43683e970f008c93c9429ef428147a54 ] MBAMService    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
14:59:58.0832 2504  MBAMService - ok
14:59:58.0894 2504  [ bfb9ee8ee977efe85d1a3105abef6dd1 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
14:59:58.0957 2504  Mcx2Svc - ok
14:59:59.0019 2504  [ 0fff5b045293002ab38eb1fd1fc2fb74 ] megasas        C:\Windows\system32\drivers\megasas.sys
14:59:59.0097 2504  megasas - ok
14:59:59.0144 2504  [ dcbab2920c75f390caf1d29f675d03d6 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
14:59:59.0206 2504  MegaSR - ok
14:59:59.0253 2504  [ 146b6f43a673379a3c670e86d89be5ea ] MMCSS          C:\Windows\system32\mmcss.dll
14:59:59.0393 2504  MMCSS - ok
14:59:59.0440 2504  [ f001861e5700ee84e2d4e52c712f4964 ] Modem          C:\Windows\system32\drivers\modem.sys
14:59:59.0565 2504  Modem - ok
14:59:59.0612 2504  [ 79d10964de86b292320e9dfe02282a23 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
14:59:59.0705 2504  monitor - ok
14:59:59.0768 2504  [ fb18cc1d4c2e716b6b903b0ac0cc0609 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
14:59:59.0799 2504  mouclass - ok
14:59:59.0861 2504  [ 2c388d2cd01c9042596cf3c8f3c7b24d ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
14:59:59.0939 2504  mouhid - ok
15:00:00.0002 2504  [ fc8771f45ecccfd89684e38842539b9b ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
15:00:00.0033 2504  mountmgr - ok
15:00:00.0236 2504  [ 46297fa8e30a6007f14118fc2b942fbc ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
15:00:00.0392 2504  MozillaMaintenance - ok
15:00:00.0439 2504  [ 2d699fb6e89ce0d8da14ecc03b3edfe0 ] mpio            C:\Windows\system32\drivers\mpio.sys
15:00:00.0485 2504  mpio - ok
15:00:00.0532 2504  [ ad2723a7b53dd1aacae6ad8c0bfbf4d0 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
15:00:00.0673 2504  mpsdrv - ok
15:00:00.0922 2504  [ 9835584e999d25004e1ee8e5f3e3b881 ] MpsSvc          C:\Windows\system32\mpssvc.dll
15:00:01.0375 2504  MpsSvc - ok
15:00:01.0421 2504  [ ceb46ab7c01c9f825f8cc6babc18166a ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
15:00:01.0546 2504  MRxDAV - ok
15:00:01.0609 2504  [ 5d16c921e3671636c0eba3bbaac5fd25 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
15:00:01.0749 2504  mrxsmb - ok
15:00:01.0827 2504  [ 6d17a4791aca19328c685d256349fefc ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:00:01.0905 2504  mrxsmb10 - ok
15:00:01.0967 2504  [ b81f204d146000be76651a50670a5e9e ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:00:02.0045 2504  mrxsmb20 - ok
15:00:02.0108 2504  [ 012c5f4e9349e711e11e0f19a8589f0a ] msahci          C:\Windows\system32\drivers\msahci.sys
15:00:02.0155 2504  msahci - ok
15:00:02.0201 2504  [ 55055f8ad8be27a64c831322a780a228 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
15:00:02.0279 2504  msdsm - ok
15:00:02.0326 2504  [ e1bce74a3bd9902b72599c0192a07e27 ] MSDTC          C:\Windows\System32\msdtc.exe
15:00:02.0389 2504  MSDTC - ok
15:00:02.0482 2504  [ daefb28e3af5a76abcc2c3078c07327f ] Msfs            C:\Windows\system32\drivers\Msfs.sys
15:00:02.0591 2504  Msfs - ok
15:00:02.0638 2504  [ 3e1e5767043c5af9367f0056295e9f84 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
15:00:02.0732 2504  mshidkmdf - ok
15:00:02.0779 2504  [ 0a4e5757ae09fa9622e3158cc1aef114 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
15:00:02.0825 2504  msisadrv - ok
15:00:02.0888 2504  [ 90f7d9e6b6f27e1a707d4a297f077828 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
15:00:03.0013 2504  MSiSCSI - ok
15:00:03.0028 2504  msiserver - ok
15:00:03.0106 2504  [ 8c0860d6366aaffb6c5bb9df9448e631 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
15:00:03.0231 2504  MSKSSRV - ok
15:00:03.0262 2504  [ 3ea8b949f963562cedbb549eac0c11ce ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
15:00:03.0418 2504  MSPCLOCK - ok
15:00:03.0481 2504  [ f456e973590d663b1073e9c463b40932 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
15:00:03.0590 2504  MSPQM - ok
15:00:03.0699 2504  [ 0e008fc4819d238c51d7c93e7b41e560 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
15:00:03.0777 2504  MsRPC - ok
15:00:03.0855 2504  [ fc6b9ff600cc585ea38b12589bd4e246 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
15:00:03.0917 2504  mssmbios - ok
15:00:03.0964 2504  [ b42c6b921f61a6e55159b8be6cd54a36 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
15:00:04.0089 2504  MSTEE - ok
15:00:04.0136 2504  [ 33599130f44e1f34631cea241de8ac84 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
15:00:04.0245 2504  MTConfig - ok
15:00:04.0276 2504  [ 159fad02f64e6381758c990f753bcc80 ] Mup            C:\Windows\system32\Drivers\mup.sys
15:00:04.0323 2504  Mup - ok
15:00:04.0370 2504  [ cb47c414e083ca6e50e634b148f28f64 ] mwlPSDFilter    C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
15:00:04.0417 2504  mwlPSDFilter - ok
15:00:04.0432 2504  [ 647b953019559bff07536f5c6121f333 ] mwlPSDNServ    C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
15:00:04.0479 2504  mwlPSDNServ - ok
15:00:04.0510 2504  [ 5a236a36db8687d1e64dc81c03eaabe1 ] mwlPSDVDisk    C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
15:00:04.0557 2504  mwlPSDVDisk - ok
15:00:04.0682 2504  [ 0036634e5c92be109056f7e2380103a9 ] MWLService      C:\Program Files\EgisTec MyWinLocker\x86\MWLService.exe
15:00:04.0729 2504  MWLService - ok
15:00:04.0791 2504  [ 61d57a5d7c6d9afe10e77dae6e1b445e ] napagent        C:\Windows\system32\qagentRT.dll
15:00:04.0916 2504  napagent - ok
15:00:04.0994 2504  [ 26384429fcd85d83746f63e798ab1480 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
15:00:05.0056 2504  NativeWifiP - ok
15:00:05.0119 2504  [ e7c54812a2aaf43316eb6930c1ffa108 ] NDIS            C:\Windows\system32\drivers\ndis.sys
15:00:05.0212 2504  NDIS - ok
15:00:05.0275 2504  [ 0e1787aa6c9191d3d319e8bafe86f80c ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
15:00:05.0368 2504  NdisCap - ok
15:00:05.0415 2504  [ e4a8aec125a2e43a9e32afeea7c9c888 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
15:00:05.0524 2504  NdisTapi - ok
15:00:05.0587 2504  [ d8a65dafb3eb41cbb622745676fcd072 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
15:00:05.0696 2504  Ndisuio - ok
15:00:05.0743 2504  [ 38fbe267e7e6983311179230facb1017 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
15:00:05.0852 2504  NdisWan - ok
15:00:05.0899 2504  [ a4bdc541e69674fbff1a8ff00be913f2 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
15:00:06.0023 2504  NDProxy - ok
15:00:06.0086 2504  [ 80b275b1ce3b0e79909db7b39af74d51 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
15:00:06.0211 2504  NetBIOS - ok
15:00:06.0257 2504  [ 280122ddcf04b378edd1ad54d71c1e54 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
15:00:06.0382 2504  NetBT - ok
15:00:06.0429 2504  [ 81951f51e318aecc2d68559e47485cc4 ] Netlogon        C:\Windows\system32\lsass.exe
15:00:06.0476 2504  Netlogon - ok
15:00:06.0538 2504  [ 7cccfca7510684768da22092d1fa4db2 ] Netman          C:\Windows\System32\netman.dll
15:00:06.0647 2504  Netman - ok
15:00:06.0679 2504  [ 8c338238c16777a802d6a9211eb2ba50 ] netprofm        C:\Windows\System32\netprofm.dll
15:00:06.0803 2504  netprofm - ok
15:00:06.0866 2504  [ f476ec40033cdb91efbe73eb99b8362d ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
15:00:06.0913 2504  NetTcpPortSharing - ok
15:00:06.0975 2504  [ 1d85c4b390b0ee09c7a46b91efb2c097 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
15:00:07.0037 2504  nfrd960 - ok
15:00:07.0100 2504  [ 912084381d30d8b89ec4e293053f4710 ] NlaSvc          C:\Windows\System32\nlasvc.dll
15:00:07.0225 2504  NlaSvc - ok
15:00:07.0240 2504  [ 1db262a9f8c087e8153d89bef3d2235f ] Npfs            C:\Windows\system32\drivers\Npfs.sys
15:00:07.0365 2504  Npfs - ok
15:00:07.0396 2504  [ ba387e955e890c8a88306d9b8d06bf17 ] nsi            C:\Windows\system32\nsisvc.dll
15:00:07.0505 2504  nsi - ok
15:00:07.0552 2504  [ e9a0a4d07e53d8fea2bb8387a3293c58 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
15:00:07.0646 2504  nsiproxy - ok
15:00:07.0724 2504  [ 81189c3d7763838e55c397759d49007a ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
15:00:07.0849 2504  Ntfs - ok
15:00:07.0911 2504  [ f9756a98d69098dca8945d62858a812c ] Null            C:\Windows\system32\drivers\Null.sys
15:00:08.0020 2504  Null - ok
15:00:08.0067 2504  [ b3e25ee28883877076e0e1ff877d02e0 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
15:00:08.0114 2504  nvraid - ok
15:00:08.0145 2504  [ 4380e59a170d88c4f1022eff6719a8a4 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
15:00:08.0207 2504  nvstor - ok
15:00:08.0270 2504  [ 5a0983915f02bae73267cc2a041f717d ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
15:00:08.0317 2504  nv_agp - ok
15:00:08.0410 2504  [ 785f487a64950f3cb8e9f16253ba3b7b ] odserv          C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
15:00:08.0488 2504  odserv - ok
15:00:08.0535 2504  [ 08a70a1f2cdde9bb49b885cb817a66eb ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
15:00:08.0613 2504  ohci1394 - ok
15:00:08.0675 2504  [ 5a432a042dae460abe7199b758e8606c ] ose            C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
15:00:08.0722 2504  ose - ok
15:00:08.0785 2504  [ 82a8521ddc60710c3d3d3e7325209bec ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
15:00:08.0909 2504  p2pimsvc - ok
15:00:08.0972 2504  [ 59c3ddd501e39e006dac31bf55150d91 ] p2psvc          C:\Windows\system32\p2psvc.dll
15:00:09.0050 2504  p2psvc - ok
15:00:09.0097 2504  [ 2ea877ed5dd9713c5ac74e8ea7348d14 ] Parport        C:\Windows\system32\drivers\parport.sys
15:00:09.0159 2504  Parport - ok
15:00:09.0190 2504  [ 3f34a1b4c5f6475f320c275e63afce9b ] partmgr        C:\Windows\system32\drivers\partmgr.sys
15:00:09.0237 2504  partmgr - ok
15:00:09.0284 2504  [ eb0a59f29c19b86479d36b35983daadc ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
15:00:09.0362 2504  Parvdm - ok
15:00:09.0393 2504  [ 358ab7956d3160000726574083dfc8a6 ] PcaSvc          C:\Windows\System32\pcasvc.dll
15:00:09.0455 2504  PcaSvc - ok
15:00:09.0502 2504  [ 673e55c3498eb970088e812ea820aa8f ] pci            C:\Windows\system32\drivers\pci.sys
15:00:09.0549 2504  pci - ok
15:00:09.0596 2504  [ afe86f419014db4e5593f69ffe26ce0a ] pciide          C:\Windows\system32\drivers\pciide.sys
15:00:09.0643 2504  pciide - ok
15:00:09.0705 2504  [ f396431b31693e71e8a80687ef523506 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
15:00:09.0752 2504  pcmcia - ok
15:00:09.0799 2504  [ 250f6b43d2b613172035c6747aeeb19f ] pcw            C:\Windows\system32\drivers\pcw.sys
15:00:09.0845 2504  pcw - ok
15:00:09.0892 2504  [ 9e0104ba49f4e6973749a02bf41344ed ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
15:00:10.0017 2504  PEAUTH - ok
15:00:10.0189 2504  [ af4d64d2a57b9772cf3801950b8058a6 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
15:00:10.0360 2504  PeerDistSvc - ok
15:00:10.0532 2504  [ 414bba67a3ded1d28437eb66aeb8a720 ] pla            C:\Windows\system32\pla.dll
15:00:10.0703 2504  pla - ok
15:00:10.0766 2504  [ ec7bc28d207da09e79b3e9faf8b232ca ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
15:00:10.0875 2504  PlugPlay - ok
15:00:10.0937 2504  [ 63ff8572611249931eb16bb8eed6afc8 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
15:00:11.0015 2504  PNRPAutoReg - ok
15:00:11.0047 2504  [ 82a8521ddc60710c3d3d3e7325209bec ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
15:00:11.0109 2504  PNRPsvc - ok
15:00:11.0156 2504  [ 53946b69ba0836bd95b03759530c81ec ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
15:00:11.0296 2504  PolicyAgent - ok
15:00:11.0359 2504  [ f87d30e72e03d579a5199ccb3831d6ea ] Power          C:\Windows\system32\umpo.dll
15:00:11.0452 2504  Power - ok
15:00:11.0515 2504  [ 631e3e205ad6d86f2aed6a4a8e69f2db ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
15:00:11.0639 2504  PptpMiniport - ok
15:00:11.0671 2504  [ 85b1e3a0c7585bc4aae6899ec6fcf011 ] Processor      C:\Windows\system32\drivers\processr.sys
15:00:11.0733 2504  Processor - ok
15:00:11.0827 2504  [ cadefac453040e370a1bdff3973be00d ] ProfSvc        C:\Windows\system32\profsvc.dll
15:00:11.0920 2504  ProfSvc - ok
15:00:11.0951 2504  [ 81951f51e318aecc2d68559e47485cc4 ] ProtectedStorage C:\Windows\system32\lsass.exe
15:00:12.0014 2504  ProtectedStorage - ok
15:00:12.0061 2504  [ 6270ccae2a86de6d146529fe55b3246a ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
15:00:12.0170 2504  Psched - ok
15:00:12.0248 2504  [ ab95ecf1f6659a60ddc166d8315b0751 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
15:00:12.0388 2504  ql2300 - ok
15:00:12.0419 2504  [ b4dd51dd25182244b86737dc51af2270 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
15:00:12.0466 2504  ql40xx - ok
15:00:12.0529 2504  [ 31ac809e7707eb580b2bdb760390765a ] QWAVE          C:\Windows\system32\qwave.dll
15:00:12.0622 2504  QWAVE - ok
15:00:12.0653 2504  [ 584078ca1b95ca72df2a27c336f9719d ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
15:00:12.0716 2504  QWAVEdrv - ok
15:00:12.0763 2504  [ 30a81b53c766d0133bb86d234e5556ab ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
15:00:12.0872 2504  RasAcd - ok
15:00:12.0919 2504  [ 57ec4aef73660166074d8f7f31c0d4fd ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
15:00:13.0012 2504  RasAgileVpn - ok
15:00:13.0059 2504  [ a60f1839849c0c00739787fd5ec03f13 ] RasAuto        C:\Windows\System32\rasauto.dll
15:00:13.0168 2504  RasAuto - ok
15:00:13.0199 2504  [ d9f91eafec2815365cbe6d167e4e332a ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
15:00:13.0309 2504  Rasl2tp - ok
15:00:13.0371 2504  [ cb9e04dc05eacf5b9a36ca276d475006 ] RasMan          C:\Windows\System32\rasmans.dll
15:00:13.0527 2504  RasMan - ok
15:00:13.0589 2504  [ 0fe8b15916307a6ac12bfb6a63e45507 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
15:00:13.0699 2504  RasPppoe - ok
15:00:13.0730 2504  [ 44101f495a83ea6401d886e7fd70096b ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
15:00:13.0839 2504  RasSstp - ok
15:00:13.0886 2504  [ d528bc58a489409ba40334ebf96a311b ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
15:00:14.0011 2504  rdbss - ok
15:00:14.0042 2504  [ 0d8f05481cb76e70e1da06ee9f0da9df ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
15:00:14.0104 2504  rdpbus - ok
15:00:14.0182 2504  [ 23dae03f29d253ae74c44f99e515f9a1 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
15:00:14.0291 2504  RDPCDD - ok
15:00:14.0338 2504  [ b973fcfc50dc1434e1970a146f7e3885 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
15:00:14.0447 2504  RDPDR - ok
15:00:14.0479 2504  [ 5a53ca1598dd4156d44196d200c94b8a ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
15:00:14.0603 2504  RDPENCDD - ok
15:00:14.0666 2504  [ 44b0a53cd4f27d50ed461dae0c0b4e1f ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
15:00:14.0759 2504  RDPREFMP - ok
15:00:14.0806 2504  [ f031683e6d1fea157abb2ff260b51e61 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
15:00:14.0884 2504  RDPWD - ok
15:00:14.0947 2504  [ 518395321dc96fe2c9f0e96ac743b656 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
15:00:14.0993 2504  rdyboost - ok
15:00:15.0056 2504  [ 7b5e1419717fac363a31cc302895217a ] RemoteAccess    C:\Windows\System32\mprdim.dll
15:00:15.0165 2504  RemoteAccess - ok
15:00:15.0196 2504  [ cb9a8683f4ef2bf99e123d79950d7935 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
15:00:15.0321 2504  RemoteRegistry - ok
15:00:15.0368 2504  [ cb928d9e6daf51879dd6ba8d02f01321 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
15:00:15.0430 2504  RFCOMM - ok
15:00:15.0493 2504  [ 78d072f35bc45d9e4e1b61895c152234 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
15:00:15.0602 2504  RpcEptMapper - ok
15:00:15.0649 2504  [ 94d36c0e44677dd26981d2bfeef2a29d ] RpcLocator      C:\Windows\system32\locator.exe
15:00:15.0695 2504  RpcLocator - ok
15:00:15.0727 2504  [ 7660f01d3b38aca1747e397d21d790af ] RpcSs          C:\Windows\system32\rpcss.dll
15:00:15.0851 2504  RpcSs - ok
15:00:15.0914 2504  [ 032b0d36ad92b582d869879f5af5b928 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
15:00:16.0039 2504  rspndr - ok
15:00:16.0132 2504  [ 7cb9f0fdd730f4a4ecf6cde15ea12e8a ] RS_Service      C:\Program Files\Acer\Acer VCM\RS_Service.exe
15:00:16.0179 2504  RS_Service - ok
15:00:16.0195 2504  [ 81951f51e318aecc2d68559e47485cc4 ] SamSs          C:\Windows\system32\lsass.exe
15:00:16.0257 2504  SamSs - ok
15:00:16.0304 2504  [ 05d860da1040f111503ac416ccef2bca ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
15:00:16.0351 2504  sbp2port - ok
15:00:16.0429 2504  [ 8fc518ffe9519c2631d37515a68009c4 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
15:00:16.0538 2504  SCardSvr - ok
15:00:16.0553 2504  [ 0693b5ec673e34dc147e195779a4dcf6 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
15:00:16.0678 2504  scfilter - ok
15:00:16.0725 2504  [ a04bb13f8a72f8b6e8b4071723e4e336 ] Schedule        C:\Windows\system32\schedsvc.dll
15:00:16.0865 2504  Schedule - ok
15:00:16.0897 2504  [ 319c6b309773d063541d01df8ac6f55f ] SCPolicySvc    C:\Windows\System32\certprop.dll
15:00:17.0006 2504  SCPolicySvc - ok
15:00:17.0053 2504  [ 08236c4bce5edd0a0318a438af28e0f7 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
15:00:17.0146 2504  SDRSVC - ok
15:00:17.0209 2504  [ 90a3935d05b494a5a39d37e71f09a677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
15:00:17.0318 2504  secdrv - ok
15:00:17.0365 2504  [ a59b3a4442c52060cc7a85293aa3546f ] seclogon        C:\Windows\system32\seclogon.dll
15:00:17.0489 2504  seclogon - ok
15:00:17.0505 2504  [ dcb7fcdcc97f87360f75d77425b81737 ] SENS            C:\Windows\System32\sens.dll
15:00:17.0630 2504  SENS - ok
15:00:17.0708 2504  [ 50087fe1ee447009c9cc2997b90de53f ] SensrSvc        C:\Windows\system32\sensrsvc.dll
15:00:17.0817 2504  SensrSvc - ok
15:00:17.0879 2504  [ 9ad8b8b515e3df6acd4212ef465de2d1 ] Serenum        C:\Windows\system32\drivers\serenum.sys
15:00:17.0942 2504  Serenum - ok
15:00:17.0973 2504  [ 5fb7fcea0490d821f26f39cc5ea3d1e2 ] Serial          C:\Windows\system32\drivers\serial.sys
15:00:18.0035 2504  Serial - ok
15:00:18.0067 2504  [ 79bffb520327ff916a582dfea17aa813 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
15:00:18.0129 2504  sermouse - ok
15:00:18.0191 2504  [ 4ae380f39a0032eab7dd953030b26d28 ] SessionEnv      C:\Windows\system32\sessenv.dll
15:00:18.0332 2504  SessionEnv - ok
15:00:18.0363 2504  [ 9f976e1eb233df46fce808d9dea3eb9c ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
15:00:18.0441 2504  sffdisk - ok
15:00:18.0472 2504  [ 932a68ee27833cfd57c1639d375f2731 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
15:00:18.0535 2504  sffp_mmc - ok
15:00:18.0550 2504  [ 6d4ccaedc018f1cf52866bbbaa235982 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
15:00:18.0613 2504  sffp_sd - ok
15:00:18.0644 2504  [ db96666cc8312ebc45032f30b007a547 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
15:00:18.0706 2504  sfloppy - ok
15:00:18.0753 2504  [ d1a079a0de2ea524513b6930c24527a2 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
15:00:18.0925 2504  SharedAccess - ok
15:00:18.0987 2504  [ 414da952a35bf5d50192e28263b40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
15:00:19.0112 2504  ShellHWDetection - ok
15:00:19.0159 2504  [ 2565cac0dc9fe0371bdce60832582b2e ] sisagp          C:\Windows\system32\drivers\sisagp.sys
15:00:19.0205 2504  sisagp - ok
15:00:19.0268 2504  [ a9f0486851becb6dda1d89d381e71055 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
15:00:19.0315 2504  SiSRaid2 - ok
15:00:19.0361 2504  [ 3727097b55738e2f554972c3be5bc1aa ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
15:00:19.0408 2504  SiSRaid4 - ok
15:00:19.0471 2504  [ 3e21c083b8a01cb70ba1f09303010fce ] Smb            C:\Windows\system32\DRIVERS\smb.sys
15:00:19.0580 2504  Smb - ok
15:00:19.0658 2504  [ 6a984831644eca1a33ffeae4126f4f37 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
15:00:19.0720 2504  SNMPTRAP - ok
15:00:19.0751 2504  [ 95cf1ae7527fb70f7816563cbc09d942 ] spldr          C:\Windows\system32\drivers\spldr.sys
15:00:19.0783 2504  spldr - ok
15:00:19.0845 2504  [ 9aea093b8f9c37cf45538382caba2475 ] Spooler        C:\Windows\System32\spoolsv.exe
15:00:19.0954 2504  Spooler - ok
15:00:20.0079 2504  [ cf87a1de791347e75b98885214ced2b8 ] sppsvc          C:\Windows\system32\sppsvc.exe
15:00:20.0375 2504  sppsvc - ok
15:00:20.0422 2504  [ b0180b20b065d89232a78a40fe56eaa6 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
15:00:20.0578 2504  sppuinotify - ok
15:00:20.0641 2504  [ e4c2764065d66ea1d2d3ebc28fe99c46 ] srv            C:\Windows\system32\DRIVERS\srv.sys
15:00:20.0719 2504  srv - ok
15:00:20.0765 2504  [ 03f0545bd8d4c77fa0ae1ceedfcc71ab ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
15:00:20.0843 2504  srv2 - ok
15:00:20.0921 2504  [ be6bd660caa6f291ae06a718a4fa8abc ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
15:00:20.0968 2504  srvnet - ok
15:00:21.0015 2504  [ d887c9fd02ac9fa880f6e5027a43e118 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
15:00:21.0140 2504  SSDPSRV - ok
15:00:21.0202 2504  [ a36ee93698802cd899f98bfd553d8185 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
15:00:21.0233 2504  ssmdrv - ok
15:00:21.0280 2504  [ d318f23be45d5e3a107469eb64815b50 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
15:00:21.0389 2504  SstpSvc - ok
15:00:21.0452 2504  [ db32d325c192b801df274bfd12a7e72b ] stexstor        C:\Windows\system32\drivers\stexstor.sys
15:00:21.0499 2504  stexstor - ok
15:00:21.0545 2504  [ e1fb3706030fb4578a0d72c2fc3689e4 ] StiSvc          C:\Windows\System32\wiaservc.dll
15:00:21.0655 2504  StiSvc - ok
15:00:21.0748 2504  [ 0bf669f0a910beda4a32258d363af2a5 ] StorSvc        C:\Windows\system32\storsvc.dll
15:00:21.0842 2504  StorSvc - ok
15:00:21.0873 2504  [ e58c78a848add9610a4db6d214af5224 ] swenum          C:\Windows\system32\drivers\swenum.sys
15:00:21.0920 2504  swenum - ok
15:00:21.0967 2504  [ a28bd92df340e57b024ba433165d34d7 ] swprv          C:\Windows\System32\swprv.dll
15:00:22.0076 2504  swprv - ok
15:00:22.0154 2504  [ 5cdd124913e91c7f79b4d5cae1c7c4de ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
15:00:22.0201 2504  SynTP - ok
15:00:22.0279 2504  [ 36650d618ca34c9d357dfd3d89b2c56f ] SysMain        C:\Windows\system32\sysmain.dll
15:00:22.0419 2504  SysMain - ok
15:00:22.0466 2504  [ 763fecdc3d30c815fe72dd57936c6cd1 ] TabletInputService C:\Windows\System32\TabSvc.dll
15:00:22.0575 2504  TabletInputService - ok
15:00:22.0622 2504  [ 613bf4820361543956909043a265c6ac ] TapiSrv        C:\Windows\System32\tapisrv.dll
15:00:22.0747 2504  TapiSrv - ok
15:00:22.0778 2504  [ b799d9fdb26111737f58288d8dc172d9 ] TBS            C:\Windows\System32\tbssvc.dll
15:00:22.0918 2504  TBS - ok
15:00:22.0996 2504  [ 7fa2e0f8b072bd04b77b421480b6cc22 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
15:00:23.0152 2504  Tcpip - ok
15:00:23.0261 2504  [ 7fa2e0f8b072bd04b77b421480b6cc22 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
15:00:23.0371 2504  TCPIP6 - ok
15:00:23.0433 2504  [ cca24162e055c3714ce5a88b100c64ed ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
15:00:23.0527 2504  tcpipreg - ok
15:00:23.0573 2504  [ 1cb91b2bd8f6dd367dfc2ef26fd751b2 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
15:00:23.0651 2504  TDPIPE - ok
15:00:23.0667 2504  [ 2c2c5afe7ee4f620d69c23c0617651a8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
15:00:23.0761 2504  TDTCP - ok
15:00:23.0823 2504  [ b459575348c20e8121d6039da063c704 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
15:00:23.0932 2504  tdx - ok
15:00:23.0979 2504  [ 04dbf4b01ea4bf25a9a3e84affac9b20 ] TermDD          C:\Windows\system32\drivers\termdd.sys
15:00:24.0026 2504  TermDD - ok
15:00:24.0104 2504  [ 382c804c92811be57829d8e550a900e2 ] TermService    C:\Windows\System32\termsrv.dll
15:00:24.0244 2504  TermService - ok
15:00:24.0291 2504  [ 42fb6afd6b79d9fe07381609172e7ca4 ] Themes          C:\Windows\system32\themeservice.dll
15:00:24.0369 2504  Themes - ok
15:00:24.0400 2504  [ 146b6f43a673379a3c670e86d89be5ea ] THREADORDER    C:\Windows\system32\mmcss.dll
15:00:24.0509 2504  THREADORDER - ok
15:00:24.0572 2504  [ 4792c0378db99a9bc2ae2de6cfff0c3a ] TrkWks          C:\Windows\System32\trkwks.dll
15:00:24.0697 2504  TrkWks - ok
15:00:24.0775 2504  [ 2c49b175aee1d4364b91b531417fe583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
15:00:24.0899 2504  TrustedInstaller - ok
15:00:24.0946 2504  [ 254bb140eee3c59d6114c1a86b636877 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
15:00:25.0087 2504  tssecsrv - ok
15:00:25.0149 2504  [ fd1d6c73e6333be727cbcc6054247654 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
15:00:25.0227 2504  TsUsbFlt - ok
15:00:25.0321 2504  [ b2fa25d9b17a68bb93d58b0556e8c90d ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
15:00:25.0430 2504  tunnel - ok
15:00:25.0477 2504  [ 750fbcb269f4d7dd2e420c56b795db6d ] uagp35          C:\Windows\system32\drivers\uagp35.sys
15:00:25.0523 2504  uagp35 - ok
15:00:25.0570 2504  [ ee43346c7e4b5e63e54f927babbb32ff ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
15:00:25.0679 2504  udfs - ok
15:00:25.0789 2504  [ fb20e2ba7cdf44b457939246647bdf65 ] UI Assistant Service C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
15:00:25.0835 2504  UI Assistant Service - ok
15:00:25.0898 2504  [ 8344fd4fce927880aa1aa7681d4927e5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
15:00:25.0960 2504  UI0Detect - ok
15:00:26.0038 2504  [ 44e8048ace47befbfdc2e9be4cbc8880 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
15:00:26.0085 2504  uliagpkx - ok
15:00:26.0163 2504  [ d295bed4b898f0fd999fcfa9b32b071b ] umbus          C:\Windows\system32\drivers\umbus.sys
15:00:26.0225 2504  umbus - ok
15:00:26.0257 2504  [ 7550ad0c6998ba1cb4843e920ee0feac ] UmPass          C:\Windows\system32\drivers\umpass.sys
15:00:26.0319 2504  UmPass - ok
15:00:26.0397 2504  [ 409994a8eaceee4e328749c0353527a0 ] UmRdpService    C:\Windows\System32\umrdp.dll
15:00:26.0491 2504  UmRdpService - ok
15:00:26.0553 2504  [ f9ec9acd504d823d9b9ca98a4f8d3ca2 ] Updater Service C:\Program Files\Acer\Acer Updater\UpdaterService.exe
15:00:26.0600 2504  Updater Service - ok
15:00:26.0662 2504  [ 833fbb672460efce8011d262175fad33 ] upnphost        C:\Windows\System32\upnphost.dll
15:00:26.0803 2504  upnphost - ok
15:00:26.0849 2504  [ bd9c55d7023c5de374507acc7a14e2ac ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
15:00:26.0927 2504  usbccgp - ok
15:00:26.0990 2504  [ 04ec7cec62ec3b6d9354eee93327fc82 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
15:00:27.0037 2504  usbcir - ok
15:00:27.0068 2504  [ f92de757e4b7ce9c07c5e65423f3ae3b ] usbehci        C:\Windows\system32\drivers\usbehci.sys
15:00:27.0115 2504  usbehci - ok
15:00:27.0146 2504  [ 8dc94aec6a7e644a06135ae7506dc2e9 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
15:00:27.0208 2504  usbhub - ok
15:00:27.0239 2504  [ e185d44fac515a18d9deddc23c2cdf44 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
15:00:27.0302 2504  usbohci - ok
15:00:27.0349 2504  [ 797d862fe0875e75c7cc4c1ad7b30252 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
15:00:27.0427 2504  usbprint - ok
15:00:27.0473 2504  [ 576096ccbc07e7c4ea4f5e6686d6888f ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
15:00:27.0583 2504  usbscan - ok
15:00:27.0629 2504  [ f991ab9cc6b908db552166768176896a ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:00:27.0723 2504  USBSTOR - ok
15:00:27.0754 2504  [ 68df884cf41cdada664beb01daf67e3d ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
15:00:27.0817 2504  usbuhci - ok
15:00:27.0848 2504  [ 45f4e7bf43db40a6c6b4d92c76cbc3f2 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
15:00:27.0926 2504  usbvideo - ok
15:00:27.0973 2504  [ 081e6e1c91aec36758902a9f727cd23c ] UxSms          C:\Windows\System32\uxsms.dll
15:00:28.0113 2504  UxSms - ok
15:00:28.0144 2504  [ 81951f51e318aecc2d68559e47485cc4 ] VaultSvc        C:\Windows\system32\lsass.exe
15:00:28.0191 2504  VaultSvc - ok
15:00:28.0253 2504  [ a059c4c3edb09e07d21a8e5c0aabd3cb ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
15:00:28.0300 2504  vdrvroot - ok
15:00:28.0363 2504  [ c3cd30495687c2a2f66a65ca6fd89be9 ] vds            C:\Windows\System32\vds.exe
15:00:28.0519 2504  vds - ok
15:00:28.0550 2504  [ 17c408214ea61696cec9c66e388b14f3 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
15:00:28.0628 2504  vga - ok
15:00:28.0643 2504  [ 8e38096ad5c8570a6f1570a61e251561 ] VgaSave        C:\Windows\System32\drivers\vga.sys
15:00:28.0753 2504  VgaSave - ok
15:00:28.0815 2504  [ 5461686cca2fda57b024547733ab42e3 ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
15:00:28.0862 2504  vhdmp - ok
15:00:28.0909 2504  [ c829317a37b4bea8f39735d4b076e923 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
15:00:28.0971 2504  viaagp - ok
15:00:29.0002 2504  [ e02f079a6aa107f06b16549c6e5c7b74 ] ViaC7          C:\Windows\system32\drivers\viac7.sys
15:00:29.0080 2504  ViaC7 - ok
15:00:29.0111 2504  [ e43574f6a56a0ee11809b48c09e4fd3c ] viaide          C:\Windows\system32\drivers\viaide.sys
15:00:29.0174 2504  viaide - ok
15:00:29.0205 2504  [ 4c63e00f2f4b5f86ab48a58cd990f212 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
15:00:29.0252 2504  volmgr - ok
15:00:29.0314 2504  [ b5bb72067ddddbbfb04b2f89ff8c3c87 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
15:00:29.0377 2504  volmgrx - ok
15:00:29.0423 2504  [ f497f67932c6fa693d7de2780631cfe7 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
15:00:29.0501 2504  volsnap - ok
15:00:29.0564 2504  [ 9dfa0cc2f8855a04816729651175b631 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
15:00:29.0626 2504  vsmraid - ok
15:00:29.0689 2504  [ 209a3b1901b83aeb8527ed211cce9e4c ] VSS            C:\Windows\system32\vssvc.exe
15:00:29.0876 2504  VSS - ok
15:00:29.0891 2504  [ 90567b1e658001e79d7c8bbd3dde5aa6 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
15:00:30.0001 2504  vwifibus - ok
15:00:30.0032 2504  [ 7090d3436eeb4e7da3373090a23448f7 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
15:00:30.0110 2504  vwififlt - ok
15:00:30.0141 2504  [ a3f04cbea6c2a10e6cb01f8b47611882 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
15:00:30.0203 2504  vwifimp - ok
15:00:30.0235 2504  [ 55187fd710e27d5095d10a472c8baf1c ] W32Time        C:\Windows\system32\w32time.dll
15:00:30.0375 2504  W32Time - ok
15:00:30.0422 2504  [ de3721e89c653aa281428c8a69745d90 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
15:00:30.0469 2504  WacomPen - ok
15:00:30.0515 2504  [ 3c3c78515f5ab448b022bdf5b8ffdd2e ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
15:00:30.0640 2504  WANARP - ok
15:00:30.0656 2504  [ 3c3c78515f5ab448b022bdf5b8ffdd2e ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
15:00:30.0749 2504  Wanarpv6 - ok
15:00:30.0843 2504  [ 691e3285e53dca558e1a84667f13e15a ] wbengine        C:\Windows\system32\wbengine.exe
15:00:30.0983 2504  wbengine - ok
15:00:31.0030 2504  [ 9614b5d29dc76ac3c29f6d2d3aa70e67 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
15:00:31.0124 2504  WbioSrvc - ok
15:00:31.0155 2504  [ 34eee0dfaadb4f691d6d5308a51315dc ] wcncsvc        C:\Windows\System32\wcncsvc.dll
15:00:31.0249 2504  wcncsvc - ok
15:00:31.0295 2504  [ 5d930b6357a6d2af4d7653bdabbf352f ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
15:00:31.0389 2504  WcsPlugInService - ok
15:00:31.0436 2504  [ 1112a9badacb47b7c0bb0392e3158dff ] Wd              C:\Windows\system32\drivers\wd.sys
15:00:31.0483 2504  Wd - ok
15:00:31.0545 2504  [ 9950e3d0f08141c7e89e64456ae7dc73 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
15:00:31.0639 2504  Wdf01000 - ok
15:00:31.0685 2504  [ 46ef9dc96265fd0b423db72e7c38c2a5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
15:00:31.0795 2504  WdiServiceHost - ok
15:00:31.0810 2504  [ 46ef9dc96265fd0b423db72e7c38c2a5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
15:00:31.0888 2504  WdiSystemHost - ok
15:00:31.0951 2504  [ a9d880f97530d5b8fee278923349929d ] WebClient      C:\Windows\System32\webclnt.dll
15:00:32.0044 2504  WebClient - ok
15:00:32.0075 2504  [ 760f0afe937a77cff27153206534f275 ] Wecsvc          C:\Windows\system32\wecsvc.dll
15:00:32.0216 2504  Wecsvc - ok
15:00:32.0231 2504  [ ac804569bb2364fb6017370258a4091b ] wercplsupport  C:\Windows\System32\wercplsupport.dll
15:00:32.0356 2504  wercplsupport - ok
15:00:32.0403 2504  [ 08e420d873e4fd85241ee2421b02c4a4 ] WerSvc          C:\Windows\System32\WerSvc.dll
15:00:32.0528 2504  WerSvc - ok
15:00:32.0590 2504  [ 8b9a943f3b53861f2bfaf6c186168f79 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
15:00:32.0684 2504  WfpLwf - ok
15:00:32.0731 2504  [ 5cf95b35e59e2a38023836fff31be64c ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
15:00:32.0777 2504  WIMMount - ok
15:00:32.0871 2504  [ 3fae8f94296001c32eab62cd7d82e0fd ] WinDefend      C:\Program Files\Windows Defender\mpsvc.dll
15:00:32.0965 2504  WinDefend - ok
15:00:32.0996 2504  WinHttpAutoProxySvc - ok
15:00:33.0058 2504  [ f62e510b6ad4c21eb9fe8668ed251826 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
15:00:33.0183 2504  Winmgmt - ok
15:00:33.0261 2504  [ 1b91cd34ea3a90ab6a4ef0550174f4cc ] WinRM          C:\Windows\system32\WsmSvc.dll
15:00:33.0448 2504  WinRM - ok
15:00:33.0573 2504  [ 16935c98ff639d185086a3529b1f2067 ] Wlansvc        C:\Windows\System32\wlansvc.dll
15:00:33.0698 2504  Wlansvc - ok
15:00:33.0729 2504  [ 0217679b8fca58714c3bf2726d2ca84e ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
15:00:33.0807 2504  WmiAcpi - ok
15:00:33.0854 2504  [ 6eb6b66517b048d87dc1856ddf1f4c3f ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
15:00:33.0932 2504  wmiApSrv - ok
15:00:34.0041 2504  [ 3b40d3a61aa8c21b88ae57c58ab3122e ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
15:00:34.0166 2504  WMPNetworkSvc - ok
15:00:34.0228 2504  [ a2f0ec770a92f2b3f9de6d518e11409c ] WPCSvc          C:\Windows\System32\wpcsvc.dll
15:00:34.0322 2504  WPCSvc - ok
15:00:34.0353 2504  [ aa53356d60af47eacc85bc617a4f3f66 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
15:00:34.0462 2504  WPDBusEnum - ok
15:00:34.0493 2504  [ 6db3276587b853bf886b69528fdb048c ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
15:00:34.0634 2504  ws2ifsl - ok
15:00:34.0696 2504  [ 6f5d49efe0e7164e03ae773a3fe25340 ] wscsvc          C:\Windows\System32\wscsvc.dll
15:00:34.0774 2504  wscsvc - ok
15:00:34.0790 2504  WSearch - ok
15:00:34.0915 2504  [ fc3ec24fce372c89423e015a2ac1a31e ] wuauserv        C:\Windows\system32\wuaueng.dll
15:00:35.0071 2504  wuauserv - ok
15:00:35.0211 2504  [ e714a1c0354636837e20ccbf00888ee7 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
15:00:35.0305 2504  WudfPf - ok
15:00:35.0367 2504  [ 1023ee888c9b47178c5293ed5336ab69 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
15:00:35.0476 2504  WUDFRd - ok
15:00:35.0507 2504  [ 8d1e1e529a2c9e9b6a85b55a345f7629 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
15:00:35.0617 2504  wudfsvc - ok
15:00:35.0663 2504  [ ff2d745b560f7c71b31f30f4d49f73d2 ] WwanSvc        C:\Windows\System32\wwansvc.dll
15:00:35.0741 2504  WwanSvc - ok
15:00:35.0835 2504  [ 3862318f85be7a91957ada5e814ed58c ] ZTEusbmdm6k    C:\Windows\system32\DRIVERS\ZTEusbmdm6k.sys
15:00:35.0897 2504  ZTEusbmdm6k - ok
15:00:35.0944 2504  [ 3862318f85be7a91957ada5e814ed58c ] ZTEusbnmea      C:\Windows\system32\DRIVERS\ZTEusbnmea.sys
15:00:35.0991 2504  ZTEusbnmea - ok
15:00:36.0038 2504  [ 3862318f85be7a91957ada5e814ed58c ] ZTEusbser6k    C:\Windows\system32\DRIVERS\ZTEusbser6k.sys
15:00:36.0069 2504  ZTEusbser6k - ok
15:00:36.0131 2504  ================ Scan global ===============================
15:00:36.0178 2504  (dab748ae0439955ed2fa22357533dddb) C:\Windows\system32\basesrv.dll
15:00:36.0225 2504  (183b4188d5d91b271613ec3efd1b3cef) C:\Windows\system32\winsrv.dll
15:00:36.0272 2504  (183b4188d5d91b271613ec3efd1b3cef) C:\Windows\system32\winsrv.dll
15:00:36.0319 2504  (364455805e64882844ee9acb72522830) C:\Windows\system32\sxssrv.dll
15:00:36.0381 2504  (5f1b6a9c35d3d5ca72d6d6fdef9747d6) C:\Windows\system32\services.exe
15:00:36.0397 2504  [Global] - ok
15:00:36.0397 2504  ================ Scan MBR ==================================
15:00:36.0412 2504  MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
15:00:36.0724 2504  \Device\Harddisk0\DR0 - ok
15:00:36.0724 2504  ================ Scan VBR ==================================
15:00:36.0740 2504  Boot (0x1200)  (3f89e6d09bc66c0b69db635a07fd680a) \Device\Harddisk0\DR0\Partition1
15:00:36.0740 2504  \Device\Harddisk0\DR0\Partition1 - ok
15:00:36.0787 2504  Boot (0x1200)  (d4b74060f6290fe407961a9941741819) \Device\Harddisk0\DR0\Partition2
15:00:36.0787 2504  \Device\Harddisk0\DR0\Partition2 - ok
15:00:36.0787 2504  ============================================================
15:00:36.0787 2504  Scan finished
15:00:36.0787 2504  ============================================================
15:00:36.0833 1592  Detected object count: 1
15:00:36.0833 1592  Actual detected object count: 1
15:00:45.0928 1592  AtherosSvc ( UnsignedFile.Multi.Generic ) - skipped by user
15:00:45.0928 1592  AtherosSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 18.08.2012 14:39
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

fux89 18.08.2012 16:26
hat alles problemlos geklappt, hier das log:

[code]
Combofix Logfile:
Code:
ComboFix 12-08-17.03 - Engelmann 18.08.2012  17:03:03.1.2 - x86
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.1013.284 [GMT 2:00]
ausgeführt von:: c:\users\Engelmann\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Public\sdelevURL.tmp
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-07-18 bis 2012-08-18  ))))))))))))))))))))))))))))))
.
.
2012-08-18 15:15 . 2012-08-18 15:15        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-08-17 18:22 . 2012-08-17 18:22        --------        d-----w-        c:\windows\system32\%LOCALAPPDATA%
2012-08-17 18:21 . 2012-08-17 18:21        --------        d-----w-        C:\_OTL
2012-08-16 20:00 . 2012-07-06 19:23        393728        ----a-w-        c:\windows\system32\drivers\bthport.sys
2012-08-16 07:56 . 2012-06-27 05:50        860672        ----a-w-        c:\program files\Internet Explorer\iedvtool.dll
2012-08-16 07:56 . 2012-06-27 05:53        981504        ----a-w-        c:\windows\system32\wininet.dll
2012-08-16 07:56 . 2012-06-27 05:53        759296        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2012-08-16 07:56 . 2012-06-27 05:50        525312        ----a-w-        c:\program files\Internet Explorer\jsdbgui.dll
2012-08-14 19:11 . 2012-08-14 19:11        --------        d-----w-        c:\program files\ESET
2012-08-14 12:49 . 2012-06-29 08:44        6891424        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{D446E8E0-2547-42C3-8E1E-76C2617FF3CE}\mpengine.dll
2012-08-08 06:30 . 2012-08-08 06:30        --------        d-----w-        c:\users\Engelmann\AppData\Roaming\Malwarebytes
2012-08-08 06:30 . 2012-08-08 06:30        --------        d-----w-        c:\programdata\Malwarebytes
2012-08-08 06:30 . 2012-08-08 06:30        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-08-08 06:30 . 2012-07-03 11:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-08-06 08:00 . 2012-08-06 08:00        --------        d-----w-        c:\users\Engelmann\AppData\Roaming\e-academy Inc
2012-08-06 08:00 . 2012-08-06 08:00        --------        d-----w-        c:\users\Engelmann\AppData\Local\e-academy Inc
2012-08-05 09:35 . 2012-08-05 09:35        770384        ----a-w-        c:\program files\Mozilla Firefox\msvcr100.dll
2012-08-05 09:35 . 2012-08-05 09:35        421200        ----a-w-        c:\program files\Mozilla Firefox\msvcp100.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-15 18:18 . 2012-03-31 07:00        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-08-15 18:18 . 2011-05-20 09:02        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-06 18:59 . 2012-06-06 18:59        1070152        ----a-w-        c:\windows\system32\MSCOMCTL.OCX
2012-06-06 05:05 . 2012-07-11 18:11        1390080        ----a-w-        c:\windows\system32\msxml6.dll
2012-06-06 05:05 . 2012-07-11 18:11        1236992        ----a-w-        c:\windows\system32\msxml3.dll
2012-06-06 05:03 . 2012-07-11 18:11        805376        ----a-w-        c:\windows\system32\cdosys.dll
2012-06-02 22:19 . 2012-06-22 11:39        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 11:39        45080        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 11:38        35864        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 11:38        577048        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-22 11:39        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-22 11:39        2422272        ----a-w-        c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-22 11:38        88576        ----a-w-        c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-22 11:38        171904        ----a-w-        c:\windows\system32\wuwebv.dll
2012-06-02 13:12 . 2012-06-22 11:38        33792        ----a-w-        c:\windows\system32\wuapp.exe
2012-06-02 04:45 . 2012-07-11 18:11        67440        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
2012-06-02 04:45 . 2012-07-11 18:11        134000        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 04:40 . 2012-07-11 18:11        369336        ----a-w-        c:\windows\system32\drivers\cng.sys
2012-06-02 04:40 . 2012-07-11 18:11        225280        ----a-w-        c:\windows\system32\schannel.dll
2012-06-02 04:39 . 2012-07-11 18:11        219136        ----a-w-        c:\windows\system32\ncrypt.dll
2012-05-31 10:25 . 2011-12-11 22:03        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-08-05 09:35 . 2012-01-22 09:12        136672        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-14 12:01 . 2010-12-24 10:37        24376        ----a-w-        c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-04-17 05:55        120176        ----a-w-        c:\program files\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-12 8546848]
"EgisUpdate"="c:\program files\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"EgisTecPMMUpdate"="c:\program files\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-22 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-22 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-22 150552]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2010-04-08 908368]
"PLFSetI"="c:\windows\PLFSetI.exe" [2010-06-05 206208]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-02-05 715296]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"UIExec"="c:\program files\1&1 Surf-Stick\UIExec.exe" [2010-12-08 139088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2012-05-22 160872]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
backup=c:\windows\pss\Acer VCM.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37        843712        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-03-27 12:41        37296        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AthBtTray]
2010-04-23 12:38        285856        ----a-w-        c:\program files\Bluetooth Suite\AthBtTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtherosBtStack]
2010-04-01 07:26        445528        ----a-w-        c:\program files\Bluetooth Suite\BtvStack.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2011-08-02 07:33        4910912        ----a-w-        c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2011-11-08 14:28        127040        ----a-w-        c:\program files\ICQ7.6\ICQ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mwlDaemon]
2010-04-17 05:57        349552        ----a-w-        c:\program files\EgisTec MyWinLocker\x86\mwlDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2012-05-22 06:38        160872        ----a-w-        c:\program files\PDF24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SuiteTray]
2010-04-17 06:28        337264        ----a-w-        c:\program files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 10:59        254696        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2010-02-05 08:46        1692968        ----a-w-        c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 MWLService;MyWinLocker Service;c:\program files\EgisTec MyWinLocker\x86\MWLService.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files\Bluetooth Suite\adminservice.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files\Acer\Registration\GREGsvc.exe [x]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [x]
S2 UI Assistant Service;UI Assistant Service;c:\program files\1&1 Surf-Stick\AssistantServices.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 79461037
*Deregistered* - 79461037
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 18:18]
.
2012-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-25 15:40]
.
2012-08-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-25 15:40]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod260&r=27b51010n665l0454wwl5w56l2t541
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Engelmann\AppData\Roaming\Mozilla\Firefox\Profiles\8jkginwg.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-ISW - (no file)
MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
MSConfigStartUp-MobileConnect - c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
MSConfigStartUp-NortonOnlineBackupReminder - c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-PIXO RESCUE_is1 - c:\program files\PIXO RESCUE\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-08-18  17:21:31
ComboFix-quarantined-files.txt  2012-08-18 15:21
.
Vor Suchlauf: 10 Verzeichnis(se), 192.151.445.504 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 192.413.888.512 Bytes frei
.
- - End Of File - - 8C69F176FA4839C201AAB6498D626925
--- --- ---

cosinus 19.08.2012 18:14
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

fux89 20.08.2012 11:14
also gmer ging leider (wie schon im startpost beschrieben) wieder nicht, dafür aber die anderen beiden:

osam:

Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 11:06:46 on 20.08.2012

OS: Windows 7  Service Pack 1 (Build 7601), 32-bit
Default Browser: Mozilla Corporation Firefox 14.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Pando" - "Pando Networks" - C:\Program Files\Pando Networks\Media Booster\PMB.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\ENGELM~1\AppData\Local\Temp\catchme.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"uxlcruoc" (uxlcruoc) - ? - C:\Users\ENGELM~1\AppData\Local\Temp\uxlcruoc.sys  (Hidden registry entry, rootkit activity | File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\Program Files\Acer\Acer VCM\Skype4COM.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{B8952421-0E55-400B-94A6-FA858FC0A39F} "AppShellPage Class" - "Atheros Communications" - C:\Program Files\Bluetooth Suite\BtvAppExt.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
{C865E0A2-40BF-4ca7-B3F3-162290A67572} "ContextMenu Class" - "Atheros Communications" - C:\Program Files\Bluetooth Suite\BtContextMenu.dll
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Technology Inc." - C:\Program Files\EgisTec MyWinLocker\x86\psdprotect.dll
{E81FFB23-40E2-431C-A041-76AEA0E4B04C} "Enterprise-Projekte" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\NAMEEXT.DLL
{AFF81F7B-6942-40c4-AADA-7214EF7B6DD1} "FTShellContext Class" - "Atheros Communications" - C:\Program Files\Bluetooth Suite\ShellContextExt.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{C345E174-3E87-4F41-A01C-B066A90A49B4} "WRC Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\wrc32.ocx / hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"ICQ7.6" - "ICQ, LLC." - C:\Program Files\ICQ7.6\ICQ.exe
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{48E73304-E1D6-4330-914C-F5F514E3486C} "Send to OneNote" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acer ePower Management" - "Acer Incorporated" - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"EgisTecPMMUpdate" - "Egis Technology Inc." - "C:\Program Files\EgisTec IPS\PmmUpdate.exe"
"EgisUpdate" - "Egis Technology Inc." - "C:\Program Files\EgisTec IPS\EgisUpdate.exe" -d
"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
"LManager" - "Dritek System Inc." - C:\Program Files\Launch Manager\LManager.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"PDFPrint" - "Geek Software GmbH" - C:\Program Files\PDF24\pdf24.exe
"PLFSetI" - ? - C:\Windows\PLFSetI.exe
"UIExec" - ? - "C:\Program Files\1&1 Surf-Stick\UIExec.exe"  (File found, but it contains no detailed information)

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Acer ePower Service" (ePowerSvc) - "Acer Incorporated" - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"AtherosSvc" (AtherosSvc) - "Atheros Communications" - C:\Program Files\Bluetooth Suite\adminservice.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Dritek WMI Service" (DsiWMIService) - "Dritek System Inc." - C:\Program Files\Launch Manager\dsiwmis.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GREGService" (GREGService) - "Acer Incorporated" - C:\Program Files\Acer\Registration\GREGsvc.exe
"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
"MyWinLocker Service" (MWLService) - "Egis Technology Inc." - C:\Program Files\EgisTec MyWinLocker\x86\MWLService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Raw Socket Service" (RS_Service) - "Acer Incorporated" - C:\Program Files\Acer\Acer VCM\RS_Service.exe
"UI Assistant Service" (UI Assistant Service) - ? - C:\Program Files\1&1 Surf-Stick\AssistantServices.exe  (File found, but it contains no detailed information)
"Updater Service" (Updater Service) - "Acer Group" - C:\Program Files\Acer\Acer Updater\UpdaterService.exe

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\System32\Acer.scr

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
und das andere:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-20 11:07:59
-----------------------------
11:07:59.893    OS Version: Windows 6.1.7601 Service Pack 1
11:07:59.894    Number of processors: 2 586 0x1C0A
11:07:59.899    ComputerName: ENGELMANN-PC  UserName: Engelmann
11:08:01.846    Initialize success
11:11:16.139    AVAST engine defs: 12082000
11:11:20.826    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
11:11:20.839    Disk 0 Vendor: Hitachi_ PB2O Size: 238475MB BusType: 3
11:11:20.875    Disk 0 MBR read successfully
11:11:20.883    Disk 0 MBR scan
11:11:21.011    Disk 0 Windows 7 default MBR code
11:11:21.031    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        13319 MB offset 63
11:11:21.063    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          101 MB offset 27278370
11:11:21.102    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      225052 MB offset 27487215
11:11:21.176    Disk 0 scanning sectors +488395120
11:11:21.321    Disk 0 scanning C:\Windows\system32\drivers
11:11:42.411    Service scanning
11:12:29.834    Modules scanning
11:12:49.137    Disk 0 trace - called modules:
11:12:49.182   
11:12:50.457    AVAST engine scan C:\Windows
11:12:56.259    AVAST engine scan C:\Windows\system32
11:18:12.543    AVAST engine scan C:\Windows\system32\drivers
11:18:46.937    AVAST engine scan C:\Users\Engelmann
11:20:01.739    AVAST engine scan C:\ProgramData
11:20:35.137    Scan finished successfully
12:12:49.513    Disk 0 MBR has been saved successfully to "C:\Users\Engelmann\Desktop\MBR.dat"
12:12:49.606    The log file has been saved successfully to "C:\Users\Engelmann\Desktop\aswMBR.txt"

cosinus 21.08.2012 11:38
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

fux89 21.08.2012 16:02
hier die beiden logs:

Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.21.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Engelmann :: ENGELMANN-PC [Administrator]

Schutz: Aktiviert

21.08.2012 13:18:04
mbam-log-2012-08-21 (13-18-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 281360
Laufzeit: 1 Stunde(n), 28 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 08/21/2012 at 04:48 PM

Application Version : 5.5.1012

Core Rules Database Version : 9093
Trace Rules Database Version: 6905

Scan type      : Complete Scan
Total Scan Time : 01:43:47

Operating System Information
Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 754
Memory threats detected  : 0
Registry items scanned    : 35353
Registry threats detected : 0
File items scanned        : 97621
File threats detected    : 193

Adware.Tracking Cookie
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\G2AGQKZT.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\FTXA1UTK.txt [ /xiti.com ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\WO992FJC.txt [ /apmebf.com ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\3JFAIVW2.txt [ /imrworldwide.com ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\BDHSEOWM.txt [ /ad.zanox.com ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\7ZB01WGN.txt [ /zanox.com ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\Y3ABV6P4.txt [ /mediaplex.com ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\6G1W3X6B.txt [ /fastclick.net ]
        C:\Users\Engelmann\AppData\Roaming\Microsoft\Windows\Cookies\5K4ZO8SU.txt [ /adfarm1.adition.com ]
        C:\USERS\ENGELMANN\Cookies\G2AGQKZT.txt [ Cookie:engelmann@ad1.adfarm1.adition.com/ ]
        C:\USERS\ENGELMANN\Cookies\FTXA1UTK.txt [ Cookie:engelmann@xiti.com/ ]
        C:\USERS\ENGELMANN\Cookies\WO992FJC.txt [ Cookie:engelmann@apmebf.com/ ]
        C:\USERS\ENGELMANN\Cookies\3JFAIVW2.txt [ Cookie:engelmann@imrworldwide.com/cgi-bin ]
        C:\USERS\ENGELMANN\Cookies\BDHSEOWM.txt [ Cookie:engelmann@ad.zanox.com/ ]
        C:\USERS\ENGELMANN\Cookies\Y3ABV6P4.txt [ Cookie:engelmann@mediaplex.com/ ]
        C:\USERS\ENGELMANN\Cookies\6G1W3X6B.txt [ Cookie:engelmann@fastclick.net/ ]
        C:\USERS\ENGELMANN\Cookies\5K4ZO8SU.txt [ Cookie:engelmann@adfarm1.adition.com/ ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\V9YPZWHY ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .novamedia.biz [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .novamedia.biz [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .wissende.122.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        cms-webstat.rhrz.uni-bonn.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .audiag.112.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .msnportal.112.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        s4.trafficmaxx.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .sevenoneintermedia.112.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .countomat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .guj.122.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.clickapps.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.clickapps.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .partypokeronlines.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .partypokeronlines.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .partypokeronlines.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.biz [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        s2.trekmedia.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        s2.trekmedia.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.biz [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.findvermont.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.findvermont.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.findvermont.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.biz [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        s2.trekmedia.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.biz [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .digital-media.us [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .digital-media.us [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .digital-media.us [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        click.blue-square-media.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        s06.flagcounter.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.biz [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.visit-tracker.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        trackstatsnow.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        trekmedia.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        trekmedia.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .advertstream.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.trekmedia.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        tracking.novem.pl [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        trekmedia.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.blogcounter.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .ice.112.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        newsletter.apodiscounter.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .apodiscounter.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .apodiscounter.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .apodiscounter.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .apodiscounter.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .microsoftofficevisio.112.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www9.addfreestats.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .paypal.112.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .getclicky.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .static.getclicky.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        in.getclicky.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        tracking.novem.pl [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        tracking.novem.pl [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .stat.4u.pl [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        tracking.novem.pl [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .skydeutschland.122.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .gamestats.org [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .gamestats.org [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .gamestats.org [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.gamestats.org [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.gamestats.org [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .meet-teens.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .meet-teens.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .meet-teens.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .meet-teens.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .meet-teens.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.meet-teens.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        stats.computecmedia.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        stats.computecmedia.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .4stats.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .stats.paypal.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        tracking.sim-technik.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .kfactormedia.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .kfactormedia.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        games.sl3.kfactormedia.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        a.visualrevenue.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        s08.flagcounter.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .microsofthalo.122.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.webcountdown.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.webcountdown.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.webcountdown.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .knex.122.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        cn.clickable.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .estat.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .count.spring.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .microsoftsto.112.2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.moviepilot.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .moviepilot.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .moviepilot.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .moviepilot.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.moviepilot.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.youporn.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .youporn.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        www.porntube.com [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .tracker.vinsight.de [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\ENGELMANN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\8JKGINWG.DEFAULT\COOKIES.SQLITE ]

cosinus 30.08.2012 11:28
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

fux89 30.08.2012 13:25
es scheint alles ind ordnung, keinerlei probleme oder warnmeldungen o.ä.

hab antivir noch mal einen vollscan machen lasse, nix gefunden.

Code:

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 30. August 2012  12:47

Es wird nach 4191474 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : Engelmann
Computername  : ENGELMANN-PC

Versionsinformationen:
BUILD.DAT      : 12.0.0.1167          Bytes  18.07.2012 19:07:00
AVSCAN.EXE    : 12.3.0.33    468472 Bytes  08.08.2012 18:34:29
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  08.05.2012 09:08:23
LUKE.DLL      : 12.3.0.15      68304 Bytes  08.05.2012 09:08:35
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  09.05.2012 20:45:27
AVREG.DLL      : 12.3.0.17    232200 Bytes  11.05.2012 06:46:02
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 18:18:34
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 09:07:39
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 06:41:21
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 13:02:35
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 12:16:43
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 08:52:56
VBASE006.VDF  : 7.11.34.117    2048 Bytes  29.06.2012 08:52:56
VBASE007.VDF  : 7.11.34.118    2048 Bytes  29.06.2012 08:52:57
VBASE008.VDF  : 7.11.34.119    2048 Bytes  29.06.2012 08:52:57
VBASE009.VDF  : 7.11.34.120    2048 Bytes  29.06.2012 08:52:57
VBASE010.VDF  : 7.11.34.121    2048 Bytes  29.06.2012 08:52:58
VBASE011.VDF  : 7.11.34.122    2048 Bytes  29.06.2012 08:52:58
VBASE012.VDF  : 7.11.34.123    2048 Bytes  29.06.2012 08:52:58
VBASE013.VDF  : 7.11.34.124    2048 Bytes  29.06.2012 08:52:58
VBASE014.VDF  : 7.11.38.18  2554880 Bytes  30.07.2012 18:02:11
VBASE015.VDF  : 7.11.38.70    556032 Bytes  31.07.2012 18:02:13
VBASE016.VDF  : 7.11.38.143  171008 Bytes  02.08.2012 09:50:27
VBASE017.VDF  : 7.11.38.221  178176 Bytes  06.08.2012 18:33:59
VBASE018.VDF  : 7.11.39.37    168448 Bytes  08.08.2012 18:34:19
VBASE019.VDF  : 7.11.39.89    131072 Bytes  09.08.2012 18:53:39
VBASE020.VDF  : 7.11.39.145  142336 Bytes  11.08.2012 22:39:52
VBASE021.VDF  : 7.11.39.207  165888 Bytes  14.08.2012 17:10:52
VBASE022.VDF  : 7.11.40.9    156160 Bytes  16.08.2012 18:17:40
VBASE023.VDF  : 7.11.40.49    133120 Bytes  17.08.2012 19:50:20
VBASE024.VDF  : 7.11.40.95    156160 Bytes  20.08.2012 11:19:09
VBASE025.VDF  : 7.11.40.155  181760 Bytes  22.08.2012 19:54:52
VBASE026.VDF  : 7.11.40.205  203264 Bytes  23.08.2012 11:40:11
VBASE027.VDF  : 7.11.41.29    188416 Bytes  27.08.2012 10:39:54
VBASE028.VDF  : 7.11.41.87    250368 Bytes  30.08.2012 10:40:05
VBASE029.VDF  : 7.11.41.88      2048 Bytes  30.08.2012 10:40:05
VBASE030.VDF  : 7.11.41.89      2048 Bytes  30.08.2012 10:40:05
VBASE031.VDF  : 7.11.41.90      2048 Bytes  30.08.2012 10:40:05
Engineversion  : 8.2.10.150
AEVDF.DLL      : 8.1.2.10      102772 Bytes  10.07.2012 11:28:07
AESCRIPT.DLL  : 8.1.4.46      455034 Bytes  24.08.2012 11:41:05
AESCN.DLL      : 8.1.8.2      131444 Bytes  28.01.2012 08:03:05
AESBX.DLL      : 8.2.5.12      606578 Bytes  15.06.2012 18:50:02
AERDL.DLL      : 8.1.9.15      639348 Bytes  08.09.2011 21:16:06
AEPACK.DLL    : 8.3.0.32      811382 Bytes  24.08.2012 11:41:04
AEOFFICE.DLL  : 8.1.2.42      201083 Bytes  24.07.2012 08:31:48
AEHEUR.DLL    : 8.1.4.94    5230967 Bytes  30.08.2012 10:40:17
AEHELP.DLL    : 8.1.23.2      258422 Bytes  30.06.2012 08:53:13
AEGEN.DLL      : 8.1.5.36      434549 Bytes  24.08.2012 11:40:23
AEEXP.DLL      : 8.1.0.84      90485 Bytes  30.08.2012 10:40:17
AEEMU.DLL      : 8.1.3.2      393587 Bytes  10.07.2012 11:28:06
AECORE.DLL    : 8.1.27.4      201078 Bytes  07.08.2012 18:33:55
AEBB.DLL      : 8.1.1.0        53618 Bytes  01.09.2011 21:46:01
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  08.05.2012 09:08:13
AVPREF.DLL    : 12.3.0.15      51920 Bytes  08.05.2012 09:08:23
AVREP.DLL      : 12.3.0.15    179208 Bytes  09.05.2012 20:45:26
AVARKT.DLL    : 12.3.0.15    211408 Bytes  08.05.2012 09:08:19
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  08.05.2012 09:08:21
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  08.05.2012 09:08:37
AVSMTP.DLL    : 12.3.0.32      63480 Bytes  08.08.2012 18:34:30
NETNT.DLL      : 12.3.0.15      17104 Bytes  08.05.2012 09:08:35
RCIMAGE.DLL    : 12.3.0.31    4444408 Bytes  08.08.2012 18:34:18
RCTEXT.DLL    : 12.3.0.31    100088 Bytes  08.08.2012 18:34:18

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Donnerstag, 30. August 2012  12:47

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!
    [INFO]      Bitte starten Sie den Suchlauf erneut mit Administratorrechten

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxext.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'EgisUpdate.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'SUPERAntiSpyware.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'UIExec.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerTray.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxsrvc.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'PLFSetI.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'LManager.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'PmmUpdate.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAAnotif.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '175' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '52' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1584' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Acer>
C:\Program Files\WinRAR\rarnew.dat
  [WARNUNG]  Das Archiv ist unbekannt oder defekt
C:\Users\Engelmann\AppData\Local\Temp\install_flashplayer11x32_mssd_au_aih.exe
  [WARNUNG]  Die Datei ist kennwortgeschützt


Ende des Suchlaufs: Donnerstag, 30. August 2012  14:10
Benötigte Zeit:  1:23:16 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  18361 Verzeichnisse wurden überprüft
 265260 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 265260 Dateien ohne Befall
  1862 Archive wurden durchsucht
      2 Warnungen
      0 Hinweise
 469934 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

cosinus 30.08.2012 19:36
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

fux89 30.08.2012 20:55
klasse, dann hier auch nochmal ein ganz großes dankeschön !!!


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:58 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131