Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Externe Platte verseucht? (https://www.trojaner-board.de/134407-externe-platte-verseucht.html)

Canna 02.05.2013 21:53
Externe Platte verseucht?
 
Hallo liebe Experten,

ich habe zuerst mal eine eher grundsätzliche Frage: Können sich Trojaner in Dateien wie Fotos, Videos, Textdokumenten (PDF, doc etc) usw einnisten? Oder nur in ausfürhbaren Programmen (exe, bat etc)?

Hintergrund meiner Frage ist folgendes Problem: Ich hatte vor ein paar Tagen den GVU-Trojaner auf meinem Laptop. Da ich seitdem zeitlich sehr eingespannt bin, bin ich leider noch nicht dazu gekommen mein System komplett neu aufzusetzen. Das scheint aber doch sehr sehr nötig zu sein. Obwohl Avira und Malwarebytes nichts mehr finden und der ADW-cleaner drüber lief, lasse ich gerade den ESET Online Scanner drüber laufen und er hat 8 Objekte gefunden. 3 verschiedenen Typen:
1) a variant of Win32/Kryptik.AZY
2) JS/Agent.NID und
3) Java/Exploit.Agent.OAS.
Kann mir jemand sagen was diese 3 Typen machen?

Ich werde in den nächsten Tagen mein System auf jeden FAll neu aufsetzen, das ist mir sonst zu riskant. Ich habe schon den Tip bekommen zur Datensicherung zum Beispiel Xubuntu zu nutzen. Nun mein Problem: Meine (einzige) externe Platte hing nach der Infizierung bereits am Laptop. Es könnte also durchaus sein, dass sich auch dort Viren eingenistet haben. Wie soll ich also vorgehen? Auf der externen befinden sich ausschließlich oben genannte Dateien, keine Programme.
Macht es Sinn die Platte an den im Moment anscheinend immer noch teilweise versechten Laptop anzuschließen und Malwarebytes etc drüberzujagen?

Ich danke euch vielmals!

cosinus 03.05.2013 23:42
Hallo,

Zitat:
er hat 8 Objekte gefunden. 3 verschiedenen Typen:
1) a variant of Win32/Kryptik.AZY
2) JS/Agent.NID und
3) Java/Exploit.Agent.OAS.
Kann mir jemand sagen was diese 3 Typen machen?
Schön und wo sind die Logs dazu? Mit solchen unkonkreten Angaben kann dir niemand helfen! :glaskugel:

Solche Angaben reichen nicht, bitte poste die vollständigen Angaben/Logs der Virenscanner siehe http://www.trojaner-board.de/125889-...tml#post941520


Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Canna 05.05.2013 22:54
In Ordnung, habe nicht gedachte dass das was bringt, weil kaum was drin steht. Aber gerne, hier ist der Log von ESET:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ff02ac97f516bd4b8bc69a764fbb5ef4
# engine=13741
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-02 03:03:00
# local_time=2013-05-02 05:03:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 7248 232930270 0 0
# compatibility_mode=5892 16776574 100 100 13559927 205039708 0 0
# scanned=26502
# found=0
# cleaned=0
# scan_time=1919
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ff02ac97f516bd4b8bc69a764fbb5ef4
# engine=13743
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-02 09:17:26
# local_time=2013-05-02 11:17:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 29714 232952736 21936 0
# compatibility_mode=5892 16776574 100 100 13585993 205062174 0 0
# scanned=234580
# found=8
# cleaned=0
# scan_time=13172
sh=A784B6C70D30DB8D9D81ED66F3790D1EB8FCE9A0 ft=0 fh=0000000000000000 vn="JS/Agent.NID trojan" ac=I fn="C:\ProgramData\44ff.js"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\ProgramData\ff44.dat.nein"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\ProgramData\hh49.dat"
sh=A784B6C70D30DB8D9D81ED66F3790D1EB8FCE9A0 ft=0 fh=0000000000000000 vn="JS/Agent.NID trojan" ac=I fn="C:\Users\All Users\44ff.js"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\Users\All Users\ff44.dat.nein"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\Users\All Users\hh49.dat"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\Users\General Easy\AppData\Local\Temp\rACuTi9.exe"
sh=1091A6B1569E13B04181C0233D8FB736A5D6D0AB ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.OAS trojan" ac=I fn="C:\Users\General Easy\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\3a980397-27839ba4"

Wichtiger ist mir aber der zweite Teil meiner Frage, der sich auf meine externe Platte bezieht.
Vielen Dank!
Canna

cosinus 06.05.2013 08:11
Ich seh da nur Funde auf Laufwerk C (Systempartition) aber nichts auf der externen Platte.
Normalerweise können nur ausführbare Dateien, also Programme und Scripte Schaden anrichten.

Hast du noch weitere Logs mit Funden? Funde auf der externen Platte?

Canna 07.05.2013 19:16
Auf der externen Platte wurden auch keine Viren gefunden. Weder durch Malwarebytes, noch durch Avira. Aber da die Platte während der Infektion meines Laptops angeschlossen war, bin ich trotzdem etwas ängstlich mir wieder Viren auf mein sauberes System zu holen. Dann würde ja auch das Datensichern mit einem sog. Live-System nichts bringen.

Also wie würdest du vorgehen? Auf der externen befinden sich wie gesagt hauptsächlich Videos, Fotos, Musik und Dokumente (PDF und doc).


Danke dir!

cosinus 07.05.2013 21:05
Zitat:
Auf der externen befinden sich wie gesagt hauptsächlich Videos, Fotos, Musik und Dokumente (PDF und doc).
Das sind i.A. ungefährliche Format, weil eben Dokumente, Fotos, Musik und Videos nur reine Nutzdaten darstellen aber keine binären Formate sprich Programme => ausführbare Dateien


Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Die Logs der aufgegebenen Tools wie zB Malwarebytes sind immer zu posten - egal ob ein Fund dabei war oder nicht!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Erstmal eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

Canna 09.05.2013 16:01
In Ordnung, ich danke dir schon mal im Voraus sehr für deine Mühe. Ich hoffe es werden keine vertraulichen Daten hier öffentlich im Forum gepostet...
Angeschlossen war während des Scans meine externe Platte die 2 Partitionen hat.

Extras.txt:
OTL Logfile:
Code:
OTL Extras logfile created on: 09.05.2013 16:17:27 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\XXX\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 0,88 Gb Available Physical Memory | 29,44% Memory free
6,22 Gb Paging File | 2,92 Gb Available in Paging File | 46,96% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 40,88 Gb Total Space | 1,34 Gb Free Space | 3,28% Space Free | Partition Type: NTFS
Drive D: | 182,00 Gb Total Space | 82,00 Gb Free Space | 45,06% Space Free | Partition Type: NTFS
Drive F: | 465,83 Gb Total Space | 1,21 Gb Free Space | 0,26% Space Free | Partition Type: NTFS
Drive H: | 465,56 Gb Total Space | 322,66 Gb Free Space | 69,31% Space Free | Partition Type: FAT32
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "D:\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01B9F681-96E7-486F-8045-E5CA8BAD2209}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0F926404-25A0-4D52-92FA-90F45A80BE2A}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{1958B11C-F1B9-4D7D-9177-0084E29679F0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{21FBADF4-A125-4407-B6A5-665E7F3AD009}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{24140EBC-A09A-4A91-A468-91D79B35EB4F}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{2484F356-B76D-4C60-8064-9F7BB9A9212A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2BD51217-E6CB-43E2-BE9D-3792DB532E2D}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{32DF3CF1-4CBF-4DD3-9B09-F54F9E387853}" = lport=3390 | protocol=6 | dir=in | app=system |
"{33D231E8-63A3-40AC-9505-BE6F3BDC45DC}" = rport=10243 | protocol=6 | dir=out | app=system |
"{380992D6-7B6E-4E67-A141-7BB1EBEB9B6C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{38E88E1F-CDE2-4049-BC31-840640284514}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{392CE8B4-AFE6-4B35-BFAE-CEB0E17A9B9E}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{3C8B1D65-CDC2-4341-B55E-78F9F0473AF2}" = lport=3390 | protocol=6 | dir=in | app=system |
"{3D1A2F47-D56C-4463-B8E1-8CE0F525B25C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{3FC8A2CD-25DB-4810-B0DF-0D7602F96750}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3FCFB53A-2D30-49FB-8348-61EBFFDEFB5E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{45918B47-734F-4671-B88D-9045B645A195}" = rport=10244 | protocol=6 | dir=out | app=system |
"{6213AFAF-56D7-4144-B23E-65DF7A062A68}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6435C2F5-623F-43A2-BC8C-391755B8C475}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{67922FB6-C00A-4F84-9543-B02FB9D76E08}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{67C0F5C1-BD97-45D3-B668-C7CD665FD392}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6800322B-E183-4D17-AA67-56F9C84BBBB0}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{885DDFEE-ECC2-458C-AA4E-AFDAC929C7EC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{951F7DD5-3FA0-4C57-823E-25AD2F9118DF}" = lport=10243 | protocol=6 | dir=in | app=system |
"{98E6CE89-1E2E-465A-87BF-92E6D218F0AA}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9BC8BDE5-2D43-440B-8938-D348F262B9B1}" = rport=10244 | protocol=6 | dir=out | app=system |
"{ABCE8658-12FE-47DA-879A-9F4CAAED9D39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B09D5F60-FE73-415B-950E-CB0714166E00}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B63830EC-0AAC-4FCA-A587-447F5ABDD215}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{BA8D5678-A8E1-44E6-934C-BCDC2ACC8613}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BF12A24D-B542-4388-8D6D-D29E6A948848}" = lport=10244 | protocol=6 | dir=in | app=system |
"{C85AEE7B-83B6-4DD3-A71F-DACE8BAB70E9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CFEA2DA0-C909-45DC-B6C2-21C67AFD62D6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DE31F7EA-701C-4769-8C44-880FDF3A2B2E}" = lport=10244 | protocol=6 | dir=in | app=system |
"{E59E3407-33AA-4F9F-8286-F759AE282C65}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E7B6A0DF-8819-46EB-8F09-F1AEE30D2E58}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EBB1D389-7963-411D-9EBB-1FD738266E0A}" = lport=6004 | protocol=17 | dir=in | app=d:\microsoft office\office12\outlook.exe |
"{EC092DC5-98A3-4FAA-B951-5B6E3B8F0A32}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ECB455E1-DF58-40DE-9418-F47E835C200B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FFF2C2C2-E18E-4E46-AC7E-5D650CAAB9DD}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03128E8B-AAEA-4B7D-A645-CE8F38714716}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{057CC98F-3BDA-42F9-A3F7-C46C9622F6F3}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{0C682038-637A-4216-B0B8-E4360D546DD3}" = protocol=17 | dir=in | app=d:\idevice manager\software4u.idevicemanager.exe |
"{13B34E19-AAEB-4C27-9FA2-52E27A832E42}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{19B9FBB8-501B-4352-9784-A12992009225}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{265C6D09-F3B0-43AA-B333-AECAB097B0AE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2CE5843C-82B3-4294-9E95-C06A192581A8}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{363FD5FE-625A-48E2-9C24-9A2958B5E415}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{3F823B1A-8BEF-4F52-BA75-CFB96B00E622}" = protocol=6 | dir=in | app=d:\avatar\bin\avatar.exe |
"{4D2C4EAE-2911-449A-9D9D-A8B17F1E2B0F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4E0F8CAE-8739-419D-B61A-86B41A73CACB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{52FDDBAA-53D9-441D-8AEF-416BC5771497}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{599CC9AB-231C-4956-82C7-8D8EA3CF58D9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5A0DA669-7AE0-4EC9-B599-C8E9B86920AA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5C9FB055-3E9A-44B1-911B-A9D864302EDB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6E93FA4A-B089-4260-8E1C-9E6F8C045D16}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{708F3A2B-C240-4FD1-98A4-92257F050FFB}" = protocol=6 | dir=out | app=system |
"{71AECD10-B940-4A61-9DBF-44C76B4AD0C8}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{7EF9F2C8-B473-46AB-89E1-75ECB1A23B52}" = protocol=6 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"{82A9B3EB-6188-48E2-BD42-E30B7E3B02B1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8382734C-C8D1-4FA2-8585-78799DF1DD4F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{83AB05C6-B61D-47A6-8BF2-78BFB88867E1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{94957FF9-14EA-42AD-9911-25DD8682FAA3}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{972A4537-7CA1-4DE5-97EE-74C7BAA9A0AB}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{98368AE1-53BF-46A0-B5C7-399141EFB10E}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{9B536AFE-3142-45B1-AA8F-2EFF56C499E2}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{B209FBC9-B928-4451-9DA7-8F2B79CD0956}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B2BD176F-B7EA-4A01-B21E-59C9784E730A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B32455C8-65E9-4C83-A8F6-66580DA83A82}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{B4BB32AD-C80C-4B76-8253-2D3330979461}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{B5EEC94C-3164-4691-ADF6-42DCA4AE0B8F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CB73F8F1-A1B8-44EE-B7BD-309FD3FC3943}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CE714BD0-9C53-4BCF-902E-1D2839CA84FD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CF38DB1D-35CF-4812-A2A8-0FDE2D679D0E}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{D1B8AAC7-EAD1-4E89-82B0-6F7A1D841EC5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DA5986A1-AC76-468E-BE42-3C0CCD0894D4}" = protocol=6 | dir=in | app=d:\idevice manager\software4u.idevicemanager.exe |
"{E005FCF5-2DC4-4F4C-89E5-3C1E2672D8BF}" = protocol=17 | dir=in | app=d:\avatar\bin\avatarlauncher.exe |
"{E4CC8D85-348C-476C-8E52-567BC748AA37}" = protocol=6 | dir=in | app=d:\avatar\bin\avatarlauncher.exe |
"{E961DAF4-8D2F-4015-A091-04CDEFEF5BDD}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{E9F0A1AB-E2F2-43A0-ABE0-1F6990A88200}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{F4354AE6-FDBE-407B-93C8-792C09731856}" = protocol=17 | dir=in | app=d:\avatar\bin\avatar.exe |
"{F6A4DB30-CDBD-4923-AFCE-EB3318298D55}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{F73EF69F-978F-4BB1-9C41-B449AB7EF792}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{FFA01A7B-3962-4FB8-90DC-7D7742AD56AF}" = protocol=17 | dir=in | app=c:\users\general XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{11DCA69A-6FC7-42EF-8972-842CCA13A7E7}C:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{2104991F-57F9-4343-B951-7A9D80E4117B}C:\program files\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"TCP Query User{3E9DCC5B-6546-4957-9ED2-C32D82AC4A3C}C:\program files\imagej\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"TCP Query User{471A5111-DDD9-42E2-B667-89CAC81609E4}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{596B45BA-0711-4F67-A678-D6E7B6518614}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{5F08205D-FDB0-4B3E-A3F9-105BC0D95801}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{61A40DDF-F88F-418E-A817-E74165FC3259}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{781F61E8-E872-4FB9-AC04-2955E07B020B}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{8D92669B-75E3-4B3E-8C46-895DB634D7E8}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{94B24CDD-39D5-4822-A907-F72BFD229AC8}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{986A0B19-3CBF-494A-A3CA-9BD71D0F4D08}D:\quantumgis\apps\udig\udig_internal.exe" = protocol=6 | dir=in | app=d:\quantumgis\apps\udig\udig_internal.exe |
"TCP Query User{BE312FCB-A6F8-44EC-AB05-EBD25CF602CC}C:\program files\imagej\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"TCP Query User{C1484956-EEE2-4CC2-8824-439DE72FA8D8}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{DAFDCCB7-3193-45ED-9CB7-E3D187D4AC2B}C:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe |
"TCP Query User{F74F3362-BCF7-4242-8580-71A52A60C835}D:\quantumgis\bin\javaw.exe" = protocol=6 | dir=in | app=d:\quantumgis\bin\javaw.exe |
"UDP Query User{4EA51141-F025-4024-A7C5-710E5CC59337}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{5F250EB7-04DD-456A-8A9C-B342ACF79871}C:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{63410484-20F0-4318-B753-0B898C7967D5}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{640DF4EF-26C1-442D-B8B7-9372B402D08E}C:\program files\imagej\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"UDP Query User{8245BFC0-F55A-4849-9550-74E729DA6206}C:\program files\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"UDP Query User{9E4235A6-F08F-4B45-97BB-C8703F98124F}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{A66B2557-65C3-4A9D-B625-89728B831AE3}D:\quantumgis\apps\udig\udig_internal.exe" = protocol=17 | dir=in | app=d:\quantumgis\apps\udig\udig_internal.exe |
"UDP Query User{AFDCF9DC-1EBE-4688-84D0-11FE9BD4417D}C:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe |
"UDP Query User{BBD0FDBD-2A1E-44D4-A328-B0BCD4282A5A}D:\quantumgis\bin\javaw.exe" = protocol=17 | dir=in | app=d:\quantumgis\bin\javaw.exe |
"UDP Query User{C3D2F7D3-8D0E-4F43-ACD1-3C438C975419}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{CB22E753-188E-4F66-B155-ACB8C23F77B4}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{CB3C30D9-A804-4B05-93F0-74BAB3A19DB5}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{D57359DF-894C-4C89-80B5-4076486106D5}C:\program files\imagej\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"UDP Query User{DCBAAC70-5B53-4CA8-A2FC-A104828E7B4B}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{EBE12859-1936-4CA6-B282-AF60FAFFC273}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}" = imagine digital freedom - Samsung
"{018FE763-ECD9-577B-05D5-3A67364FBAAA}" = Catalyst Control Center Localization Hungarian
"{02E43EC2-6B1C-45B5-9E48-941C3E1B204A}_is1" = System.Data.SQLite v1.0.81.0
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.5000
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1252B4EB-51F1-F349-6D79-954D877FB865}" = Catalyst Control Center Localization Swedish
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution II
"{14F91018-2A76-725D-056C-ECFF03F40F54}" = CCC Help Swedish
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1CE60928-8325-49A8-8B06-633E48DD2B67}" = Cisco Systems VPN Client 5.0.07.0410
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7A2A3A-B874-1E81-D291-A5ACB452F23F}" = CCC Help Italian
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2433BAD7-453F-473D-BE81-455E68940DEB}" = Catalyst Control Center - Branding
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{28A78C92-AC8C-DA80-6100-99A3AC4C3911}" = CCC Help Turkish
"{29ED20C9-5E15-4969-9279-25BF3727A3DA}" = iTunes
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{303A3978-8F11-DAAB-6F72-3D399477CC31}" = Catalyst Control Center Localization Chinese Standard
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D69628B-4DE8-43C7-9A22-F90F5B870C08}" = ArcSoft TotalMedia Backup
"{3FF8E8A7-5BA8-4D9E-B976-B05B2B00B0AE}" = Microsoft Expression Web 4
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{4890127D-D62F-C496-9EFF-89FC910ABFE5}" = Catalyst Control Center Localization Polish
"{4C82121C-EB17-CEB0-996B-4D73FA0FAB47}" = Catalyst Control Center Graphics Light
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{5466620C-3B00-0BEE-D626-1FBE29A16AC4}" = Catalyst Control Center Localization Russian
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{5508C9EB-5336-87F4-C2DB-53F2B3A482E7}" = Catalyst Control Center Graphics Previews Vista
"{5611C71F-AFC6-EBA3-E3E1-9FCCEC9647EE}" = ccc-core-static
"{5D7D1784-84A9-0EDB-62A6-D479F7F75DF6}" = CCC Help Chinese Traditional
"{62172AFD-E7F0-CAC1-1334-CB0159566F6C}" = Catalyst Control Center Localization Greek
"{64F67489-76BB-4CDD-A236-F954BE774B35}" = NVIDIA PhysX
"{65A0F799-1E9A-093B-BB8B-986203DAD390}" = Catalyst Control Center Core Implementation
"{67B41BEF-F407-D81D-762F-CC44CC6FEB7A}" = Catalyst Control Center Localization Italian
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6DFBD0A2-C692-44F5-1C96-773ED9B16002}" = Catalyst Control Center Graphics Full Existing
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{71A51B09-E7D3-11DB-A386-005056C00008}" = Vimicro UVC Camera
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{768361B2-F78F-FFAA-5B1F-EFDB41C70D95}" = CCC Help French
"{76902AF9-DA86-419D-B533-077643124722}" = Sony ACID Pro 5.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A98B8DF-687E-8F7F-9A4A-ED1D9B306EAF}" = CCC Help Russian
"{804F1285-8CBF-408D-8CDC-D4D40003B2E4}" = PlayCamera
"{818F922E-DE7A-6FC1-D85C-C44495070174}" = Catalyst Control Center Localization Dutch
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DB12734-9543-FBB3-E94D-3BE397ED8078}" = Catalyst Control Center Localization Japanese
"{9001B8A7-B591-7559-2264-B4A0F480D1A8}" = CCC Help Polish
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{905DF41F-D74C-6DF4-9453-D29CDE46A4A4}" = CCC Help Finnish
"{92041735-0623-CD56-9BCB-6CD4385232B0}" = CCC Help Thai
"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"{96A1E845-A730-4488-99A2-054C5BFAB9D1}" = CCC Help Greek
"{97EE277B-C0D9-6394-9A01-7681086EED5C}" = Catalyst Control Center Localization Portuguese
"{99F9ACB2-BCD2-B5A7-7738-24FB0B7B7763}" = ccc-utility
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DCC214C-CD1A-1115-6775-A9056185FE4E}" = ATI Catalyst Install Manager
"{9F06F30E-5138-2315-EC57-D4A23D572649}" = CCC Help Portuguese
"{A00B9A50-3090-4CFF-9CDA-82DA0BEDAA21}" = Apple Mobile Device Support
"{A3D22413-28D3-636E-1CE9-BC55C46364C3}" = Catalyst Control Center Graphics Full New
"{A41EB7B5-8883-4795-A587-AAD8A84A010D}" = Cisco AnyConnect Secure Mobility Client
"{A53EA764-AB97-445E-002B-A32165BB0B3B}" = CCC Help Dutch
"{A586A89F-2BC4-CEB3-3C52-D1F4B57F572F}" = Catalyst Control Center Localization Turkish
"{A5EF9152-55CC-DF0E-AEDA-98D20EC3293E}" = CCC Help Japanese
"{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A952B4E1-913A-1492-A551-43EAE1D44E1D}" = Catalyst Control Center Localization Chinese Traditional
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch
"{B0524CD7-2B3F-50C1-B3AD-87457B7FF852}" = Catalyst Control Center Localization Spanish
"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe  1.8.15.1
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1" = Emsisoft Anti-Malware
"{C359699C-2D0A-5F08-9C44-4C1A508C4990}" = CCC Help Hungarian
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint 2.0
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDA83283-8D9F-321F-5C76-AF68D3039B87}" = Catalyst Control Center Localization Czech
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1C099EA-C28C-6593-8CE1-38F63EBD22F4}" = CCC Help Korean
"{D885CD8B-343B-271D-85EB-DFE5BE962C0D}" = Catalyst Control Center Localization Norwegian
"{DDDA0B2B-674E-A49F-6E31-184F00BDDC85}" = CCC Help Czech
"{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}" = Prince of Persia T2T
"{E2430405-1983-852E-B297-4FF9207E6C16}" = CCC Help German
"{E596EC1C-4C61-2457-21B3-EDDA326E8157}" = CCC Help English
"{E64D1146-55AE-61E3-7C43-0DA16C0E4416}" = CCC Help Spanish
"{ED924786-EFE7-392D-F37C-64F4B6E19C2F}" = CCC Help Danish
"{EE174D9D-EF64-9FC7-C900-57C64F02E80D}" = Catalyst Control Center Localization Danish
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{EFF43C31-5F5A-574E-563C-68190FA13F0C}" = CCC Help Chinese Standard
"{F023B88F-DD32-8C85-F372-5319180597A5}" = Catalyst Control Center Localization Thai
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2912763-486E-B5D1-D0C6-BD1AE24D0C20}" = Catalyst Control Center Localization Korean
"{F2D65205-A1D0-5B53-4399-8AA39F738D9D}" = CCC Help Norwegian
"{F4ECB8B5-737F-6910-C26F-7DA94A2C0710}" = Catalyst Control Center Localization Finnish
"{F59778FB-4F31-0ADE-84C3-D7D77676A1A5}" = Catalyst Control Center Localization French
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FAAE0782-8073-112D-BC19-12C64A2D90D9}" = Skins
"{FAC15A44-64C7-1908-CC36-83BC9A308EA9}" = Catalyst Control Center Localization German
"{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now
"AC3Filter" = AC3Filter (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"AviSynth" = AviSynth 2.5
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"FE5AE7DC-7B01-4263-A94C-B4526C276550_is1" = iDevice Manager
"Forexyard MetaTrader 4" = Forexyard MetaTrader 4
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.2
"htmltads.exe" = HTML TADS Player Kit
"ImageJ_is1" = ImageJ 1.44p
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now
"IrfanView" = IrfanView (remove only)
"jZip" = jZip
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.1.4 (Standard)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"MARK 7.0" = MARK 7.0
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Quantum GIS Lisboa" = Quantum GIS Lisboa 1.8.0 Lisboa
"R for Windows 2.13.2_is1" = R for Windows 2.13.2
"SecureW2 EAP Suite" = SecureW2 EAP Suite 1.0.6 for Windows
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Transcribe!_is1" = Transcribe! 8.31
"VLC media player" = VLC media player 1.1.4
"Web_4.0.1460.0" = Microsoft Expression Web 4
"WinMend Folder Hidden_is1" = WinMend Folder Hidden 1.4.5.5
"WinRAR archiver" = WinRAR
"WinUHA_is1" = WinUHA 2.0 RC1 (2005.02.27)
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 09.05.2013 08:04:11 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 09.05.2013 08:04:11 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1388
 
Error - 09.05.2013 08:04:11 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1388
 
Error - 09.05.2013 08:04:12 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 09.05.2013 08:04:12 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2621
 
Error - 09.05.2013 08:04:12 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2621
 
Error - 09.05.2013 08:04:14 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 09.05.2013 08:04:14 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4071
 
Error - 09.05.2013 08:04:14 | Computer Name = XXX | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4071
 
Error - 09.05.2013 10:08:33 | Computer Name = XXX | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.69.0 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 2284  Anfangszeit: 01ce4cbacdb6f270  Zeitpunkt der Beendigung:
 12
 
[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 08.05.2013 15:15:22 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 650 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33161196
 (0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 08.05.2013 15:15:27 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2652 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.05.2013 15:15:27 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2169 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.05.2013 15:15:27 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 650 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33161196
 (0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 08.05.2013 15:15:32 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2652 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.05.2013 15:15:32 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2169 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.05.2013 15:15:32 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 650 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33161196
 (0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 08.05.2013 15:15:38 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2652 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.05.2013 15:15:38 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2169 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 08.05.2013 15:15:38 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
 650 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33161196
 (0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
[ Media Center Events ]
Error - 29.04.2012 14:35:27 | Computer Name = XXX | Source = Mcx2Dvcs | ID = 405
Description =
 
Error - 29.04.2012 14:40:05 | Computer Name = XXX | Source = McrMgr | ID = 107
Description =
 
Error - 29.04.2012 14:40:52 | Computer Name = XXX | Source = McrMgr | ID = 107
Description =
 
Error - 29.04.2012 14:41:43 | Computer Name = XXX | Source = McrMgr | ID = 107
Description =
 
Error - 29.04.2012 14:42:47 | Computer Name = XXX | Source = McrMgr | ID = 107
Description =
 
Error - 29.04.2012 14:43:51 | Computer Name = XXX | Source = McrMgr | ID = 107
Description =
 
[ OSession Events ]
Error - 05.02.2010 18:48:35 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 282960
 seconds with 29340 seconds of active time.  This session ended with a crash.
 
Error - 07.02.2010 09:58:02 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 140953
 seconds with 4560 seconds of active time.  This session ended with a crash.
 
Error - 30.03.2010 09:11:35 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 259436
 seconds with 4560 seconds of active time.  This session ended with a crash.
 
Error - 30.05.2010 08:50:37 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 89167
 seconds with 1020 seconds of active time.  This session ended with a crash.
 
Error - 19.08.2010 17:40:39 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 18
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 17.06.2011 06:35:58 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 91245
 seconds with 5100 seconds of active time.  This session ended with a crash.
 
Error - 23.11.2011 06:24:21 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 31586
 seconds with 660 seconds of active time.  This session ended with a crash.
 
Error - 16.04.2013 17:06:08 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 24
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 08.05.2013 15:12:59 | Computer Name = XXX | Source = Service Control Manager | ID = 7000
Description =
 
Error - 08.05.2013 15:12:59 | Computer Name = XXX | Source = Service Control Manager | ID = 7011
Description =
 
Error - 08.05.2013 15:13:27 | Computer Name = XXX | Source = Dhcp | ID = 1001
Description = Diesem Computer konnte keine Netzwerkadresse durch den DHCP-Server
 für die Netzwerkkarte mit der Netzwerkadresse 0013776C4860 zugeteilt werden. Der
 folgende Fehler ist aufgetreten:  %%258. Es wird weiterhin im Hintergrund versucht,
 eine Adresse vom Netzwerkadressserver (DHCP) zugeteilt zu bekommen.
 
Error - 08.05.2013 15:15:02 | Computer Name = XXX | Source = DCOM | ID = 10010
Description =
 
Error - 09.05.2013 07:29:00 | Computer Name = XXX | Source = volsnap | ID = 393251
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht vergrößert werden kann.
 
Error - 09.05.2013 07:41:27 | Computer Name = XXX | Source = bowser | ID = 8003
Description =
 
Error - 09.05.2013 07:53:28 | Computer Name = XXX | Source = bowser | ID = 8003
Description =
 
Error - 09.05.2013 09:17:33 | Computer Name = XXX | Source = bowser | ID = 8003
Description =
 
Error - 09.05.2013 09:29:34 | Computer Name = XXX | Source = bowser | ID = 8003
Description =
 
Error - 09.05.2013 09:41:34 | Computer Name = XXX | Source = bowser | ID = 8003
Description =
 
 
< End of report >
--- --- ---


OTL.text:
OTL Logfile:
Code:
OTL logfile created on: 09.05.2013 16:17:27 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\General Easy\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 0,88 Gb Available Physical Memory | 29,44% Memory free
6,22 Gb Paging File | 2,92 Gb Available in Paging File | 46,96% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 40,88 Gb Total Space | 1,34 Gb Free Space | 3,28% Space Free | Partition Type: NTFS
Drive D: | 182,00 Gb Total Space | 82,00 Gb Free Space | 45,06% Space Free | Partition Type: NTFS
Drive F: | 465,83 Gb Total Space | 1,21 Gb Free Space | 0,26% Space Free | Partition Type: NTFS
Drive H: | 465,56 Gb Total Space | 322,66 Gb Free Space | 69,31% Space Free | Partition Type: FAT32
 
Computer Name: GENERALEASY | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\XXX\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Windows Media Player\wmplayer.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\Java\jre6\bin\javaw.exe (Sun Microsystems, Inc.)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Mail\WinMail.exe (Microsoft Corporation)
PRC - C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics co., LTD.)
PRC - C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Windows\System32\btwhidcs.dll ()
MOD - C:\Programme\Samsung\Easy Display Manager\WinMove.dll ()
MOD - C:\Programme\Samsung\Samsung Magic Doctor\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\EasySpeedUpManager\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll ()
MOD - C:\Programme\WinUHA\shellwinuha.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (a2AntiMalware) -- C:\Programme\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (vpnagent) -- C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (a9sanmgx) --  File not found
DRV - (A2DDA) -- C:\Programme\Emsisoft Anti-Malware\a2ddax86.sys (Emsisoft GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (USB_RNDIS) -- C:\Windows\System32\drivers\usb8023.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (acsmux) -- C:\Windows\System32\drivers\acsmux.sys (Cisco Systems, Inc.)
DRV - (acsint) -- C:\Windows\System32\drivers\acsint.sys (Cisco Systems, Inc.)
DRV - (a2acc) -- C:\Programme\Emsisoft Anti-Malware\a2accx86.sys (Emsisoft GmbH)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys ()
DRV - (sfdrv01) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (KMDFMEMIO) -- C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (VMC302) -- C:\Windows\System32\drivers\vmc302.sys (Vimicro Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (AtiPcie) -- C:\Windows\System32\drivers\AtiPcie.sys (ATI Technologies Inc.)
DRV - (sfvfs02) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology (StarForce))
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NETw2v32) -- C:\Windows\System32\drivers\NETw2v32.sys (Intel® Corporation)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (sfsync02) -- C:\Windows\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfhlp02) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (SE27mdm) -- C:\Windows\System32\drivers\SE27mdm.sys (MCCI)
DRV - (SE27mdfl) -- C:\Windows\System32\drivers\SE27mdfl.sys (MCCI)
DRV - (SE27bus) -- C:\Windows\System32\drivers\SE27bus.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKLM\..\SearchScopes,DefaultScope =
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{DE2D1A3E-95BE-42F3-B8D0-9E191ACF94CB}: "URL" = hxxp://de.wikipedia.org/wiki/Spezial:Search?search={searchTerms}
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-i3752
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{E14811B2-F5DB-45B9-B7D5-4FD7D6DA9DA7}: "URL" = hxxp://www.benefind.de/result.html?q={searchTerms}
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "foxsearch"
FF - prefs.js..browser.search.order.1: "foxsearch"
FF - prefs.js..browser.search.selectedEngine: "foxsearch"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.8
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.09 15:37:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.04.16 19:36:15 | 000,000,000 | ---D | M]
 
[2009.01.10 21:27:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2013.04.30 19:02:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\udhwr9qy.default\extensions
[2013.04.30 19:02:13 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\udhwr9qy.default\extensions\ich@maltegoetz.de
[2012.03.02 22:52:49 | 000,020,591 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\udhwr9qy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2012.03.02 22:47:58 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.15 12:39:57 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.05.09 15:37:17 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.05.09 15:37:06 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.05.09 15:37:06 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.05.09 15:37:06 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.06.03 23:56:37 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src
[2013.05.09 15:37:06 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.05.09 15:37:06 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.05.09 15:37:06 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [emsisoft anti-malware] C:\Program Files\Emsisoft Anti-Malware\a2guard.exe (Emsisoft GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-2378140445-2909387748-784235094-1003..\Run: [ctfmon.exe] C:\PROGRA~2\rundll32.exe FG00 File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7044E990-DB48-44BA-B743-E604CF9DB3DB}: DhcpNameServer = 192.168.0.100
O18 - Protocol\Handler\msdaipp\0x00000001 {FF151822-B0BF-11D1-A80D-000000000000} - C:\Programme\Common Files\System\Ole DB\oledb32.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - Unable to obtain root file information for disk F:\
O33 - MountPoints2\{489e9d28-14d4-11df-b331-0013776c4860}\Shell\AutoRun\command - "" = G:\Get_Started_for_Win.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.09 15:37:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.05.09 15:37:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013.05.09 01:05:19 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2013.05.02 16:27:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013.05.01 19:15:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2013.05.01 19:12:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2013.04.30 14:00:37 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe
[2013.04.22 19:52:03 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Bitdefender
[2013.04.17 00:22:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
[2013.04.17 00:20:51 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware
[2013.04.17 00:20:51 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Anti-Malware
[2013.04.16 23:50:48 | 000,000,000 | ---D | C] -- C:\_OTL
[2013.04.15 19:28:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.04.15 19:28:40 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.04.12 14:26:46 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013.04.12 14:26:44 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013.04.12 14:26:44 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013.04.12 14:26:43 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013.04.12 14:26:43 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013.04.12 14:26:42 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013.04.12 14:26:41 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013.04.12 14:26:39 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013.04.11 16:53:36 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Qiusy
[2013.04.11 16:53:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Ukigod
[2013.04.11 16:53:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Lyugvu
[2013.04.10 14:43:30 | 003,603,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2013.04.10 14:43:30 | 003,551,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2013.04.10 14:43:29 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2013.04.10 14:43:23 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2013.04.10 14:43:19 | 002,049,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[14 C:\Users\XXX\Desktop\*.tmp files -> C:\Users\XXX\Desktop\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.09 16:20:35 | 000,699,844 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.09 16:20:35 | 000,655,966 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.09 16:20:35 | 000,156,942 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.09 16:20:35 | 000,128,980 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.09 15:57:05 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.09 15:23:29 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.09 15:23:29 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.09 14:35:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.09 13:57:01 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.09 01:05:19 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2013.05.07 22:23:15 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\SupBackGroundTask.job
[2013.05.07 22:22:49 | 3219,308,544 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.07 22:21:31 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.05.05 23:37:41 | 000,057,856 | ---- | M] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.05.01 19:22:12 | 095,023,320 | ---- | M] () -- C:\ProgramData\44ff.pad
[2013.05.01 19:13:53 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.05.01 19:13:53 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.30 14:00:59 | 095,023,320 | ---- | M] () -- C:\ProgramData\94hh.pad
[2013.04.30 14:00:37 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe
[2013.04.17 00:22:47 | 000,000,888 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2013.04.15 19:28:47 | 000,000,570 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.04.15 16:45:02 | 000,405,680 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[14 C:\Users\XXX\Desktop\*.tmp files -> C:\Users\XXX\Desktop\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.04.30 14:00:38 | 095,023,320 | ---- | C] () -- C:\ProgramData\94hh.pad
[2013.04.30 14:00:38 | 095,023,320 | ---- | C] () -- C:\ProgramData\44ff.pad
[2013.04.29 18:55:25 | 001,919,022 | ---- | C] () -- C:\Users\XXX\Desktop\Foto.JPG
[2013.04.17 00:22:47 | 000,000,888 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
[2013.04.15 19:28:47 | 000,000,570 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.04.14 12:47:24 | 000,000,004 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\skype.ini
[2012.11.08 01:16:13 | 000,010,752 | ---- | C] () -- C:\Windows\System32\KOAZXAAL.DLL
[2010.03.23 23:26:40 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.05.10 10:29:40 | 000,000,680 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2009.03.30 12:31:21 | 000,000,100 | ---- | C] () -- C:\Users\XXX\AppData\Local\fusioncache.dat
[2009.03.13 23:09:37 | 000,000,012 | ---- | C] () -- C:\Users\XXX\tmpifo.bat
[2009.02.17 16:35:47 | 000,033,727 | ---- | C] () -- C:\Users\XXX\ge_4_0.jar
[2009.02.17 16:24:20 | 000,000,313 | ---- | C] () -- C:\Users\XXX\.authorrc1
[2009.02.17 14:58:22 | 000,514,875 | ---- | C] () -- C:\Users\XXX\thes_am_6_0.jar
[2009.02.17 14:58:21 | 000,000,168 | ---- | C] () -- C:\Users\XXX\EditLiveForJava.ini
[2009.01.22 21:14:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.08.30 14:16:18 | 000,057,856 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\XXX\Desktop\Elephant Man - Dancehall Soca (2008) (mp3cut.net).mp3:TOC.WMV

< End of report >
--- --- ---

cosinus 09.05.2013 18:42
Bitte ein Log mit CF machen:



Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Canna 11.05.2013 12:43
Zuerst eine Anmerkung: Plötzlich habe ich überall Dateien die wie transparent aussehen. Zum Beispiel so was wie "~WRL3266.tmp" auf dem Desktop. Ich glaube das ist nach dem Scan mit CF passiert, kann das sein? Und was soll das?

Hier jetzt der Log, Virenscanner war abgeschaltet. Am Ende musste neu gestartet werden wg der Registrierungsschlüssel-Geschichte.

Code:
Combofix Logfile:

       
Code:

       
ComboFix 13-05-10.03 - XXX 10.05.2013  20:40:09.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3069.1846 [GMT 2:00]
ausgeführt von:: c:\users\XXX\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\SecureW2
c:\program files\SecureW2\Uninstall.exe
c:\programdata\44ff.pad
c:\programdata\94hh.pad
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\TTLS Manager.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk
c:\programdata\rundll32.exe
c:\users\XXX\AppData\Local\.#
c:\users\XXX\AppData\Roaming\.#
c:\users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-04-10 bis 2013-05-10  ))))))))))))))))))))))))))))))
.
.
2013-05-10 18:48 . 2013-05-10 18:49        --------        d-----w-        c:\users\XXX\AppData\Local\temp
2013-05-10 18:48 . 2013-05-10 18:48        --------        d-----w-        c:\users\Mcx1\AppData\Local\temp
2013-05-10 18:48 . 2013-05-10 18:48        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-05-02 14:27 . 2013-05-02 14:27        --------        d-----w-        c:\program files\ESET
2013-05-01 17:12 . 2013-05-01 17:12        --------        d-----w-        c:\program files\Common Files\Skype
2013-04-22 17:52 . 2013-04-22 17:52        --------        d-----w-        c:\program files\Common Files\Bitdefender
2013-04-16 22:20 . 2013-05-07 20:21        --------        d-----w-        c:\program files\Emsisoft Anti-Malware
2013-04-16 21:50 . 2013-04-16 21:50        --------        d-----w-        C:\_OTL
2013-04-15 17:28 . 2013-04-04 12:50        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
2013-04-11 14:53 . 2013-04-11 14:53        --------        d-----w-        c:\users\XXX\AppData\Roaming\Qiusy
2013-04-11 14:53 . 2013-04-16 17:40        --------        d-----w-        c:\users\XXX\AppData\Roaming\Ukigod
2013-04-11 14:53 . 2013-04-16 17:36        --------        d-----w-        c:\users\XXX\AppData\Roaming\Lyugvu
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-01 17:13 . 2012-04-15 15:06        691592        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2013-05-01 17:13 . 2011-05-17 08:52        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-02 21:59 . 2012-11-26 16:39        84744        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2013-04-02 21:59 . 2012-11-26 16:39        37352        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2013-04-02 21:59 . 2012-11-26 16:39        135136        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2013-03-11 13:25 . 2013-04-10 12:43        3603816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-10 12:43        3551080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-10 12:43        49152        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-10 12:43        64000        ----a-w-        c:\windows\system32\smss.exe
2013-03-08 03:53 . 2013-04-10 12:43        376320        ----a-w-        c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-10 12:43        2067968        ----a-w-        c:\windows\system32\mstscax.dll
2013-03-05 01:40 . 2013-04-10 12:43        2049024        ----a-w-        c:\windows\system32\win32k.sys
2013-03-03 19:07 . 2013-04-10 12:43        1082232        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-02-12 01:57 . 2013-03-21 19:46        15872        ----a-w-        c:\windows\system32\drivers\usb8023.sys
2013-05-09 13:37 . 2013-05-09 13:37        263064        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-02-28 18642024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-05-07 345312]
"emsisoft anti-malware"="c:\program files\Emsisoft Anti-Malware\a2guard.exe" [2013-04-16 3363752]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-24 723760]
VPN Client.lnk - c:\windows\Installer\{1CE60928-8325-49A8-8B06-633E48DD2B67}\Icon3E5562ED7.ico [2012-10-29 6144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoHotStart"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-22 05:05        40368        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-09 16:06        421736        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-08 13:17        52256        ----a-w-        c:\program files\CyberLink\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 16:36        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-01-08 13:26        68640        ----a-w-        c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 03:17        61440        ----a-w-        c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun
"ehTray.exe"=c:\windows\ehome\ehTray.exe
"Skype"="c:\program files\Skype\\Phone\Skype.exe" /nosplash /minimized
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [x]
R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [x]
R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files\Emsisoft Anti-Malware\a2ddax86.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 7.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ           BthServ
LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-07-18 08:53        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-29 21:18]
.
2013-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-29 21:18]
.
2013-05-07 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-09-25 12:26]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{4C826F10-D34B-4ba8-B609-1FB8C6482A05} - c:\casino\Europa Casino\casino.exe
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.0.100
DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab
FF - ProfilePath - c:\users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\udhwr9qy.default\
FF - prefs.js: browser.search.selectedEngine - foxsearch
FF - prefs.js: browser.startup.homepage - www.google.de
FF - ExtSQL: !HIDDEN! 2009-09-02 07:34; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-AppleSyncNotifier - c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
MSConfigStartUp-CanonMyPrinter - c:\program files\Canon\MyPrinter\BJMyPrt.exe
MSConfigStartUp-CanonSolutionMenu - c:\program files\Canon\SolutionMenu\CNSLMAIN.exe
MSConfigStartUp-OpwareSE4 - c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe
MSConfigStartUp-SSBkgdUpdate - c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe
AddRemove-Free M4a to MP3 Converter_is1 - c:\free m4a to mp3 converter\unins000.exe
AddRemove-SecureW2 EAP Suite - c:\program files\SecureW2\Uninstall.exe
AddRemove-Transcribe!_is1 - d:\transcribe!\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-05-10 20:49
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2378140445-2909387748-784235094-1003\Software\SecuROM\License information*]
"datasecu"=hex:49,0b,a3,16,8b,98,15,f5,51,b4,0e,01,9e,a5,c4,c3,e5,59,b1,07,e9,
   02,1c,3b,bf,d1,67,bf,3e,0e,ad,d4,41,66,1e,41,9d,02,c0,be,0b,27,16,5c,94,85,\
"rkeysecu"=hex:fd,2e,7a,68,d9,c7,6a,ad,0f,53,7b,95,43,38,91,48
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3224)
c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
c:\windows\system32\btmmhook.dll
.
Zeit der Fertigstellung: 2013-05-10  20:51:48
ComboFix-quarantined-files.txt  2013-05-10 18:51
.
Vor Suchlauf: 944.496.640 Bytes frei
Nach Suchlauf: 777.224.192 Bytes frei
.
- - End Of File - - 54582886478C0ABF253DDB4E905ACB29

--- --- ---

cosinus 12.05.2013 20:12
Combofix-Skript
WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

  • Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
  • Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
  • Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
  • Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
    Code:
    Folder::
    c:\users\XXX\AppData\Roaming\Qiusy
    c:\users\XXX\AppData\Roaming\Ukigod
    c:\users\XXX\AppData\Roaming\Lyugvu
    Solltest du deinen Benutzernamen z. B. durch "*****" oder "XXX" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Speichere dies als CFScript.txt auf deinem Desktop.
  • Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
  • Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  • Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
    Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

Canna 21.05.2013 23:11
Entschuldige, hat etwas länger gedauert durch die Pfingstage.
HIer der Log:

Code:
Combofix Logfile:

       
Code:

       
ComboFix 13-05-21.01 - XXX 21.05.2013  23:48:26.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3069.1593 [GMT 2:00]
ausgeführt von:: c:\users\XXX\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\XXX\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\XXX\AppData\Roaming\Lyugvu
c:\users\XXX\AppData\Roaming\Qiusy
c:\users\XXX\AppData\Roaming\Qiusy\uvav.yke
c:\users\XXX\AppData\Roaming\Ukigod
c:\users\XXX\AppData\Roaming\Ukigod\eqabo.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-04-21 bis 2013-05-21  ))))))))))))))))))))))))))))))
.
.
2013-05-21 21:56 . 2013-05-21 21:57        --------        d-----w-        c:\users\XXX\AppData\Local\temp
2013-05-21 21:56 . 2013-05-21 21:56        --------        d-----w-        c:\users\Mcx1\AppData\Local\temp
2013-05-21 21:56 . 2013-05-21 21:56        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-05-02 14:27 . 2013-05-02 14:27        --------        d-----w-        c:\program files\ESET
2013-05-01 17:12 . 2013-05-01 17:12        --------        d-----w-        c:\program files\Common Files\Skype
2013-04-22 17:52 . 2013-04-22 17:52        --------        d-----w-        c:\program files\Common Files\Bitdefender
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-01 17:13 . 2012-04-15 15:06        691592        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2013-05-01 17:13 . 2011-05-17 08:52        71048        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-04 12:50 . 2013-04-15 17:28        22856        ----a-w-        c:\windows\system32\drivers\mbam.sys
2013-04-02 21:59 . 2012-11-26 16:39        84744        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2013-04-02 21:59 . 2012-11-26 16:39        37352        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2013-04-02 21:59 . 2012-11-26 16:39        135136        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2013-03-11 13:25 . 2013-04-10 12:43        3603816        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2013-03-11 13:25 . 2013-04-10 12:43        3551080        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-09 03:45 . 2013-04-10 12:43        49152        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-09 01:28 . 2013-04-10 12:43        64000        ----a-w-        c:\windows\system32\smss.exe
2013-03-08 03:53 . 2013-04-10 12:43        376320        ----a-w-        c:\windows\system32\winsrv.dll
2013-03-08 03:52 . 2013-04-10 12:43        2067968        ----a-w-        c:\windows\system32\mstscax.dll
2013-03-05 01:40 . 2013-04-10 12:43        2049024        ----a-w-        c:\windows\system32\win32k.sys
2013-03-03 19:07 . 2013-04-10 12:43        1082232        ----a-w-        c:\windows\system32\drivers\ntfs.sys
2013-02-22 03:46 . 2013-04-12 12:26        1800704        ----a-w-        c:\windows\system32\jscript9.dll
2013-02-22 03:38 . 2013-04-12 12:26        1129472        ----a-w-        c:\windows\system32\wininet.dll
2013-02-22 03:37 . 2013-04-12 12:26        1427968        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-02-22 03:34 . 2013-04-12 12:26        142848        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-02-22 03:34 . 2013-04-12 12:26        420864        ----a-w-        c:\windows\system32\vbscript.dll
2013-02-22 03:31 . 2013-04-12 12:26        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
2013-05-09 13:37 . 2013-05-09 13:37        263064        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-02-28 18642024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-05-07 345312]
"emsisoft anti-malware"="c:\program files\Emsisoft Anti-Malware\a2guard.exe" [2013-04-16 3363752]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-24 723760]
VPN Client.lnk - c:\windows\Installer\{1CE60928-8325-49A8-8B06-633E48DD2B67}\Icon3E5562ED7.ico [2012-10-29 6144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"NoHotStart"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-22 05:05        40368        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-09 16:06        421736        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-08 13:17        52256        ----a-w-        c:\program files\CyberLink\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 16:36        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-01-08 13:26        68640        ----a-w-        c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2008-01-21 03:17        61440        ----a-w-        c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun
"ehTray.exe"=c:\windows\ehome\ehTray.exe
"Skype"="c:\program files\Skype\\Phone\Skype.exe" /nosplash /minimized
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [x]
R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [x]
R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files\Emsisoft Anti-Malware\a2ddax86.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 7.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ           BthServ
LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-07-18 08:53        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-29 21:18]
.
2013-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-02-29 21:18]
.
2013-05-19 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-09-25 12:26]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{4C826F10-D34B-4ba8-B609-1FB8C6482A05} - c:\casino\Europa Casino\casino.exe
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab
FF - ProfilePath - c:\users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\udhwr9qy.default\
FF - prefs.js: browser.search.selectedEngine - foxsearch
FF - prefs.js: browser.startup.homepage - www.google.de
FF - ExtSQL: !HIDDEN! 2009-09-02 07:34; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-05-21 23:57
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2378140445-2909387748-784235094-1003\Software\SecuROM\License information*]
"datasecu"=hex:49,0b,a3,16,8b,98,15,f5,51,b4,0e,01,9e,a5,c4,c3,e5,59,b1,07,e9,
   02,1c,3b,bf,d1,67,bf,3e,0e,ad,d4,41,66,1e,41,9d,02,c0,be,0b,27,16,5c,94,85,\
"rkeysecu"=hex:fd,2e,7a,68,d9,c7,6a,ad,0f,53,7b,95,43,38,91,48
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(864)
c:\users\XXX\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
c:\windows\system32\btmmhook.dll
.
Zeit der Fertigstellung: 2013-05-21  23:59:28
ComboFix-quarantined-files.txt  2013-05-21 21:59
ComboFix2.txt  2013-05-21 21:32
ComboFix3.txt  2013-05-10 18:51
.
Vor Suchlauf: 654.811.136 Bytes frei
Nach Suchlauf: 528.986.112 Bytes frei
.
- - End Of File - - F87D14FC9AFC4542F5F3CCF878D248CD

--- --- ---
Danke dir vielmals!!

cosinus 22.05.2013 09:08
Rootkitscan mit GMER

Bitte lade dir GMER Rootkit Scanner GMER herunter: (Dateiname zufällig)
  • Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
  • Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei: IAT/EAT und Show All
  • Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
  • Starte den Scan mit "Scan".
  • Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!


Tauchen Probleme auf?
  • Probiere alternativ den abgesicherten Modus.
  • Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.


Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Canna 22.05.2013 15:02
Ich bin nicht sicher ob du von Gmer auch den Log haben willst, hast du nicht geschrieben, aber ich füge ihn mal hier an:

Code:
GMER Logfile:

       
Code:

       
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-22 15:13:26
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS542525K9A300 rev.BBFOC3EP 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\XXX\AppData\Local\Temp\kwlyyfow.sys


---- System - GMER 2.1 ----

SSDT            8C0084F6                                                                                                             ZwCreateSection
SSDT            8C008500                                                                                                             ZwRequestWaitReplyPort
SSDT            8C0084FB                                                                                                             ZwSetContextThread
SSDT            8C008505                                                                                                             ZwSetSecurityObject
SSDT            8C00850A                                                                                                             ZwSystemDebugControl
SSDT            8C008497                                                                                                             ZwTerminateProcess

INT 0x81        ?                                                                                                                    84A90BF8
INT 0x82        ?                                                                                                                    863B2F00
INT 0x82        ?                                                                                                                    863B2F00
INT 0x91        ?                                                                                                                    84A90BF8
INT 0x92        ?                                                                                                                    863B2F00
INT 0x92        ?                                                                                                                    863B2F00
INT 0xA1        ?                                                                                                                    84A90BF8
INT 0xA2        ?                                                                                                                    863B2F00
INT 0xB2        ?                                                                                                                    863B2F00

---- Kernel code sections - GMER 2.1 ----

.text           ntoskrnl.exe!KeInsertQueue + 405                                                                                     82481A3C 4 Bytes  [F6, 84, 00, 8C]
.text           ntoskrnl.exe!KeInsertQueue + 729                                                                                     82481D60 4 Bytes  [00, 85, 00, 8C]
.text           ntoskrnl.exe!KeInsertQueue + 75D                                                                                     82481D94 4 Bytes  [FB, 84, 00, 8C]
.text           ntoskrnl.exe!KeInsertQueue + 7C1                                                                                     82481DF8 4 Bytes  [05, 85, 00, 8C]
.text           ntoskrnl.exe!KeInsertQueue + 809                                                                                     82481E40 4 Bytes  [0A, 85, 00, 8C]
.text           ...                                                                                                                 
?               System32\Drivers\sphx.sys                                                                                            Das System kann den angegebenen Pfad nicht finden. !
.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                                             section is writeable [0x8EC05000, 0x1F9F9A, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                                               section is writeable [0x9F53C300, 0x3ACC8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                                               section is writeable [0x9F60F300, 0x1B7E, 0xE8000020]
?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                           Das System kann die angegebene Datei nicht finden. !
?               C:\Users\GENERA~1\AppData\Local\Temp\catchme.sys                                                                     Das System kann den angegebenen Pfad nicht finden. !

---- Devices - GMER 2.1 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                               854271F8
Device          \FileSystem\fastfat \FatCdrom                                                                                        85FD51F8

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                              Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                              Wdf01000.sys

Device          \Driver\volmgr \Device\VolMgrControl                                                                                 854241F8
Device          \Driver\usbohci \Device\USBPDO-0                                                                                     8636F1F8
Device          \Driver\usbohci \Device\USBPDO-1                                                                                     8636F1F8
Device          \Driver\usbohci \Device\USBPDO-2                                                                                     8636F1F8
Device          \Driver\netbt \Device\NetBT_Tcpip_{7044E990-DB48-44BA-B743-E604CF9DB3DB}                                             86FA61F8
Device          \Driver\usbohci \Device\USBPDO-3                                                                                     8636F1F8
Device          \Driver\usbohci \Device\USBPDO-4                                                                                     8636F1F8
Device          \Driver\usbehci \Device\USBPDO-5                                                                                     863801F8
Device          \Driver\netbt \Device\NetBT_Tcpip_{9C04A1E9-B9FB-4C12-AFD8-F470D45D1103}                                             86FA61F8
Device          \Driver\volmgr \Device\HarddiskVolume1                                                                               854241F8
Device          \Driver\volmgr \Device\HarddiskVolume2                                                                               854241F8
Device          \Driver\cdrom \Device\CdRom0                                                                                         864BF1F8
Device          \Driver\volmgr \Device\HarddiskVolume3                                                                               854241F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                          854261F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                          sfsync02.sys
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-3                                                                          854261F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-3                                                                          sfsync02.sys
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                   854261F8
Device          \Driver\atapi \Device\Ide\IdePort0                                                                                   sfsync02.sys
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                   854261F8
Device          \Driver\atapi \Device\Ide\IdePort1                                                                                   sfsync02.sys
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                   854261F8
Device          \Driver\atapi \Device\Ide\IdePort2                                                                                   sfsync02.sys
Device          \Driver\atapi \Device\Ide\IdePort3                                                                                   854261F8
Device          \Driver\atapi \Device\Ide\IdePort3                                                                                   sfsync02.sys
Device          \Driver\PCI_PNP7211 \Device\00000066                                                                                 sphx.sys
Device          \Driver\volmgr \Device\HarddiskVolume4                                                                               854241F8
Device          \Driver\volmgr \Device\HarddiskVolume5                                                                               854241F8
Device          \Driver\netbt \Device\NetBt_Wins_Export                                                                              86FA61F8
Device          \Driver\Smb \Device\NetbiosSmb                                                                                       86FA91F8
Device          \Driver\USBSTOR \Device\00000095                                                                                     8758B1F8
Device          \Driver\USBSTOR \Device\00000095                                                                                     sfsync02.sys
Device          \Driver\iScsiPrt \Device\RaidPort0                                                                                   864D71F8
Device          \Driver\USBSTOR \Device\00000096                                                                                     8758B1F8
Device          \Driver\USBSTOR \Device\00000096                                                                                     sfsync02.sys
Device          \Driver\usbohci \Device\USBFDO-0                                                                                     8636F1F8
Device          \Driver\usbohci \Device\USBFDO-1                                                                                     8636F1F8
Device          \Driver\usbohci \Device\USBFDO-2                                                                                     8636F1F8
Device          \Driver\usbohci \Device\USBFDO-3                                                                                     8636F1F8
Device          \Driver\usbohci \Device\USBFDO-4                                                                                     8636F1F8
Device          \Driver\usbehci \Device\USBFDO-5                                                                                     863801F8
Device          \Driver\au4uuagx \Device\Scsi\au4uuagx1                                                                              864B7500
Device          \Driver\sptd \Device\1251463252                                                                                      sphx.sys
Device          \FileSystem\fastfat \Fat                                                                                             85FD51F8

AttachedDevice  \FileSystem\fastfat \Fat                                                                                             fltmgr.sys

Device          \FileSystem\cdfs \Cdfs                                                                                               871E5500

---- Trace I/O - GMER 2.1 ----

Trace           ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll sfsync02.sys >>UNKNOWN [0x854261f8]<<                            854261f8
Trace           1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b81238]                                                              85b81238
Trace           3 CLASSPNP.SYS[8adde8b3] -> nt!IofCallDriver -> [0x855cd860]                                                         855cd860
Trace           5 acpi.sys[8a7846bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x855b3b98]                                855b3b98
Trace           \Driver\atapi[0x85468808] -> IRP_MJ_CREATE -> 0x854261f8                                                             854261f8

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000278774082                                         
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                   771343423
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                   285507792
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                   1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                    
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Program Files\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x61 0x51 0xE5 0xCA ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                           
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0xEA 0xC2 0x70 0x75 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x8E 0x8C 0x43 0xD2 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                0xFB 0x15 0xAC 0x24 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000278774082 (not active ControlSet)                     
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Program Files\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x61 0x51 0xE5 0xCA ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)       
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xEA 0xC2 0x70 0x75 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) 
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x8E 0x8C 0x43 0xD2 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) 
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                    0xFB 0x15 0xAC 0x24 ...

---- Disk sectors - GMER 2.1 ----

Disk            \Device\Harddisk0\DR0                                                                                                unknown MBR code

---- EOF - GMER 2.1 ----

--- --- ---

MBAR hat nichts gefunden, hier der LOG:
Code:
Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org

Database version: v2013.05.22.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
XXX :: XXX [administrator]

22.05.2013 15:30:44
mbar-log-2013-05-22 (15-30-44).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28880
Time elapsed: 11 minute(s), 37 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
Kannst du mir bitte eine kurze Status-Meldung geben? Wurden bisher gefährliche Viren gefunden/beseitigt?

Danke!!!

cosinus 22.05.2013 15:18
aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).




TDSS-Killer

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Canna 22.05.2013 16:31
aswMBR:
Code:
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-05-22 16:32:19
-----------------------------
16:32:19.884    OS Version: Windows 6.0.6002 Service Pack 2
16:32:19.884    Number of processors: 2 586 0xF0D
16:32:19.885    ComputerName: XXX  UserName:
16:32:22.619    Initialize success
16:35:55.286    AVAST engine defs: 13052200
16:37:35.167    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
16:37:35.170    Disk 0 Vendor: Hitachi_HTS542525K9A300 BBFOC3EP Size: 238475MB BusType: 3
16:37:35.185    Disk 0 MBR read successfully
16:37:35.189    Disk 0 MBR scan
16:37:35.213    Disk 0 unknown MBR code
16:37:35.236    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
16:37:35.271    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        41866 MB offset 20973568
16:37:35.293    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      186366 MB offset 106715136
16:37:35.309    Disk 0 scanning sectors +488394744
16:37:35.600    Disk 0 scanning C:\Windows\system32\drivers
16:37:56.487    Service scanning
16:38:24.183    Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
16:38:34.779    Modules scanning
16:38:43.207    Disk 0 trace - called modules:
16:38:43.234    ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll sfsync02.sys >>UNKNOWN [0x854251f8]<<
16:38:43.241    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x856c2ac8]
16:38:43.248    3 CLASSPNP.SYS[8adda8b3] -> nt!IofCallDriver -> [0x855ce918]
16:38:43.255    5 acpi.sys[8a77a6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x855b0b98]
16:38:43.262    \Driver\atapi[0x8546d5b0] -> IRP_MJ_CREATE -> 0x854251f8
16:38:44.180    AVAST engine scan C:\Windows
16:38:49.473    AVAST engine scan C:\Windows\system32
16:46:22.721    AVAST engine scan C:\Windows\system32\drivers
16:46:48.184    AVAST engine scan C:\Users\XXX
17:10:46.450    AVAST engine scan C:\ProgramData
17:17:59.423    Scan finished successfully
17:19:07.514    Disk 0 MBR has been saved successfully to "C:\Users\XXX\Desktop\MBR.dat"
17:19:07.525    The log file has been saved successfully to "C:\Users\XXX\Desktop\aswMBR.txt"

Der Log des TDSS-Killer ist zu lang. Ich versuche es in einem 2. seperaten Post...

Canna 22.05.2013 16:34
Die Datei ist zu groß, ich hänge sie als Anhang an, hoffe das ist ok so.

Kannst du mir bitte eine kurze Status-Meldung geben? Wurden bisher gefährliche Viren gefunden/beseitigt?

Danke!!!

cosinus 22.05.2013 20:18
JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




Im Anschluss:

adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Danach eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles in CODE-Tags hier in den Thread.

Canna 22.05.2013 23:04
JRT:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows Vista (TM) Home Premium x86
Ran by General Easy on 22.05.2013 at 22:51:06,90
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


~~~ Services

~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{DE2D1A3E-95BE-42F3-B8D0-9E191ACF94CB}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\General Easy\AppData\Roaming\software4u"



~~~ FireFox

Emptied folder: C:\Users\General Easy\AppData\Roaming\mozilla\firefox\profiles\udhwr9qy.default\minidumps [35 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.05.2013 at 22:54:12,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

adw-cleaner:
AdwCleaner Logfile:
Code:
# AdwCleaner v2.301 - Datei am 22/05/2013 um 23:01:22 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : XXX - XXX
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\XXX\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\udhwr9qy.default\foxydeal.sqlite

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16476

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v20.0.1 (de)

Datei : C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\udhwr9qy.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [2925 octets] - [17/04/2013 00:03:54]
AdwCleaner[R2].txt - [3044 octets] - [17/04/2013 00:10:59]
AdwCleaner[S1].txt - [359 octets] - [17/04/2013 00:05:54]
AdwCleaner[S2].txt - [3212 octets] - [17/04/2013 00:16:08]
AdwCleaner[S3].txt - [1167 octets] - [22/05/2013 23:01:22]

########## EOF - C:\AdwCleaner[S3].txt - [1227 octets] ##########
--- --- ---

[/code]


OTL Logfile:
Code:
OTL logfile created on: 22.05.2013 23:11:21 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\XXX\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,60 Gb Available Physical Memory | 53,45% Memory free
6,19 Gb Paging File | 4,84 Gb Available in Paging File | 78,18% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 40,88 Gb Total Space | 1,21 Gb Free Space | 2,96% Space Free | Partition Type: NTFS
Drive D: | 182,00 Gb Total Space | 90,25 Gb Free Space | 49,59% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\XXX\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
PRC - C:\Programme\Samsung\Samsung Update Plus\SUPBackGround.exe ()
PRC - C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics co., LTD.)
PRC - C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Samsung\Samsung Update Plus\SUPBackGround.exe ()
MOD - C:\Programme\Samsung\Samsung Update Plus\HMXML.dll ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll ()
MOD - C:\Windows\System32\btwhidcs.dll ()
MOD - C:\Programme\Samsung\Easy Display Manager\WinMove.dll ()
MOD - C:\Programme\Samsung\Samsung Magic Doctor\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\EasySpeedUpManager\HookDllPS2.dll ()
MOD - C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll ()
MOD - C:\Programme\WinUHA\shellwinuha.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (vpnagent) -- C:\Programme\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (CVPND) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
SRV - (ACDaemon) -- C:\Programme\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (SQLWriter) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (catchme) -- C:\Users\GENERA~1\AppData\Local\Temp\catchme.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (amud1r2v) --  File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (USB_RNDIS) -- C:\Windows\System32\drivers\usb8023.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (acsmux) -- C:\Windows\System32\drivers\acsmux.sys (Cisco Systems, Inc.)
DRV - (acsint) -- C:\Windows\System32\drivers\acsint.sys (Cisco Systems, Inc.)
DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys ()
DRV - (sfdrv01) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)
DRV - (KMDFMEMIO) -- C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (VMC302) -- C:\Windows\System32\drivers\vmc302.sys (Vimicro Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (AtiPcie) -- C:\Windows\System32\drivers\AtiPcie.sys (ATI Technologies Inc.)
DRV - (sfvfs02) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology (StarForce))
DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (NETw2v32) -- C:\Windows\System32\drivers\NETw2v32.sys (Intel® Corporation)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (sfsync02) -- C:\Windows\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfhlp02) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (SE27mdm) -- C:\Windows\System32\drivers\SE27mdm.sys (MCCI)
DRV - (SE27mdfl) -- C:\Windows\System32\drivers\SE27mdfl.sys (MCCI)
DRV - (SE27bus) -- C:\Windows\System32\drivers\SE27bus.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes,DefaultScope = {DECA3892-BA8F-44b8-A993-A466AD694AE4}
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=chr-i3752
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\SearchScopes\{E14811B2-F5DB-45B9-B7D5-4FD7D6DA9DA7}: "URL" = hxxp://www.benefind.de/result.html?q={searchTerms}
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "foxsearch"
FF - prefs.js..browser.search.order.1: "foxsearch"
FF - prefs.js..browser.search.selectedEngine: "foxsearch"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.8
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\3.0.50106.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.09 15:37:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.04.16 19:36:15 | 000,000,000 | ---D | M]
 
[2009.01.10 21:27:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2013.04.30 19:02:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\udhwr9qy.default\extensions
[2013.04.30 19:02:13 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\udhwr9qy.default\extensions\ich@maltegoetz.de
[2012.03.02 22:52:49 | 000,020,591 | ---- | M] () (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\udhwr9qy.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2012.03.02 22:47:58 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.15 12:39:57 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.05.09 15:37:17 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.05.09 15:37:06 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.05.09 15:37:06 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.05.09 15:37:06 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.06.03 23:56:37 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src
[2013.05.09 15:37:06 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.05.09 15:37:06 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.05.09 15:37:06 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2013.05.21 23:56:57 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O3 - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\..\Toolbar\WebBrowser: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Europa Casino - {4C826F10-D34B-4ba8-B609-1FB8C6482A05} - C:\Casino\Europa Casino\casino.exe File not found
O9 - Extra 'Tools' menuitem : Europa Casino - {4C826F10-D34B-4ba8-B609-1FB8C6482A05} - C:\Casino\Europa Casino\casino.exe File not found
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe File not found
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} hxxp://www.sibelius.com/download/software/win/ActiveXPlugin.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 vpnweb.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9C04A1E9-B9FB-4C12-AFD8-F470D45D1103}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\msdaipp\0x00000001 {FF151822-B0BF-11D1-A80D-000000000000} - C:\Programme\Common Files\System\Ole DB\oledb32.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.22 23:00:31 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2013.05.22 22:51:01 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.05.22 22:50:39 | 000,000,000 | ---D | C] -- C:\JRT
[2013.05.22 22:00:40 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\XXX\Desktop\JRT.exe
[2013.05.21 23:59:30 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.05.21 23:59:30 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\temp
[2013.05.21 23:58:32 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.05.21 23:46:50 | 000,000,000 | ---D | C] -- C:\ComboFix
[2013.05.10 20:26:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.05.10 20:26:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.05.10 20:26:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.05.10 20:26:01 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.05.10 20:25:36 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.05.09 15:37:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013.05.09 15:37:29 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013.05.02 16:27:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2013.05.01 19:15:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2013.05.01 19:12:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.22 23:05:12 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.22 23:04:45 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\SupBackGroundTask.job
[2013.05.22 23:03:58 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.22 23:03:57 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.22 23:03:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.22 23:02:57 | 3219,308,544 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.22 23:01:53 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2013.05.22 23:00:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2013.05.22 22:59:44 | 000,632,031 | ---- | M] () -- C:\Users\XXX\Desktop\adwcleaner.exe
[2013.05.22 22:57:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.22 22:00:41 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\XXX\Desktop\JRT.exe
[2013.05.22 14:48:03 | 000,655,966 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.22 14:48:02 | 000,699,844 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.22 14:48:02 | 000,156,942 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.22 14:48:02 | 000,128,980 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.21 23:56:57 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.05.20 16:51:31 | 000,064,920 | ---- | M] () -- C:\Users\XXX\Desktop\Utility bill Heiko Schmidt.JPG
[2013.05.20 16:45:45 | 000,015,670 | ---- | M] () -- C:\Users\XXX\Desktop\138266924.pdf
[2013.05.19 18:18:04 | 000,095,033 | ---- | M] () -- C:\Users\XXX\Desktop\Praktikumsbericht_Joorman.pdf
[2013.05.16 19:06:46 | 000,066,048 | ---- | M] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.05.01 19:13:53 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2013.05.01 19:13:53 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2013.04.29 18:55:25 | 001,919,022 | ---- | M] () -- C:\Users\XXX\Desktop\Foto.JPG
 
========== Files Created - No Company Name ==========
 
[2013.05.22 22:59:44 | 000,632,031 | ---- | C] () -- C:\Users\XXX\Desktop\adwcleaner.exe
[2013.05.20 16:48:45 | 000,064,920 | ---- | C] () -- C:\Users\XXX\Desktop\Utility bill Heiko Schmidt.JPG
[2013.05.20 16:45:45 | 000,015,670 | ---- | C] () -- C:\Users\XXX\Desktop\138266924.pdf
[2013.05.19 18:18:04 | 000,095,033 | ---- | C] () -- C:\Users\XXX\Desktop\Praktikumsbericht_Joorman.pdf
[2013.05.10 20:26:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.05.10 20:26:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.05.10 20:26:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.05.10 20:26:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.05.10 20:26:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.04.29 18:55:25 | 001,919,022 | ---- | C] () -- C:\Users\XXX\Desktop\Foto.JPG
[2013.04.14 12:47:24 | 000,000,004 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\skype.ini
[2012.11.08 01:16:13 | 000,010,752 | ---- | C] () -- C:\Windows\System32\KOAZXAAL.DLL
[2010.03.23 23:26:40 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.05.10 10:29:40 | 000,000,680 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2009.03.30 12:31:21 | 000,000,100 | ---- | C] () -- C:\Users\XXX\AppData\Local\fusioncache.dat
[2009.03.13 23:09:37 | 000,000,012 | ---- | C] () -- C:\Users\XXX\tmpifo.bat
[2009.02.17 16:35:47 | 000,033,727 | ---- | C] () -- C:\Users\XXX\ge_4_0.jar
[2009.02.17 16:24:20 | 000,000,313 | ---- | C] () -- C:\Users\XXX\.authorrc1
[2009.02.17 14:58:22 | 000,514,875 | ---- | C] () -- C:\Users\XXX\thes_am_6_0.jar
[2009.02.17 14:58:21 | 000,000,168 | ---- | C] () -- C:\Users\XXX\EditLiveForJava.ini
[2009.01.22 21:14:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.08.30 14:16:18 | 000,066,048 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\XXX\Desktop\Elephant Man - Dancehall Soca (2008) (mp3cut.net).mp3:TOC.WMV

< End of report >
--- --- ---

[/code]

OTL - Extras:
OTL Logfile:
Code:
OTL Extras logfile created on: 22.05.2013 23:11:21 - Run 3
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\XXX\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,60 Gb Available Physical Memory | 53,45% Memory free
6,19 Gb Paging File | 4,84 Gb Available in Paging File | 78,18% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 40,88 Gb Total Space | 1,21 Gb Free Space | 2,96% Space Free | Partition Type: NTFS
Drive D: | 182,00 Gb Total Space | 90,25 Gb Free Space | 49,59% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "D:\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01B9F681-96E7-486F-8045-E5CA8BAD2209}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0F926404-25A0-4D52-92FA-90F45A80BE2A}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{1958B11C-F1B9-4D7D-9177-0084E29679F0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{21FBADF4-A125-4407-B6A5-665E7F3AD009}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{24140EBC-A09A-4A91-A468-91D79B35EB4F}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{2484F356-B76D-4C60-8064-9F7BB9A9212A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2BD51217-E6CB-43E2-BE9D-3792DB532E2D}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{32DF3CF1-4CBF-4DD3-9B09-F54F9E387853}" = lport=3390 | protocol=6 | dir=in | app=system |
"{33D231E8-63A3-40AC-9505-BE6F3BDC45DC}" = rport=10243 | protocol=6 | dir=out | app=system |
"{380992D6-7B6E-4E67-A141-7BB1EBEB9B6C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{38E88E1F-CDE2-4049-BC31-840640284514}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{392CE8B4-AFE6-4B35-BFAE-CEB0E17A9B9E}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{3C8B1D65-CDC2-4341-B55E-78F9F0473AF2}" = lport=3390 | protocol=6 | dir=in | app=system |
"{3D1A2F47-D56C-4463-B8E1-8CE0F525B25C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{3FC8A2CD-25DB-4810-B0DF-0D7602F96750}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{3FCFB53A-2D30-49FB-8348-61EBFFDEFB5E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{45918B47-734F-4671-B88D-9045B645A195}" = rport=10244 | protocol=6 | dir=out | app=system |
"{6213AFAF-56D7-4144-B23E-65DF7A062A68}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6435C2F5-623F-43A2-BC8C-391755B8C475}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{67922FB6-C00A-4F84-9543-B02FB9D76E08}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{67C0F5C1-BD97-45D3-B668-C7CD665FD392}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6800322B-E183-4D17-AA67-56F9C84BBBB0}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{885DDFEE-ECC2-458C-AA4E-AFDAC929C7EC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{951F7DD5-3FA0-4C57-823E-25AD2F9118DF}" = lport=10243 | protocol=6 | dir=in | app=system |
"{98E6CE89-1E2E-465A-87BF-92E6D218F0AA}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9BC8BDE5-2D43-440B-8938-D348F262B9B1}" = rport=10244 | protocol=6 | dir=out | app=system |
"{ABCE8658-12FE-47DA-879A-9F4CAAED9D39}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B09D5F60-FE73-415B-950E-CB0714166E00}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B63830EC-0AAC-4FCA-A587-447F5ABDD215}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{BA8D5678-A8E1-44E6-934C-BCDC2ACC8613}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BF12A24D-B542-4388-8D6D-D29E6A948848}" = lport=10244 | protocol=6 | dir=in | app=system |
"{C85AEE7B-83B6-4DD3-A71F-DACE8BAB70E9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CFEA2DA0-C909-45DC-B6C2-21C67AFD62D6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DE31F7EA-701C-4769-8C44-880FDF3A2B2E}" = lport=10244 | protocol=6 | dir=in | app=system |
"{E59E3407-33AA-4F9F-8286-F759AE282C65}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E7B6A0DF-8819-46EB-8F09-F1AEE30D2E58}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EBB1D389-7963-411D-9EBB-1FD738266E0A}" = lport=6004 | protocol=17 | dir=in | app=d:\microsoft office\office12\outlook.exe |
"{EC092DC5-98A3-4FAA-B951-5B6E3B8F0A32}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ECB455E1-DF58-40DE-9418-F47E835C200B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FFF2C2C2-E18E-4E46-AC7E-5D650CAAB9DD}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03128E8B-AAEA-4B7D-A645-CE8F38714716}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{057CC98F-3BDA-42F9-A3F7-C46C9622F6F3}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{0C682038-637A-4216-B0B8-E4360D546DD3}" = protocol=17 | dir=in | app=d:\idevice manager\software4u.idevicemanager.exe |
"{13B34E19-AAEB-4C27-9FA2-52E27A832E42}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{19B9FBB8-501B-4352-9784-A12992009225}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{265C6D09-F3B0-43AA-B333-AECAB097B0AE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2CE5843C-82B3-4294-9E95-C06A192581A8}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{363FD5FE-625A-48E2-9C24-9A2958B5E415}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{3F823B1A-8BEF-4F52-BA75-CFB96B00E622}" = protocol=6 | dir=in | app=d:\avatar\bin\avatar.exe |
"{4D2C4EAE-2911-449A-9D9D-A8B17F1E2B0F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4E0F8CAE-8739-419D-B61A-86B41A73CACB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{52FDDBAA-53D9-441D-8AEF-416BC5771497}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{599CC9AB-231C-4956-82C7-8D8EA3CF58D9}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5A0DA669-7AE0-4EC9-B599-C8E9B86920AA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5C9FB055-3E9A-44B1-911B-A9D864302EDB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6E93FA4A-B089-4260-8E1C-9E6F8C045D16}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{708F3A2B-C240-4FD1-98A4-92257F050FFB}" = protocol=6 | dir=out | app=system |
"{71AECD10-B940-4A61-9DBF-44C76B4AD0C8}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{7EF9F2C8-B473-46AB-89E1-75ECB1A23B52}" = protocol=6 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"{82A9B3EB-6188-48E2-BD42-E30B7E3B02B1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8382734C-C8D1-4FA2-8585-78799DF1DD4F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{83AB05C6-B61D-47A6-8BF2-78BFB88867E1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{94957FF9-14EA-42AD-9911-25DD8682FAA3}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{972A4537-7CA1-4DE5-97EE-74C7BAA9A0AB}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{98368AE1-53BF-46A0-B5C7-399141EFB10E}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{9B536AFE-3142-45B1-AA8F-2EFF56C499E2}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{B209FBC9-B928-4451-9DA7-8F2B79CD0956}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B2BD176F-B7EA-4A01-B21E-59C9784E730A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B32455C8-65E9-4C83-A8F6-66580DA83A82}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{B4BB32AD-C80C-4B76-8253-2D3330979461}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{B5EEC94C-3164-4691-ADF6-42DCA4AE0B8F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CB73F8F1-A1B8-44EE-B7BD-309FD3FC3943}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CE714BD0-9C53-4BCF-902E-1D2839CA84FD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CF38DB1D-35CF-4812-A2A8-0FDE2D679D0E}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{D1B8AAC7-EAD1-4E89-82B0-6F7A1D841EC5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DA5986A1-AC76-468E-BE42-3C0CCD0894D4}" = protocol=6 | dir=in | app=d:\idevice manager\software4u.idevicemanager.exe |
"{E005FCF5-2DC4-4F4C-89E5-3C1E2672D8BF}" = protocol=17 | dir=in | app=d:\avatar\bin\avatarlauncher.exe |
"{E4CC8D85-348C-476C-8E52-567BC748AA37}" = protocol=6 | dir=in | app=d:\avatar\bin\avatarlauncher.exe |
"{E961DAF4-8D2F-4015-A091-04CDEFEF5BDD}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{E9F0A1AB-E2F2-43A0-ABE0-1F6990A88200}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe |
"{F4354AE6-FDBE-407B-93C8-792C09731856}" = protocol=17 | dir=in | app=d:\avatar\bin\avatar.exe |
"{F6A4DB30-CDBD-4923-AFCE-EB3318298D55}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{F73EF69F-978F-4BB1-9C41-B449AB7EF792}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{FFA01A7B-3962-4FB8-90DC-7D7742AD56AF}" = protocol=17 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{11DCA69A-6FC7-42EF-8972-842CCA13A7E7}C:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{2104991F-57F9-4343-B951-7A9D80E4117B}C:\program files\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"TCP Query User{3E9DCC5B-6546-4957-9ED2-C32D82AC4A3C}C:\program files\imagej\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"TCP Query User{4088A077-078E-40EF-A59F-608AAD224549}C:\users\XXX\desktop\utorrent.exe" = protocol=6 | dir=in | app=c:\users\XXX\desktop\utorrent.exe |
"TCP Query User{471A5111-DDD9-42E2-B667-89CAC81609E4}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{596B45BA-0711-4F67-A678-D6E7B6518614}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{5F08205D-FDB0-4B3E-A3F9-105BC0D95801}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{61A40DDF-F88F-418E-A817-E74165FC3259}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{781F61E8-E872-4FB9-AC04-2955E07B020B}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{8D92669B-75E3-4B3E-8C46-895DB634D7E8}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{94B24CDD-39D5-4822-A907-F72BFD229AC8}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{986A0B19-3CBF-494A-A3CA-9BD71D0F4D08}D:\quantumgis\apps\udig\udig_internal.exe" = protocol=6 | dir=in | app=d:\quantumgis\apps\udig\udig_internal.exe |
"TCP Query User{BE312FCB-A6F8-44EC-AB05-EBD25CF602CC}C:\program files\imagej\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"TCP Query User{C1484956-EEE2-4CC2-8824-439DE72FA8D8}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{DAFDCCB7-3193-45ED-9CB7-E3D187D4AC2B}C:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe |
"TCP Query User{F74F3362-BCF7-4242-8580-71A52A60C835}D:\quantumgis\bin\javaw.exe" = protocol=6 | dir=in | app=d:\quantumgis\bin\javaw.exe |
"UDP Query User{4EA51141-F025-4024-A7C5-710E5CC59337}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{5F250EB7-04DD-456A-8A9C-B342ACF79871}C:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{63410484-20F0-4318-B753-0B898C7967D5}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{640DF4EF-26C1-442D-B8B7-9372B402D08E}C:\program files\imagej\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"UDP Query User{8245BFC0-F55A-4849-9550-74E729DA6206}C:\program files\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"UDP Query User{9E4235A6-F08F-4B45-97BB-C8703F98124F}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{A66B2557-65C3-4A9D-B625-89728B831AE3}D:\quantumgis\apps\udig\udig_internal.exe" = protocol=17 | dir=in | app=d:\quantumgis\apps\udig\udig_internal.exe |
"UDP Query User{AFDCF9DC-1EBE-4688-84D0-11FE9BD4417D}C:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\jzip\jzip27205\jzip03dd\routerclient.exe |
"UDP Query User{BBD0FDBD-2A1E-44D4-A328-B0BCD4282A5A}D:\quantumgis\bin\javaw.exe" = protocol=17 | dir=in | app=d:\quantumgis\bin\javaw.exe |
"UDP Query User{C3197299-C64E-44A3-BC9F-35234A6FF9ED}C:\users\XXX\desktop\utorrent.exe" = protocol=17 | dir=in | app=c:\users\XXX\desktop\utorrent.exe |
"UDP Query User{C3D2F7D3-8D0E-4F43-ACD1-3C438C975419}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{CB22E753-188E-4F66-B155-ACB8C23F77B4}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{CB3C30D9-A804-4B05-93F0-74BAB3A19DB5}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{D57359DF-894C-4C89-80B5-4076486106D5}C:\program files\imagej\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"UDP Query User{DCBAAC70-5B53-4CA8-A2FC-A104828E7B4B}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{EBE12859-1936-4CA6-B282-AF60FAFFC273}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}" = imagine digital freedom - Samsung
"{018FE763-ECD9-577B-05D5-3A67364FBAAA}" = Catalyst Control Center Localization Hungarian
"{02E43EC2-6B1C-45B5-9E48-941C3E1B204A}_is1" = System.Data.SQLite v1.0.81.0
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.5000
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1252B4EB-51F1-F349-6D79-954D877FB865}" = Catalyst Control Center Localization Swedish
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution II
"{14F91018-2A76-725D-056C-ECFF03F40F54}" = CCC Help Swedish
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1CE60928-8325-49A8-8B06-633E48DD2B67}" = Cisco Systems VPN Client 5.0.07.0410
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7A2A3A-B874-1E81-D291-A5ACB452F23F}" = CCC Help Italian
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2433BAD7-453F-473D-BE81-455E68940DEB}" = Catalyst Control Center - Branding
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 17
"{28A78C92-AC8C-DA80-6100-99A3AC4C3911}" = CCC Help Turkish
"{29ED20C9-5E15-4969-9279-25BF3727A3DA}" = iTunes
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{303A3978-8F11-DAAB-6F72-3D399477CC31}" = Catalyst Control Center Localization Chinese Standard
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D69628B-4DE8-43C7-9A22-F90F5B870C08}" = ArcSoft TotalMedia Backup
"{3FF8E8A7-5BA8-4D9E-B976-B05B2B00B0AE}" = Microsoft Expression Web 4
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{4890127D-D62F-C496-9EFF-89FC910ABFE5}" = Catalyst Control Center Localization Polish
"{4C82121C-EB17-CEB0-996B-4D73FA0FAB47}" = Catalyst Control Center Graphics Light
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{5466620C-3B00-0BEE-D626-1FBE29A16AC4}" = Catalyst Control Center Localization Russian
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{5508C9EB-5336-87F4-C2DB-53F2B3A482E7}" = Catalyst Control Center Graphics Previews Vista
"{5611C71F-AFC6-EBA3-E3E1-9FCCEC9647EE}" = ccc-core-static
"{5D7D1784-84A9-0EDB-62A6-D479F7F75DF6}" = CCC Help Chinese Traditional
"{62172AFD-E7F0-CAC1-1334-CB0159566F6C}" = Catalyst Control Center Localization Greek
"{64F67489-76BB-4CDD-A236-F954BE774B35}" = NVIDIA PhysX
"{65A0F799-1E9A-093B-BB8B-986203DAD390}" = Catalyst Control Center Core Implementation
"{67B41BEF-F407-D81D-762F-CC44CC6FEB7A}" = Catalyst Control Center Localization Italian
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6DFBD0A2-C692-44F5-1C96-773ED9B16002}" = Catalyst Control Center Graphics Full Existing
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{71A51B09-E7D3-11DB-A386-005056C00008}" = Vimicro UVC Camera
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{768361B2-F78F-FFAA-5B1F-EFDB41C70D95}" = CCC Help French
"{76902AF9-DA86-419D-B533-077643124722}" = Sony ACID Pro 5.0
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A98B8DF-687E-8F7F-9A4A-ED1D9B306EAF}" = CCC Help Russian
"{804F1285-8CBF-408D-8CDC-D4D40003B2E4}" = PlayCamera
"{818F922E-DE7A-6FC1-D85C-C44495070174}" = Catalyst Control Center Localization Dutch
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DB12734-9543-FBB3-E94D-3BE397ED8078}" = Catalyst Control Center Localization Japanese
"{9001B8A7-B591-7559-2264-B4A0F480D1A8}" = CCC Help Polish
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{905DF41F-D74C-6DF4-9453-D29CDE46A4A4}" = CCC Help Finnish
"{92041735-0623-CD56-9BCB-6CD4385232B0}" = CCC Help Thai
"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"{96A1E845-A730-4488-99A2-054C5BFAB9D1}" = CCC Help Greek
"{97EE277B-C0D9-6394-9A01-7681086EED5C}" = Catalyst Control Center Localization Portuguese
"{99F9ACB2-BCD2-B5A7-7738-24FB0B7B7763}" = ccc-utility
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DCC214C-CD1A-1115-6775-A9056185FE4E}" = ATI Catalyst Install Manager
"{9F06F30E-5138-2315-EC57-D4A23D572649}" = CCC Help Portuguese
"{A00B9A50-3090-4CFF-9CDA-82DA0BEDAA21}" = Apple Mobile Device Support
"{A3D22413-28D3-636E-1CE9-BC55C46364C3}" = Catalyst Control Center Graphics Full New
"{A41EB7B5-8883-4795-A587-AAD8A84A010D}" = Cisco AnyConnect Secure Mobility Client
"{A53EA764-AB97-445E-002B-A32165BB0B3B}" = CCC Help Dutch
"{A586A89F-2BC4-CEB3-3C52-D1F4B57F572F}" = Catalyst Control Center Localization Turkish
"{A5EF9152-55CC-DF0E-AEDA-98D20EC3293E}" = CCC Help Japanese
"{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A952B4E1-913A-1492-A551-43EAE1D44E1D}" = Catalyst Control Center Localization Chinese Traditional
"{AC76BA86-7AD7-1031-7B44-A82000000003}" = Adobe Reader 8.2.6 - Deutsch
"{B0524CD7-2B3F-50C1-B3AD-87457B7FF852}" = Catalyst Control Center Localization Spanish
"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe  1.8.15.1
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C359699C-2D0A-5F08-9C44-4C1A508C4990}" = CCC Help Hungarian
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint 2.0
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDA83283-8D9F-321F-5C76-AF68D3039B87}" = Catalyst Control Center Localization Czech
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1C099EA-C28C-6593-8CE1-38F63EBD22F4}" = CCC Help Korean
"{D885CD8B-343B-271D-85EB-DFE5BE962C0D}" = Catalyst Control Center Localization Norwegian
"{DDDA0B2B-674E-A49F-6E31-184F00BDDC85}" = CCC Help Czech
"{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}" = Prince of Persia T2T
"{E2430405-1983-852E-B297-4FF9207E6C16}" = CCC Help German
"{E596EC1C-4C61-2457-21B3-EDDA326E8157}" = CCC Help English
"{E64D1146-55AE-61E3-7C43-0DA16C0E4416}" = CCC Help Spanish
"{ED924786-EFE7-392D-F37C-64F4B6E19C2F}" = CCC Help Danish
"{EE174D9D-EF64-9FC7-C900-57C64F02E80D}" = Catalyst Control Center Localization Danish
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{EFF43C31-5F5A-574E-563C-68190FA13F0C}" = CCC Help Chinese Standard
"{F023B88F-DD32-8C85-F372-5319180597A5}" = Catalyst Control Center Localization Thai
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2912763-486E-B5D1-D0C6-BD1AE24D0C20}" = Catalyst Control Center Localization Korean
"{F2D65205-A1D0-5B53-4399-8AA39F738D9D}" = CCC Help Norwegian
"{F4ECB8B5-737F-6910-C26F-7DA94A2C0710}" = Catalyst Control Center Localization Finnish
"{F59778FB-4F31-0ADE-84C3-D7D77676A1A5}" = Catalyst Control Center Localization French
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FAAE0782-8073-112D-BC19-12C64A2D90D9}" = Skins
"{FAC15A44-64C7-1908-CC36-83BC9A308EA9}" = Catalyst Control Center Localization German
"{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now
"AC3Filter" = AC3Filter (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"AviSynth" = AviSynth 2.5
"Cisco AnyConnect Secure Mobility Client" = Cisco AnyConnect Secure Mobility Client
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ESET Online Scanner" = ESET Online Scanner v3
"FE5AE7DC-7B01-4263-A94C-B4526C276550_is1" = iDevice Manager
"htmltads.exe" = HTML TADS Player Kit
"ImageJ_is1" = ImageJ 1.44p
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now
"IrfanView" = IrfanView (remove only)
"jZip" = jZip
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.1.4 (Standard)
"MARK 7.0" = MARK 7.0
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Quantum GIS Lisboa" = Quantum GIS Lisboa 1.8.0 Lisboa
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VLC media player 1.1.4
"Web_4.0.1460.0" = Microsoft Expression Web 4
"WinMend Folder Hidden_is1" = WinMend Folder Hidden 1.4.5.5
"WinRAR archiver" = WinRAR
"WinUHA_is1" = WinUHA 2.0 RC1 (2005.02.27)
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2378140445-2909387748-784235094-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
 
========== Last 20 Event Log Errors ==========
 
[ Cisco AnyConnect Secure Mobility Client Events ]
Error - 22.05.2013 16:45:28 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CMainThread::genericNoticeHandler File: .\MainThread.cpp Line:
 5911 Invoked Function: CMainThread::applyHostConfigForNoVpn Return Code: -33161196
 (0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 22.05.2013 16:45:28 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CMainThread::processNotice File: .\MainThread.cpp Line: 5636
Invoked
 Function: CMainThread::genericNoticeHandler Return Code: -33161196 (0xFE060014) Description:
 ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 22.05.2013 16:45:28 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CMainThread::noticeHandler File: .\MainThread.cpp Line: 5598
Invoked
 Function: CMainThread::processNotice Return Code: -33161196 (0xFE060014) Description:
 ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 22.05.2013 16:45:28 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CMainThread::internalCallbackHandler File: .\MainThread.cpp
Line:
 5352 Invoked Function: CMainThread::noticeHandler Return Code: -33161196 (0xFE060014)
Description:
 ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 22.05.2013 16:45:28 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CMainThread::callbackHandler File: .\MainThread.cpp Line:
5287 Invoked Function: internalCallbackHandler Return Code: -33161196 (0xFE060014)
Description:
 ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE
 
Error - 22.05.2013 17:01:51 | Computer Name = XXX | Source = acvpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 22.05.2013 17:04:20 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2652 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 22.05.2013 17:04:20 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2652 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 22.05.2013 17:04:20 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2652 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED
 
Error - 22.05.2013 17:04:44 | Computer Name = XXX | Source = acvpnagent | ID = 67108866
Description = Function: CThread::invokeRun File: .\Utility\Thread.cpp Line: 376 Invoked
 Function: IRunnable::Run Return Code: -32047093 (0xFE17000B) Description: BROWSERPROXY_ERROR_NO_PROXY_FILE

 
[ OSession Events ]
Error - 05.02.2010 18:48:35 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 282960
 seconds with 29340 seconds of active time.  This session ended with a crash.
 
Error - 07.02.2010 09:58:02 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 140953
 seconds with 4560 seconds of active time.  This session ended with a crash.
 
Error - 30.03.2010 09:11:35 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 259436
 seconds with 4560 seconds of active time.  This session ended with a crash.
 
Error - 30.05.2010 08:50:37 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 89167
 seconds with 1020 seconds of active time.  This session ended with a crash.
 
Error - 19.08.2010 17:40:39 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 18
 seconds with 0 seconds of active time.  This session ended with a crash.
 
Error - 17.06.2011 06:35:58 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 91245
 seconds with 5100 seconds of active time.  This session ended with a crash.
 
Error - 23.11.2011 06:24:21 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 31586
 seconds with 660 seconds of active time.  This session ended with a crash.
 
Error - 16.04.2013 17:06:08 | Computer Name = XXX | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 24
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 22.05.2013 17:04:24 | Computer Name = XXX | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >
--- --- ---

[/code]

Kannst du mir bitte eine kurze Status-Meldung geben? Wurden bisher gefährliche Viren gefunden/beseitigt?

Danke!!!

cosinus 22.05.2013 23:17
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Vollscan mit Malwarebytes Anti-Malware (MBAM) (falls du vor kurzem erst einen Vollscan gemacht hast, reicht auch ein Quickscan (spart Zeit), das dann mir bitte auch mitteilen)

Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Canna 23.05.2013 13:42
Beides ohne Befund, hier noch der Log von ESET:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ff02ac97f516bd4b8bc69a764fbb5ef4
# engine=13741
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-02 03:03:00
# local_time=2013-05-02 05:03:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 7248 232930270 0 0
# compatibility_mode=5892 16776574 100 100 13559927 205039708 0 0
# scanned=26502
# found=0
# cleaned=0
# scan_time=1919
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ff02ac97f516bd4b8bc69a764fbb5ef4
# engine=13743
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-02 09:17:26
# local_time=2013-05-02 11:17:26 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 29714 232952736 21936 0
# compatibility_mode=5892 16776574 100 100 13585993 205062174 0 0
# scanned=234580
# found=8
# cleaned=0
# scan_time=13172
sh=A784B6C70D30DB8D9D81ED66F3790D1EB8FCE9A0 ft=0 fh=0000000000000000 vn="JS/Agent.NID trojan" ac=I fn="C:\ProgramData\44ff.js"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\ProgramData\ff44.dat.nein"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\ProgramData\hh49.dat"
sh=A784B6C70D30DB8D9D81ED66F3790D1EB8FCE9A0 ft=0 fh=0000000000000000 vn="JS/Agent.NID trojan" ac=I fn="C:\Users\All Users\44ff.js"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\Users\All Users\ff44.dat.nein"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\Users\All Users\hh49.dat"
sh=DC48ED21AE7F92EC2B8B6CE871197F79A0D90F92 ft=1 fh=bcfa0dcbb9078c01 vn="a variant of Win32/Kryptik.AZYI trojan" ac=I fn="C:\Users\XXX\AppData\Local\Temp\rACuTi9.exe"
sh=1091A6B1569E13B04181C0233D8FB736A5D6D0AB ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.OAS trojan" ac=I fn="C:\Users\XXX\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\3a980397-27839ba4"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ff02ac97f516bd4b8bc69a764fbb5ef4
# engine=13891
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-23 12:30:52
# local_time=2013-05-23 02:30:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 9442 234692342 0 0
# compatibility_mode=5892 16776574 100 100 15325599 206801780 0 0
# scanned=21351
# found=0
# cleaned=0
# scan_time=1800
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ff02ac97f516bd4b8bc69a764fbb5ef4
# engine=13893
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-23 12:32:02
# local_time=2013-05-23 02:32:02 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 97 52712 234735612 45451 0
# compatibility_mode=5892 16776574 100 100 15365269 206845050 0 0
# scanned=267456
# found=0
# cleaned=0
# scan_time=11864

cosinus 23.05.2013 14:10
Bitte trotzdem immer alle Logs posten. Ein Log enthält mehr Infos als nur die Funde.

Canna 23.05.2013 15:14
In Ordnung. Quick Scan wurde durchgeführt, da Vollscan erst wenige Tage zurück liegt (nach Infektion bestimmt 5 Mal durchgelaufen).

Hier der Log:

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.23.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
XXX :: XXX [Administrator]

23.05.2013 16:05:03
mbam-log-2013-05-23 (16-05-03).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 233833
Laufzeit: 7 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Danke!

cosinus 23.05.2013 15:23
Quickscan mit MBAM? Hattest du vor kurzem einen Vollscan gemacht?

Canna 23.05.2013 15:29
Ja, hab ich doch geschrieben, wie von dir im Beitrag davor vorgeschlagen.

cosinus 23.05.2013 15:49
Siehste :stirn: auch ich bin manchmal blind :lach:

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Canna 24.05.2013 11:25
Na dann danke ich dir auf jeden Fall vielmals.

Von MVPS Hosts File hab ich noch nie gehört. Was Cookies sind weiß ich. Eigentlich könnte ich auf diese gut verzichten. Ich werde die Einstellung in Firefox vornehmen dass Cookies beim Schließen des Browsers gelöscht werden. Damit erübrigt sich das dann oder?

Ansonsten werde ich versuchen AntiVir immer auf dem neusten Stand halte und natürlich weiterhin aufpassen was ich anklicke. GIbt es noch Tips welche Art von "Aufräumprogrammen" oder Analyseprogrammen man ab und zu durchlaufen lassen sollte? Also macht es zum Beispiel Sinn ab und zu mal einen ESET Online-Scan zu machen oder so was?

Danke dir!!

cosinus 24.05.2013 11:28
Naja, durch MVPS Hostsdatei kann sich dein Rechner schonmal mit vielen Werbedomains nicht mehr verbinden weil diese durch die Hostsdatei auf 127.0.0.1 (localhost) geerdet sind. Dadruch bekommst du auch sogut wie keine Werbung mehr zu Gesicht. Und Cookies können diese Werbedomains dann garnicht erst setzen, weil dich dein Rechner mit denen ja keine Verbindung aufbauen kann.


Dann wären wir durch! :daumenhoc


Falls du noch Lob oder Kritik loswerden möchtest => http://www.trojaner-board.de/lob-kritik-wuensche/



Die Programme, die hier zum Einsatz kamen, können alle wieder runter.

Combofix entfernen (nur relevant wenn es hier benutzt wurde!) : Start/Ausführen (Tastenkombination WIN+R), dort den Befehl combofix /uninstall eintippen und ausführen

Mit Hilfe von OTL kannst du auch viele andere Tools entfernen: Starte dazu einfach OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Canna 26.05.2013 21:46
Alles klar, ich danke dir vielmals für deine Hilfe! Damit kann das Thema jetzt geschlossen werden!

Canna


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:18 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132