Trojaner-Board - GVU Trojaner eingefangen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - GVU Trojaner eingefangen (https://www.trojaner-board.de/134470-gvu-trojaner-eingefangen.html)

GVU Trojaner eingefangen

Guten Tag!

Ich habe mir heute den GVU Trojaner auf meinen Windows 7 Laptop eingefangen. Ich hab keine Ahnung von Pcs und deshalb benötige ich Hilfe.Ich hab es schon mit dem abgesicherten Modus probiert, aber auch dort erschien der Sperrbildschirm. ich habe dann den Task manager öffnen wollen aber ich es ging nicht.Ich kam zwar in das Menü wenn man Strg+alt+entf und konnte z.b. mich auch abmelden . Bisher konnte ich den Pc normal starten und noch eine Weile auf ihn zugreifen doch irgendwann kommt dann der GVU Bildschirm. Aber zu meiner Vwewunderung gilt das nur für mein Konto auf einem anderen konto kann ich den Pc ganz normal nutzen. Was kann man da machen um das Problem zu beheben?

:hallo:

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Wähle Scanne Alle Benuzer
Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
Unter Extra Registrierung, wähle bitte Benutze SafeList
Klicke nun auf Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Erstmal danke dass du dich der Sache annimmst.

Code:

OTL Extras logfile created on: 04.05.2013 21:06:09 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\ASUS\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16540)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,66% Memory free

8,00 Gb Paging File | 6,25 Gb Available in Paging File | 78,17% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 74,52 Gb Total Space | 3,04 Gb Free Space | 4,09% Space Free | Partition Type: NTFS

Drive D: | 211,85 Gb Total Space | 173,68 Gb Free Space | 81,98% Space Free | Partition Type: NTFS

 

Computer Name: ASUS-PC | User Name: ASUS | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)

.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)

 

[HKEY_USERS\S-1-5-21-1302862512-3681644172-702645094-1000\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)

https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)

https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"AutoUpdateDisableNotify" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{08BB92A4-1DC0-4E59-95EF-098076511D19}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{0E0FCAD0-7BFA-46E7-978F-3F5CE4574719}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{0F9E1F68-2823-4F0C-BAF3-F9A2F47F90EE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 

"{21AB125D-EE02-4478-ABAA-5D999C2D41E0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{239F8B12-4A28-4135-A1E7-E4D19AD7A8A3}" = rport=445 | protocol=6 | dir=out | app=system | 

"{243059B2-8EFC-4EF0-9157-4509C23398BB}" = lport=445 | protocol=6 | dir=in | app=system | 

"{24335FC2-D4A6-46E1-AE42-D1437F23A408}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{28AF90A7-AE55-4621-85AA-8ED6E54D765A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{32ADC5AB-6AF9-41BE-932A-AEC9FAC7FF39}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{33B169DF-65C4-4FE8-BB4F-03B138DC4037}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 

"{4D791F7C-E68B-4519-A427-B1EA32B17C80}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{4DDBAC04-9A85-475C-8D96-17EB62871E6C}" = lport=139 | protocol=6 | dir=in | app=system | 

"{570689AE-AB6F-4B3A-AF08-08A99E844795}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{5A753F0A-637F-4533-9447-41C3070F08E4}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 

"{60FA41DD-C24A-4FC0-AB96-38BCF32238F6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{6674560A-5736-43CC-82B7-7D7A16187375}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{66FF9740-5FB1-4DF5-8185-301296FEFD06}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{67E3CE44-5186-4AF5-B38A-6A33189028F0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{67FB8DE4-F42A-4465-B581-D450DAAB770A}" = lport=137 | protocol=17 | dir=in | app=system | 

"{684F6AE2-92E3-4D5E-9FBB-9103C0174418}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{684F91BB-EA1D-4941-AFB9-C3FF99091096}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{6E88985A-5D7E-482F-B434-EE01A3CE3AB2}" = rport=10243 | protocol=6 | dir=out | app=system | 

"{801EADF0-D0A1-4637-8AC6-67848412D373}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe | 

"{861E4868-5097-4186-998B-0B3E32129F41}" = rport=139 | protocol=6 | dir=out | app=system | 

"{8740483F-3D17-4E57-9A80-C7F47B98673C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 

"{90A56199-3A94-4C34-BD38-8932F5506B75}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 

"{9AFF3FA6-967E-4279-B47C-C96486DBE34B}" = rport=137 | protocol=17 | dir=out | app=system | 

"{BBECAE2D-7096-47E2-ADB0-C865C70B5152}" = lport=10243 | protocol=6 | dir=in | app=system | 

"{C209B915-4906-4762-9427-CBC649A097C4}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 

"{C49BE81C-F518-4C8F-958A-4527B8784C10}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 

"{C94EBEB3-A287-4D80-9F19-C40F2C970150}" = lport=138 | protocol=17 | dir=in | app=system | 

"{DC03112F-82E7-4E61-A039-98D9181183EB}" = rport=138 | protocol=17 | dir=out | app=system | 

"{EFBB5ABE-7BFC-492A-9B07-5142A536EDA5}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 

"{EFCCEEA1-42FD-4E18-90AB-E11EBF630F94}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{053537A0-7F5C-4DB7-87F5-41F92F8680C2}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe | 

"{0754C37B-8645-43C1-A61E-7108AD93FAD4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{0A86A3DA-C14B-43D0-B337-B6CC59CDEB87}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.6\icq.exe | 

"{0C18BFC4-6BED-4862-B48C-D00227A8F950}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 

"{0C1BD32B-75BE-4B92-8427-AAA0B4C94450}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{0E140DD1-B3E1-49D9-93BF-31CAA57B34CD}" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 

"{0E4B91AF-3144-49F9-87E9-1C2B0D203AA0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{12AC4AF4-FBBD-4FD0-9AD6-6320EF4DDD4D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 

"{12E6B087-9012-40D3-B20B-187FCABB4CD8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{13023EAC-D2F3-4506-8845-FD0034F1682F}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.6\icq.exe | 

"{136C31E6-A922-429C-B17B-74FB288925C5}" = protocol=17 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"{13AEF883-A29D-4C0C-88F4-6BBB970F8EDD}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe | 

"{147F44A1-BCFA-4F76-BABF-D72EA32754D1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{14E950DD-78C8-4AE1-8F08-D83C2D176C43}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe | 

"{1B6F8DC8-9886-4917-B34E-9054814D101B}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 

"{1D314A5A-7D28-48B7-BD01-4B30908BC51F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{24E53BF4-5C1E-4E86-B275-7F789FCC3AFD}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 

"{278F7966-07EA-490F-A80E-B87088E354D3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"{2A30E8FC-50DC-4E20-8794-4F841E187D09}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{360E69FA-9A02-4459-B03F-B1B451981114}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{374A9BB4-009C-4CDA-9880-D61403CE351A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{396DCDD6-71E5-4816-8D6A-87ABCB32222F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe | 

"{39A5D8A5-DED4-4F18-B66F-2B4767F75885}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 

"{490AC532-2FEF-4870-B0EB-A1EF1F7A0A93}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe | 

"{4D08F9FB-ABF7-47EA-8CFC-CA1941915EFC}" = protocol=6 | dir=out | app=system | 

"{4FB16362-08EF-4FD3-A777-C6156E3A16F5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 

"{505525CD-95FD-4E9A-ABF1-FC8834666581}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe | 

"{58659B4B-EFB6-479C-8457-8323F772804F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{5FAEA0B4-D0E1-45F2-8B00-97917ED1273C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe | 

"{65B8CF6E-B3AE-4CEA-BCAC-802CA86F9DA0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{6F1A8FF2-D1E9-431A-987D-E94F4792A143}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe | 

"{6F896B7C-6534-422E-8E22-7DAA3EF90D1B}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.6\icq.exe | 

"{70688880-80D3-4E3F-B686-BE4FB67F3779}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe | 

"{761A2F06-E8D9-46E2-977E-74E2C77FCBA6}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe | 

"{78406C46-6D50-4105-AF6C-1AD9B5E544D7}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.6\icq.exe | 

"{7CBE2E02-8C17-431D-9DA0-ABFC4AADEABD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 

"{7D0FC3D4-CA8A-40D1-80EB-413D40280AF3}" = protocol=6 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"{81E48796-8527-4259-A9E1-DD9931503AA8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe | 

"{891F1143-9111-4393-95E4-6E9071430AEF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{8A6FFF4F-D516-417F-B93D-8F3C8019984E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e\ruse.exe | 

"{91EE49FD-9113-4CF4-AE78-CE2D2D8026A0}" = dir=in | app=c:\program files (x86)\electronic arts\command & conquer 3 kanes rache\retailexe\1.0\cnc3ep1.dat | 

"{9500B6CB-6C58-451B-AF3E-53EC4CA82EC1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 

"{9A200BAD-AB3D-47B2-8225-F678F66B82CA}" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 

"{9A62987B-230E-4F72-98F6-9C484E91F360}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{A049C984-41D3-4FFF-A669-DFEF2E4DB428}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e\ruse.exe | 

"{ACC01E15-4BC7-45F9-BF29-EC12665AADDD}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe | 

"{B11CC8C0-D67C-4E5C-B67D-238515313310}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe | 

"{B364699C-70C3-436E-94FE-DBF7B5D5AE81}" = protocol=17 | dir=in | app=c:\program files (x86)\openvpn\bin\openvpn.exe | 

"{B4ADC5AD-0E63-46BB-8C13-22AA9A88E886}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 

"{B59EACC0-6026-4C64-8620-4EB51F331D1E}" = dir=in | app=c:\program files (x86)\electronic arts\command & conquer 3\retailexe\1.4\cnc3game.dat | 

"{B6A9971D-2984-4DA6-8E53-C8759BB2F0D1}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe | 

"{BB19B3B1-A4EE-4F41-AC69-A873F6E0840A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe | 

"{BEEB66D1-F343-4BCA-A524-DA48EDC73604}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 

"{C0AB3814-7CAC-46AB-8490-EA02B686AB9D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 

"{C8263ECB-685A-4B06-B745-E31A864E61AC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 

"{D1C0C011-F6F0-4805-AFB8-0A47841C99AF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 

"{D5946988-F4CB-40E1-A10D-D7649A283525}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | 

"{DEAD7CA3-74D5-4C2E-957E-517187ED3280}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.6\icq.exe | 

"{E8E358C8-091E-4FF2-B817-0BD7BB2A1835}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{EEC900F1-C985-49B8-998B-6ABC1DD4976D}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 

"{F152117E-CBED-4DD8-B69F-4B58DFE348A1}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 

"{F528E750-6A76-46E8-B19A-B05ED14701E6}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer.exe | 

"{F678B66D-59D1-44C4-B03B-99B3A2DEC802}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 

"{F71273A5-7869-444B-86C4-E0D3CAB9BC33}" = protocol=6 | dir=in | app=c:\program files (x86)\openvpn\bin\openvpn.exe | 

"{FB7C3C80-0063-4C1D-9F5F-4FFCAAAFC035}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 

"{FFBC4AA6-6A25-4D91-8896-BC134B4D6AE4}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.6\icq.exe | 

"{FFF72CAA-A2BA-441B-9AD1-98AE44B53494}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version6\teamviewer_service.exe | 

"TCP Query User{11C0C9A0-407A-4247-BE32-16E361E7FDF3}I:\reliccoh.exe" = protocol=6 | dir=in | app=i:\reliccoh.exe | 

"TCP Query User{13D5E929-C73E-4334-A0B8-B63B6B4B1C84}C:\users\asus\desktop\call of duty - world at war\codwaw.crack.exe" = protocol=6 | dir=in | app=c:\users\asus\desktop\call of duty - world at war\codwaw.crack.exe | 

"TCP Query User{14D21260-545C-40F3-AA84-5A51F719DFF8}G:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat" = protocol=6 | dir=in | app=g:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"TCP Query User{1DE530E2-96D9-4CF2-BBB1-AD30E873A564}I:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat" = protocol=6 | dir=in | app=i:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"TCP Query User{257F16D5-0D1D-48DB-9110-D99F60D14447}J:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat" = protocol=6 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"TCP Query User{2A4ECE84-D578-4C63-BA33-259A0EA2B27C}C:\users\asus\desktop\cod6\iw4mp.dat" = protocol=6 | dir=in | app=c:\users\asus\desktop\cod6\iw4mp.dat | 

"TCP Query User{36953E6C-FAC4-47C2-A30E-787F4C7BA643}F:\call of duty 6\iw4mp.dat" = protocol=6 | dir=in | app=f:\call of duty 6\iw4mp.dat | 

"TCP Query User{39E7D1C0-F6B4-468E-8A80-FC73DE5B7D7F}C:\program files (x86)\electronic arts\command & conquer 3 kanes rache\retailexe\1.1\cnc3ep1.dat" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\command & conquer 3 kanes rache\retailexe\1.1\cnc3ep1.dat | 

"TCP Query User{400C3485-4CDC-44C8-9357-559E16162DD2}C:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe" = protocol=6 | dir=in | app=c:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe | 

"TCP Query User{40CDF507-F00B-467A-8CA6-CD7F1A4B77C8}I:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mpold.exe" = protocol=6 | dir=in | app=i:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mpold.exe | 

"TCP Query User{496079E1-411F-4E89-9A5F-CA79A721A836}C:\windows\syswow64\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\dplaysvr.exe | 

"TCP Query User{4A4FFC60-01F6-4308-BD23-49F3691ABA8D}J:\mw3\iw5mp_server.exe" = protocol=6 | dir=in | app=j:\mw3\iw5mp_server.exe | 

"TCP Query User{575BAB6D-CD98-4BC4-863B-FD4B39140E12}C:\users\asus\desktop\call of duty - world at war\codwawmp.exe" = protocol=6 | dir=in | app=c:\users\asus\desktop\call of duty - world at war\codwawmp.exe | 

"TCP Query User{57903B20-FD48-476B-8247-CE403C024296}C:\users\markus\appdata\local\iw4m\iw4m.dat" = protocol=6 | dir=in | app=c:\users\markus\appdata\local\iw4m\iw4m.dat | 

"TCP Query User{5877AF4B-9E08-4999-BA3A-1FA825ED2201}J:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod2\cod2mp_s.exe" = protocol=6 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod2\cod2mp_s.exe | 

"TCP Query User{59120B38-0DA3-4E2E-9922-B416D46AF2E3}I:\call of duty - modern warfare - eng\iw3mp.exe" = protocol=6 | dir=in | app=i:\call of duty - modern warfare - eng\iw3mp.exe | 

"TCP Query User{5A8CC81B-11AF-4EC0-AD59-DBFDDAFA20F9}C:\users\asus\desktop\sierra\empire earth ii\ee2.exe" = protocol=6 | dir=in | app=c:\users\asus\desktop\sierra\empire earth ii\ee2.exe | 

"TCP Query User{5C8A3B2C-C019-4E12-880E-73CFF12AC1C5}G:\call of duty - modern warfare - eng\iw3mp.exe" = protocol=6 | dir=in | app=g:\call of duty - modern warfare - eng\iw3mp.exe | 

"TCP Query User{6252BA31-A77A-4727-BD18-9104799C8E88}C:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 

"TCP Query User{6A1FCDE4-5F1F-4123-8024-5FC372AA5528}F:\iso\call of duty 5 uncut\call of duty - world at war\codwawmp.exe" = protocol=6 | dir=in | app=f:\iso\call of duty 5 uncut\call of duty - world at war\codwawmp.exe | 

"TCP Query User{71994B20-B16F-4F2B-95F8-69A62F68FA69}C:\users\asus\desktop\cod6\iw4mp.exe" = protocol=6 | dir=in | app=c:\users\asus\desktop\cod6\iw4mp.exe | 

"TCP Query User{7470A052-995B-4D66-AF46-CC1463BFCD2E}C:\program files (x86)\sierra\empire earth ii\ee2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sierra\empire earth ii\ee2.exe | 

"TCP Query User{76FAB23F-D417-46E9-9C80-DCC74EEEE4BE}J:\call of duty - modern warfare - eng\iw3mp.exe" = protocol=6 | dir=in | app=j:\call of duty - modern warfare - eng\iw3mp.exe | 

"TCP Query User{7D186A16-F452-4F94-8BAE-A08983A7B5C2}C:\program files (x86)\openvpn\bin\openvpn.exe" = protocol=6 | dir=in | app=c:\program files (x86)\openvpn\bin\openvpn.exe | 

"TCP Query User{7D54BA13-8C03-4F86-B49D-7D9D2C0AC1E5}F:\cod6\iw4mp.exe" = protocol=6 | dir=in | app=f:\cod6\iw4mp.exe | 

"TCP Query User{8094EB50-75B0-4600-8F09-AE6227FCADC2}C:\users\asus\desktop\call of duty - world at war\codwaw lanfixed.exe" = protocol=6 | dir=in | app=c:\users\asus\desktop\call of duty - world at war\codwaw lanfixed.exe | 

"TCP Query User{83F7024A-8DDA-49D6-BA17-3246213AEA52}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 

"TCP Query User{88961590-0BB2-4FA0-A47E-935ABA6C24DC}C:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwawmp.exe" = protocol=6 | dir=in | app=c:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwawmp.exe | 

"TCP Query User{88AD3A7E-65A7-45AC-9986-23468992802B}F:\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe" = protocol=6 | dir=in | app=f:\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe | 

"TCP Query User{8C382F04-88EA-4C51-B41B-09985684895C}F:\call of duty 5 uncut\call of duty - world at war\codwaw.crack.exe" = protocol=6 | dir=in | app=f:\call of duty 5 uncut\call of duty - world at war\codwaw.crack.exe | 

"TCP Query User{92070C59-F848-4472-9389-15BADE22D7BC}F:\cod6\iw4mp.dat" = protocol=6 | dir=in | app=f:\cod6\iw4mp.dat | 

"TCP Query User{A7CCABCC-F274-4F13-B5AA-3453F984BC96}J:\company of heroes\reliccoh.exe" = protocol=6 | dir=in | app=j:\company of heroes\reliccoh.exe | 

"TCP Query User{AC764506-C3FD-4082-B224-7814B4417FE5}I:\counter strike - source\hl2.exe" = protocol=6 | dir=in | app=i:\counter strike - source\hl2.exe | 

"TCP Query User{B215C9AF-CF00-4EEF-88FD-B3347DE3DCD9}I:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe" = protocol=6 | dir=in | app=i:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe | 

"TCP Query User{B2EF6F44-2558-4326-9D05-65BB80C5E7F5}D:\left4dead\left4dead.exe" = protocol=6 | dir=in | app=d:\left4dead\left4dead.exe | 

"TCP Query User{B507CCB3-0A30-4824-92E1-55B39AB152A5}J:\botf\trek.exe" = protocol=6 | dir=in | app=j:\botf\trek.exe | 

"TCP Query User{BBD413BB-09B9-4BA7-A5EC-196EC40E6D43}C:\program files (x86)\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"TCP Query User{C27D0691-B72E-4EDF-AF8A-B10BD6EDC97B}F:\call of duty 6\iw4mp.exe" = protocol=6 | dir=in | app=f:\call of duty 6\iw4mp.exe | 

"TCP Query User{C3190FDF-E2B0-4744-BD56-513C6C2EC953}I:\cod6\iw4mp.exe" = protocol=6 | dir=in | app=i:\cod6\iw4mp.exe | 

"TCP Query User{C53A570D-F0C2-4C08-8D07-C88467C7C66A}G:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe" = protocol=6 | dir=in | app=g:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe | 

"TCP Query User{D387C9EE-72CD-4AFD-947E-4241FE596BE7}G:\cod6\iw4mp.exe" = protocol=6 | dir=in | app=g:\cod6\iw4mp.exe | 

"TCP Query User{DC552439-2FB2-47EE-A1E6-8259DC1F0467}F:\call of duty 5 uncut\call of duty - world at war\codwawmp.exe" = protocol=6 | dir=in | app=f:\call of duty 5 uncut\call of duty - world at war\codwawmp.exe | 

"TCP Query User{E3409705-7339-483B-BC7C-4B4DBDF3272B}J:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe" = protocol=6 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe | 

"TCP Query User{F68B8C3D-8E57-48D7-9195-FC619D17F6EE}J:\left4dead\left4dead.exe" = protocol=6 | dir=in | app=j:\left4dead\left4dead.exe | 

"TCP Query User{FF022848-4555-4EAD-9B21-ADC334D20C80}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=6 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe | 

"UDP Query User{07A8E8B3-B765-45FD-8B9A-B2B72488F48F}F:\call of duty 6\iw4mp.dat" = protocol=17 | dir=in | app=f:\call of duty 6\iw4mp.dat | 

"UDP Query User{0C0C5A09-76B4-43B1-AD5C-D76A00F319B1}C:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwawmp.exe" = protocol=17 | dir=in | app=c:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwawmp.exe | 

"UDP Query User{0F4B2CC7-D0A6-43D7-81ED-73D0C703C1DC}C:\program files (x86)\openvpn\bin\openvpn.exe" = protocol=17 | dir=in | app=c:\program files (x86)\openvpn\bin\openvpn.exe | 

"UDP Query User{12261D3B-0B4C-4505-848B-92554EBE2B1C}I:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mpold.exe" = protocol=17 | dir=in | app=i:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mpold.exe | 

"UDP Query User{12A8EFD7-4A1C-4105-8E38-9DD9943596FB}F:\cod6\iw4mp.exe" = protocol=17 | dir=in | app=f:\cod6\iw4mp.exe | 

"UDP Query User{16674834-1B96-4698-801F-D7CFBF275F67}C:\users\markus\appdata\local\iw4m\iw4m.dat" = protocol=17 | dir=in | app=c:\users\markus\appdata\local\iw4m\iw4m.dat | 

"UDP Query User{1C8227D4-A11C-4488-9B51-FF7D7DDB6661}G:\call of duty - modern warfare - eng\iw3mp.exe" = protocol=17 | dir=in | app=g:\call of duty - modern warfare - eng\iw3mp.exe | 

"UDP Query User{219BE14F-E150-45C4-B04D-7A9F7763C003}J:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat" = protocol=17 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"UDP Query User{277B20FA-E1B2-44C1-AA33-41D86E2F024E}I:\reliccoh.exe" = protocol=17 | dir=in | app=i:\reliccoh.exe | 

"UDP Query User{27CA78A0-233B-4F5C-AC45-168D833473E6}C:\program files (x86)\electronic arts\command & conquer 3 kanes rache\retailexe\1.1\cnc3ep1.dat" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\command & conquer 3 kanes rache\retailexe\1.1\cnc3ep1.dat | 

"UDP Query User{32F9A06B-6318-4E2A-8FAF-DE5AF123D92F}F:\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe" = protocol=17 | dir=in | app=f:\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe | 

"UDP Query User{415131D3-0EEE-4AD6-AD44-45D689B4CCE9}G:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat" = protocol=17 | dir=in | app=g:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"UDP Query User{47BB7FA9-C69A-4067-8F02-5A72164FDAF9}C:\users\asus\desktop\call of duty - world at war\codwaw lanfixed.exe" = protocol=17 | dir=in | app=c:\users\asus\desktop\call of duty - world at war\codwaw lanfixed.exe | 

"UDP Query User{4B306345-3BAE-41AB-9539-B79FC7BE30EE}F:\call of duty 5 uncut\call of duty - world at war\codwawmp.exe" = protocol=17 | dir=in | app=f:\call of duty 5 uncut\call of duty - world at war\codwawmp.exe | 

"UDP Query User{521B0ACF-2F7A-4A23-AD19-1183A7B6B18D}C:\users\asus\desktop\call of duty - world at war\codwaw.crack.exe" = protocol=17 | dir=in | app=c:\users\asus\desktop\call of duty - world at war\codwaw.crack.exe | 

"UDP Query User{5385843C-1B68-4E50-A236-7503D41C3222}I:\cod6\iw4mp.exe" = protocol=17 | dir=in | app=i:\cod6\iw4mp.exe | 

"UDP Query User{5E6B5B1E-4C83-4C55-B224-DDC4FD220397}J:\mw3\iw5mp_server.exe" = protocol=17 | dir=in | app=j:\mw3\iw5mp_server.exe | 

"UDP Query User{6381D86B-E7F6-4493-BE9B-6C03C513118D}C:\users\asus\desktop\sierra\empire earth ii\ee2.exe" = protocol=17 | dir=in | app=c:\users\asus\desktop\sierra\empire earth ii\ee2.exe | 

"UDP Query User{6D344707-AEF8-435E-B9AE-ABEC2F24794B}C:\users\asus\desktop\cod6\iw4mp.dat" = protocol=17 | dir=in | app=c:\users\asus\desktop\cod6\iw4mp.dat | 

"UDP Query User{6E25E96C-8268-460A-A4D4-2339A99C050A}C:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars battlefront ii\gamedata\battlefrontii.exe | 

"UDP Query User{716EC9CD-19B7-4469-B4ED-AEF65A09EA31}J:\left4dead\left4dead.exe" = protocol=17 | dir=in | app=j:\left4dead\left4dead.exe | 

"UDP Query User{7571B066-40B0-4EF8-A552-99D488EE6F46}I:\counter strike - source\hl2.exe" = protocol=17 | dir=in | app=i:\counter strike - source\hl2.exe | 

"UDP Query User{7608A530-C2BB-45EC-B365-CA3B731B50A8}F:\call of duty 6\iw4mp.exe" = protocol=17 | dir=in | app=f:\call of duty 6\iw4mp.exe | 

"UDP Query User{76195F65-F23F-45FB-8252-6C92E4A1676E}C:\program files (x86)\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 

"UDP Query User{8650749B-5AEC-44AA-90B1-25581B1DEE48}G:\cod6\iw4mp.exe" = protocol=17 | dir=in | app=g:\cod6\iw4mp.exe | 

"UDP Query User{8DE1CBF7-2C75-441E-9A40-B2924A203FD7}C:\program files (x86)\sierra\empire earth ii\ee2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sierra\empire earth ii\ee2.exe | 

"UDP Query User{8F016F90-D922-46CC-A486-527B233D0B90}C:\users\asus\desktop\cod6\iw4mp.exe" = protocol=17 | dir=in | app=c:\users\asus\desktop\cod6\iw4mp.exe | 

"UDP Query User{98147E56-7874-4A30-8468-6BF52AFFECFD}J:\botf\trek.exe" = protocol=17 | dir=in | app=j:\botf\trek.exe | 

"UDP Query User{9943BB61-FEEB-48C5-B533-19E03D1934D0}F:\iso\call of duty 5 uncut\call of duty - world at war\codwawmp.exe" = protocol=17 | dir=in | app=f:\iso\call of duty 5 uncut\call of duty - world at war\codwawmp.exe | 

"UDP Query User{9BFC546E-EC8F-4270-A0A4-E5E59D4924CE}G:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe" = protocol=17 | dir=in | app=g:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe | 

"UDP Query User{AB524E81-7638-4167-93EB-84947D2ACE26}I:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat" = protocol=17 | dir=in | app=i:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.dat | 

"UDP Query User{AB9C0C9C-5B7B-4933-B10E-4F22CE23139A}I:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe" = protocol=17 | dir=in | app=i:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe | 

"UDP Query User{AC03ADE9-14A0-44CE-BAED-00A622ACD5FF}C:\users\asus\desktop\call of duty - world at war\codwawmp.exe" = protocol=17 | dir=in | app=c:\users\asus\desktop\call of duty - world at war\codwawmp.exe | 

"UDP Query User{ACDFED11-96E9-4829-AAF4-45EF5BBB5C17}C:\program files (x86)\anno 1701\anno1701.exe" = protocol=17 | dir=in | app=c:\program files (x86)\anno 1701\anno1701.exe | 

"UDP Query User{B289547B-B4C8-4AF0-91D0-52DB73C62A15}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 

"UDP Query User{B50C1E76-BC08-4AB6-B0CD-B24CABEFC718}J:\call of duty - modern warfare - eng\iw3mp.exe" = protocol=17 | dir=in | app=j:\call of duty - modern warfare - eng\iw3mp.exe | 

"UDP Query User{B8FCE671-14F6-44F8-8682-2E60381FE5CB}J:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod2\cod2mp_s.exe" = protocol=17 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod2\cod2mp_s.exe | 

"UDP Query User{CFD7C5CB-A824-4418-B862-26A75C6226E3}F:\call of duty 5 uncut\call of duty - world at war\codwaw.crack.exe" = protocol=17 | dir=in | app=f:\call of duty 5 uncut\call of duty - world at war\codwaw.crack.exe | 

"UDP Query User{D6FE01A9-B027-4EC5-9BD4-5DD6E628DE94}I:\call of duty - modern warfare - eng\iw3mp.exe" = protocol=17 | dir=in | app=i:\call of duty - modern warfare - eng\iw3mp.exe | 

"UDP Query User{DFBC4086-5451-4D03-A190-3C9CB58E4476}F:\cod6\iw4mp.dat" = protocol=17 | dir=in | app=f:\cod6\iw4mp.dat | 

"UDP Query User{E3177FDF-C351-4C7B-A403-845032847085}C:\windows\syswow64\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\dplaysvr.exe | 

"UDP Query User{E867B66E-4477-4FAC-9AD6-D02F4E70923C}J:\company of heroes\reliccoh.exe" = protocol=17 | dir=in | app=j:\company of heroes\reliccoh.exe | 

"UDP Query User{EFC98B26-A7AA-4A6B-ACDE-63C39FC8C26C}D:\left4dead\left4dead.exe" = protocol=17 | dir=in | app=d:\left4dead\left4dead.exe | 

"UDP Query User{F07D50E1-9C62-425E-849C-9E66DFB9E630}J:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe" = protocol=17 | dir=in | app=j:\eigene bilder\england 2011 lars\england 2011 andere fotos\cod6\iw4mp.exe | 

"UDP Query User{FC3F358E-F431-4A0D-95AF-AABB7EBD2899}C:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe" = protocol=17 | dir=in | app=c:\users\asus\desktop\call of duty 5 uncut\call of duty - world at war\codwaw lanfixed.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{13F4A7F3-EABC-4261-AF6B-1317777F0755}" = Fast Boot

"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes

"{1686C4D1-B1FD-42E8-B7A8-FB4C4DBA5BA8}" = ASUS Power4Gear Hybrid

"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant

"{1C55470A-7C9E-4C63-B466-6AFFC69E94E9}" = Windows Live Family Safety

"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219

"{26A24AE4-039D-4CA4-87B4-2F86417009FF}" = Java 7 Update 9 (64-bit)

"{46A5FBE9-ADB3-4493-A1CC-B4CFFD24D26A}" = Windows Live Family Safety

"{4BC310C4-B898-46E2-B5FB-B85A30AA7142}" = iCloud

"{4BDE1305-35D5-56F3-8B91-5BF29A8DB939}" = ATI Catalyst Install Manager

"{5F0C3F07-B6EF-C641-C4BD-7E202A194121}" = ccc-utility64

"{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}" = MobileMe Control Panel

"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour

"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support

"{81830FEF-866C-4DC0-9435-B6287B1EDD8A}" = HP Photosmart B010 All-In-One Driver Software 14.0 Rel. 7

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting

"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175

"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)

"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053

"{BB71D186-7124-4774-99B0-D4945F9E6D71}" = AStA Copyclient

"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector

"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources

"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources

"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter

"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client

"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service

"{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}" = SRS Premium Sound Control Panel

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer

"5CF0EE27907EC698C86347313F4AF6F6E4040874" = Windows-Treiberpaket - Ricoh Printer  (06/24/2011 1.1.0.0)

"DesktopIconAmazon" = Desktop Icon für Amazon

"Elantech" = ETDWare PS/2-x64 7.0.5.5_WHQL

"HP Imaging Device Functions" = HP Imaging Device Functions 14.0

"HP Smart Web Printing" = HP Smart Web Printing 4.60

"HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0

"HPExtendedCapabilities" = HP Customer Participation Program 14.0

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"SearchAnonymizer" = SearchAnonymizer

"Shop for HP Supplies" = Shop for HP Supplies

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}" = ASUS AI Recovery

"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan

"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = MSN Toolbar

"{0824E481-EB8E-A53B-5CA6-6EC82B29240F}" = CCC Help Russian

"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology

"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer

"{0C1B3A6B-B467-474D-97E4-D8BAC3E839CD}" = YTD Toolbar v7.0

"{0D8E6567-7082-48DB-A305-293873AC8B39}_is1" = Preispilot für Firefox

"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime

"{106B4413-ACBB-4CDE-8707-587DB9BD77EC}" = LogMeIn Hamachi

"{13581A3D-28FF-4DDC-0E6D-E585F4E432AE}" = CCC Help Korean

"{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery

"{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant

"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 3.5

"{1A786741-2D69-38F8-25A0-87D483FF893F}" = CCC Help French

"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3

"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update

"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions

"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform

"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3

"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 37

"{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox

"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update

"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery

"{35BEFF48-53E9-C955-5D24-D9F207C82954}" = CCC Help Portuguese

"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack

"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2

"{43923CFF-E3EF-EC15-8F7A-D50F11AC8E38}" = Catalyst Control Center Core Implementation

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3

"{4F5B18A3-E921-4FFE-BEF4-ACBB98964FC2}" = AMD USB Filter Driver

"{505522F8-9BAF-4CB4-8767-EE074BB0ECE1}" = PS_AIO_07_B010_SW_Min

"{552636E5-1274-9229-10A6-EE56638524D3}" = CCC Help German

"{58E65E96-6649-4CBE-9382-35326D694E6F}" = MSN Toolbar Platform

"{5A186C42-F699-1207-7D8B-034120FBEFD4}" = CCC Help Dutch

"{5B025634-7D5B-4B8D-BE2A-7943C1CF2D5D}" = Status

"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager

"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support

"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon

"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect

"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.0.0

"{724015FC-1175-CE89-667E-5C715EEB5052}" = CCC Help Italian

"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6

"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com

"{78704F80-9845-BA22-DD52-DF1F88D8C8E8}" = CCC Help Czech

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core

"{78CDB125-7541-33BA-11E0-55CF7346FD9D}" = CCC Help Chinese Standard

"{7A4A6C58-C772-DEB7-ADE5-7AA3D8393FDA}" = CCC Help English

"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey

"{7F6ED92F-459D-E40B-BD80-B87B3E852C0A}" = Catalyst Control Center Graphics Previews Vista

"{80E91367-66B4-9D48-D78E-17C3B5AFB83C}" = Catalyst Control Center Graphics Light

"{81601299-AD02-403C-9A47-93C509FE2EC2}" = Catalyst Control Center - Branding

"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform

"{83C99425-1095-A10F-8622-D949180EFA83}" = CCC Help Norwegian

"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert

"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer

"{86209DE5-0642-1ADA-3060-0698374B84A1}" = CCC Help Danish

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver

"{8BF46E02-3A99-4469-AE99-EAAE51FE8F9F}" = B010

"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime

"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT

"{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg

"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash

"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting

"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{9091F4E3-6A00-562A-DDF6-ECB1704F45B2}" = CCC Help Spanish

"{914544F7-4EB6-9F54-6217-D76997EB9E06}" = Catalyst Control Center InstallProxy

"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker

"{95140000-007A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector

"{97635F88-6774-7C96-B872-A4949A4FE06B}" = ccc-core-static

"{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}" = Software Version Updater

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame

"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail

"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A3E59DE5-46A8-68FB-7A2E-4507D2B7C1EC}" = Catalyst Control Center Localization All

"{A436F67F-687E-4736-BD2B-537121A804CF}" = HP Product Detection

"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer

"{A765D3FB-AE33-FAA0-E725-21E6558D8147}" = CCC Help Finnish

"{A8033DE8-2D2C-8730-5D35-8800C92560DE}" = CCC Help Polish

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common

"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer

"{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply

"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI - Deutsch

"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh

"{AEAC0128-8947-0E77-860F-3BD0735F31E5}" = CCC Help Turkish

"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie

"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail

"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call

"{B7B3E9B3-FB14-4927-894B-E9124509AF5A}" = Adobe Flash Player 10 ActiveX

"{B8D52C7C-9460-7F82-C092-C0197B1138A1}" = CCC Help Swedish

"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes

"{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2

"{BC5DD87B-0143-4D14-AAE6-97109614DC6B}" = SolutionCenter

"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations

"{BF192C65-04BE-3F5D-632F-51132799CDE0}" = Catalyst Control Center Graphics Full New

"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common

"{C50ED22A-B0D3-16D8-BE55-947DA0E6F986}" = CCC Help Thai

"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections

"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari

"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget

"{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp

"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform

"{D0809476-5FF0-7724-27CB-BE73D216624A}" = CCC Help Hungarian

"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64

"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media

"{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch

"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service

"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform

"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump

"{DB5C5CB4-3519-1D95-EF98-0356ABFAFAF8}" = CCC Help Japanese

"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3

"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh

"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II

"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10

"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker

"{E52C74AA-4E7E-51ED-B738-0D24922BE597}" = Catalyst Control Center Graphics Full Existing

"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update

"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger

"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}" = ASUS FancyStart

"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5

"{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader

"{F71AA0EC-15E4-6F63-3C9C-7E8D8D756EC5}" = CCC Help Chinese Traditional

"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials

"{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm

"{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager

"{FE163F11-1919-4257-A280-FF5AF8DAEECB}" = ICQ Sparberater

"{FEE0F194-7D6C-A7BF-F12E-96ABE64F5132}" = CCC Help Greek

"Adobe AIR" = Adobe AIR

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver

"Avira AntiVir Desktop" = Avira Free Antivirus

"Birth of the Federation" = Birth of the Federation

"Free Studio_is1" = Free Studio version 5.9.0.1212

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.17.221

"Google Chrome" = Google Chrome

"ICQToolbar" = ICQ Toolbar

"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager

"InstallShield_{F4BF5F6B-F695-4762-AEB2-D095A4C34D89}" = Alcor Micro USB Card Reader

"LogMeIn Hamachi" = LogMeIn Hamachi

"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"OpenVPN" = OpenVPN 2.2.2-gui-1.0.3

"Opera 12.12.1707" = Opera 12.12

"Picasa 3" = Picasa 3

"Star wars Battlefront II Ultimate Pack" = Star wars Battlefront II Ultimate Pack

"Steam App 21970" = R.U.S.E

"Sweet Home 3D_is1" = Sweet Home 3D version 3.7

"TeamViewer 6" = TeamViewer 6

"WinLiveSuite" = Windows Live Essentials

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-1302862512-3681644172-702645094-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"pdfsam" = pdfsam

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 10.05.2012 11:44:00 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 3557

 

Error - 10.05.2012 11:44:01 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 10.05.2012 11:44:01 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 4571

 

Error - 10.05.2012 11:44:01 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 4571

 

Error - 10.05.2012 11:44:02 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 10.05.2012 11:44:02 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 5897

 

Error - 10.05.2012 11:44:02 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 5897

 

Error - 10.05.2012 11:50:09 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 10.05.2012 11:50:09 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 372920

 

Error - 10.05.2012 11:50:09 | Computer Name = ASUS-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 372920

 

[ System Events ]

Error - 04.05.2013 09:55:32 | Computer Name = ASUS-PC | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?04.?05.?2013 um 15:54:33 unerwartet heruntergefahren.

 

Error - 04.05.2013 09:57:03 | Computer Name = ASUS-PC | Source = Service Control Manager | ID = 7043

Description = Der Dienst Gruppenrichtlinienclient konnte nach dem Empfang eines 

Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

 

Error - 04.05.2013 10:01:16 | Computer Name = ASUS-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%577

 

Error - 04.05.2013 10:01:19 | Computer Name = ASUS-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%577

 

Error - 04.05.2013 10:47:16 | Computer Name = ASUS-PC | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am ?04.?05.?2013 um 16:46:19 unerwartet heruntergefahren.

 

Error - 04.05.2013 10:49:36 | Computer Name = ASUS-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%577

 

Error - 04.05.2013 10:49:38 | Computer Name = ASUS-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%577

 

Error - 04.05.2013 14:20:15 | Computer Name = ASUS-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%577

 

Error - 04.05.2013 14:20:17 | Computer Name = ASUS-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:

   %%577

 

Error - 04.05.2013 15:00:05 | Computer Name = ASUS-PC | Source = NetBT | ID = 4321

Description = Der Name "WORKGROUP      :1d" konnte nicht auf der Schnittstelle mit

 IP-Adresse 192.168.178.20  registriert werden. Der Computer mit IP-Adresse 192.168.178.1

 hat nicht  zugelassen, dass dieser Computer diesen Namen verwendet.

 

 

< End of report >

Und hier der zweite:

Code:

OTL logfile created on: 04.05.2013 21:06:09 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\ASUS\Desktop

64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16540)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

4,00 Gb Total Physical Memory | 2,55 Gb Available Physical Memory | 63,66% Memory free

8,00 Gb Paging File | 6,25 Gb Available in Paging File | 78,17% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 74,52 Gb Total Space | 3,04 Gb Free Space | 4,09% Space Free | Partition Type: NTFS

Drive D: | 211,85 Gb Total Space | 173,68 Gb Free Space | 81,98% Space Free | Partition Type: NTFS

 

Computer Name: ASUS-PC | User Name: ASUS | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\ASUS\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

PRC - C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)

PRC - C:\Users\Markus\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe ()

PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

PRC - C:\Program Files (x86)\AStA Paderborn\AStA Copyclient\AStACopyclientFirewallService.exe ()

PRC - C:\Program Files (x86)\AStA Paderborn\AStA Copyclient\asta-copyclient-helper.exe (AStA Paderborn)

PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe ()

PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()

PRC - C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)

PRC - C:\Windows\AsScrPro.exe (ASUS)

PRC - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe (Microsoft Corp.)

PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()

PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

PRC - C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)

PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe (ASUS)

PRC - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)

PRC - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

PRC - C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7366a39c36523a084bc11c230929ff92\Microsoft.VisualBasic.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\dd20416f723ee13ffb4173ec1afc4ec4\System.Data.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()

MOD - C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe ()

MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()

MOD - C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe ()

MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe ()

MOD - C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe ()

MOD - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()

MOD - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)

SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)

SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV:64bit: - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()

SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (Application Updater) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)

SRV - (AddonsHelper) -- C:\Users\Markus\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe ()

SRV - (SearchAnonymizer) -- C:\Users\Markus\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe ()

SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)

SRV - (AstaCopyclientFirewallService) -- C:\Program Files (x86)\AStA Paderborn\AStA Copyclient\AStACopyclientFirewallService.exe ()

SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (OpenVPNService) -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe ()

SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()

SRV - (TeamViewer6) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe (ASUS)

SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)

SRV - (ADSMService) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)

DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)

DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)

DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)

DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)

DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()

DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()

DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )

DRV:64bit: - (AsDsm) -- C:\Windows\SysNative\drivers\AsDsm.sys (ASUSTek Computer Inc)

DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)

DRV:64bit: - (AmUStor) -- C:\Windows\SysNative\drivers\AmUStor.sys (Alcor Micro, Corp.)

DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)

DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.)

DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (lullaby) -- C:\Windows\SysNative\drivers\lullaby.sys (Windows (R) Win 7 DDK provider)

DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronic Corp.)

DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)

DRV:64bit: - (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys ()

DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)

DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)

DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)

DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)

DRV:64bit: - (ASMMAP64) -- C:\Program Files\ATKGFNEX\ASMMAP64.sys ()

DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {721061fb-eb79-4568-a03c-3ce26d68dae9}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{721061fb-eb79-4568-a03c-3ce26d68dae9}: "URL" = hxxp://de.search.yahoo.com/search/?p={searchTerms}&fr=vc_trans_de_8197&type=dsse

 

 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

 

 

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/sm

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 23 86 D2 B8 9A B1 CB 01  [binary data]

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\..\URLSearchHook:  - No CLSID value found

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\7.0\ytdToolbarIE.dll (Spigot, Inc.)

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\..\SearchScopes,DefaultScope = {8DC9946F-5E60-4244-8AED-A86B0A4B2D75}

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\..\SearchScopes\{8DC9946F-5E60-4244-8AED-A86B0A4B2D75}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1302862512-3681644172-702645094-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q="

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12"

FF - prefs.js..browser.search.selectedEngine: "Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://de.search.yahoo.com/web?fr=vc_trans_de_8197&type=dshp"

FF - prefs.js..extensions.enabledAddons: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.8

FF - prefs.js..extensions.enabledAddons: {800b5000-a755-47e1-992b-48a1c1357f07}:1.5.3

FF - prefs.js..extensions.enabledAddons: ytd@mybrowserbar.com:7.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26

FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.9.0.9216

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.3.3

FF - prefs.js..extensions.enabledItems: ciuvo-extension@icq.de:1.2.662

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31

FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:5.1

FF - prefs.js..extensions.enabledItems: youtubedownloader@mybrowserbar.com:5.1

FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.8

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q="

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

 

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Sun Microsystems, Inc.)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=4.0: C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.06.24 19:10:06 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\Firefox [2011.06.24 19:11:29 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2013.01.13 15:59:03 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\dnshelp@dnshelp.com: C:\Users\Markus\AppData\Roaming\Helper [2013.02.10 16:34:43 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.15 19:45:14 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.16 09:18:57 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.06.24 19:10:06 | 000,000,000 | ---D | M]

 

[2011.01.12 17:06:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS\AppData\Roaming\mozilla\Extensions

[2013.05.04 21:08:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ASUS\AppData\Roaming\mozilla\Firefox\Profiles\jwgkru19.default\extensions

[2012.09.07 15:21:02 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\ASUS\AppData\Roaming\mozilla\Firefox\Profiles\jwgkru19.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2012.03.02 12:35:54 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\ASUS\AppData\Roaming\mozilla\Firefox\Profiles\jwgkru19.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2013.05.04 21:08:57 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\ASUS\AppData\Roaming\mozilla\Firefox\Profiles\jwgkru19.default\extensions\ich@maltegoetz.de

[2012.08.31 14:07:36 | 000,101,863 | ---- | M] () (No name found) -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\extensions\ciuvo-extension@icq.de.xpi

[2013.02.10 16:27:53 | 000,002,079 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\30692a55-3774-414d-886f-32b565940c34.xml

[2011.08.13 12:03:00 | 000,001,832 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\bing.xml

[2013.05.04 21:04:57 | 000,000,950 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\icqplugin-1.xml

[2012.03.31 21:10:14 | 000,000,950 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\icqplugin-2.xml

[2012.05.11 10:54:16 | 000,000,950 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\icqplugin-3.xml

[2012.07.21 20:50:33 | 000,000,950 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\icqplugin-4.xml

[2013.03.08 23:24:08 | 000,000,950 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\icqplugin-5.xml

[2011.03.30 15:14:34 | 000,001,042 | ---- | M] () -- C:\Users\ASUS\AppData\Roaming\mozilla\firefox\profiles\jwgkru19.default\searchplugins\icqplugin.xml

[2012.10.19 22:24:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2012.03.09 15:20:42 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2012.07.01 19:52:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

[2012.08.31 19:12:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

[2012.10.19 22:24:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

[2013.03.22 15:32:24 | 000,000,000 | ---D | M] (YTD Toolbar) -- C:\PROGRAM FILES (X86)\YTD TOOLBAR\FF

[2012.07.08 11:11:54 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2013.02.10 16:28:12 | 000,001,684 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2013.02.10 16:28:12 | 000,001,935 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2013.02.10 16:28:12 | 000,001,271 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2013.02.10 16:28:12 | 000,007,051 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2013.02.10 16:28:12 | 000,001,278 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2013.02.10 16:28:12 | 000,001,170 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}

CHR - homepage: hxxp://de.search.yahoo.com/web?fr=vc_trans_de_8197&type=dshp

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\gcswf32.dll

CHR - plugin: Shockwave Flash (Disabled) = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

CHR - plugin: Skype Toolbars (Enabled) = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL

CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: MSN\u00AE Toolbar (Enabled) = C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll

CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll

CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.0_0\

CHR - Extension: YouTube = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\

CHR - Extension: Google-Suche = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\

CHR - Extension: Skype Click to Call = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\

CHR - Extension: ICQ Sparberater = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo\1.4.9_0\

CHR - Extension: Google Mail = C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

 

O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (DNS Error Helper) - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll ()

O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)

O2 - BHO: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\7.0\ytdToolbarIE.dll (Spigot, Inc.)

O2 - BHO: (ICQ Sparberater) - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Program Files (x86)\icq\Internet Explorer\icq.dll (solute gmbh)

O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)

O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\7.0\ytdToolbarIE.dll (Spigot, Inc.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)

O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)

O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Markus\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ASUS)

O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)

O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS)

O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)

O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)

O4 - HKLM..\Run: [MSN Toolbar] C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe (Microsoft Corp.)

O4 - HKLM..\Run: [openvpn-gui] C:\Program Files (x86)\OpenVPN\bin\openvpn-gui.exe ()

O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-1302862512-3681644172-702645094-1000..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

O4 - HKU\S-1-5-21-1302862512-3681644172-702645094-1000..\Run: [ICQ] "C:\Program Files (x86)\ICQ7.5\ICQ.exe" silent loginmode=4 File not found

O4 - HKU\S-1-5-21-1302862512-3681644172-702645094-1000..\Run: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe File not found

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found

O4 - HKU\S-1-5-21-1302862512-3681644172-702645094-1000..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10x_Plugin.exe (Adobe Systems, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found

O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\ASUS\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\ASUS\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found

O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)

O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)

O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9D77AD7A-4C56-4E89-BE5C-D2AB34691384}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FBBEC2B-CD24-4AE3-91DE-051CBA03E579}: DhcpNameServer = 131.234.137.24 131.234.137.23

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found

O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found

O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found

O18:64bit: - Protocol\Handler\wlpg - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18:64bit: - Protocol\Filter\text/xml - No CLSID value found

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{43f35d87-1837-11e1-b1da-e0cb4e2615b0}\Shell - "" = AutoRun

O33 - MountPoints2\{43f35d87-1837-11e1-b1da-e0cb4e2615b0}\Shell\AutoRun\command - "" = Iomega Encryption Utility.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.04 21:04:00 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\ASUS\Desktop\OTL.exe

[2013.05.04 15:31:18 | 000,148,992 | ---- | C] (Корпорация Майкрософт2) -- C:\ProgramData\tot6z4.dat

[2013.05.04 15:31:18 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe

[2013.05.04 11:45:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2013.05.01 17:19:32 | 001,054,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2013.05.01 17:19:31 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2013.05.01 17:19:31 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll

[2013.05.01 17:19:31 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll

[2013.05.01 17:19:31 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2013.05.01 17:19:31 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe

[2013.05.01 17:19:31 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe

[2013.05.01 17:19:31 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2013.05.01 17:19:31 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2013.05.01 17:19:31 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe

[2013.05.01 17:19:31 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll

[2013.05.01 17:19:30 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat

[2013.05.01 17:19:30 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2013.05.01 17:19:30 | 000,629,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2013.05.01 17:19:30 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2013.05.01 17:19:30 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2013.05.01 17:19:30 | 000,232,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2013.05.01 17:19:30 | 000,137,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2013.05.01 17:19:30 | 000,125,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2013.05.01 17:19:30 | 000,117,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2013.05.01 17:19:30 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll

[2013.05.01 17:19:30 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll

[2013.05.01 17:19:30 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe

[2013.05.01 17:19:30 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx

[2013.05.01 17:19:30 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll

[2013.05.01 17:19:30 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe

[2013.05.01 17:19:29 | 001,441,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2013.05.01 17:19:29 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat

[2013.05.01 17:19:29 | 000,905,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2013.05.01 17:19:29 | 000,762,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2013.05.01 17:19:29 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2013.05.01 17:19:29 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2013.05.01 17:19:29 | 000,281,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2013.05.01 17:19:29 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2013.05.01 17:19:29 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll

[2013.05.01 17:19:29 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2013.05.01 17:19:29 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe

[2013.05.01 17:19:29 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll

[2013.05.01 17:19:29 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll

[2013.05.01 17:19:29 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2013.05.01 17:19:29 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2013.05.01 17:19:29 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2013.05.01 17:19:29 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2013.05.01 17:19:29 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2013.05.01 17:19:29 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll

[2013.05.01 17:19:28 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2013.05.01 17:19:28 | 001,509,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2013.05.01 17:19:28 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2013.05.01 17:19:28 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2013.05.01 17:19:28 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2013.05.01 17:19:28 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2013.05.01 17:19:28 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe

[2013.05.01 17:19:28 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2013.05.01 17:19:28 | 000,144,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe

[2013.05.01 17:19:28 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2013.05.01 17:19:28 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll

[2013.05.01 17:19:28 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2013.05.01 17:19:28 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2013.05.01 17:19:28 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe

[2013.05.01 17:19:28 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll

[2013.05.01 17:19:28 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll

[2013.05.01 17:19:28 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll

[2013.05.01 17:19:28 | 000,027,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2013.05.01 17:19:28 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe

[2013.05.01 17:19:28 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe

[2013.05.01 17:19:27 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2013.05.01 17:19:27 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll

[2013.05.01 17:19:27 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx

[2013.05.01 17:16:25 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.05.01 17:16:25 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.05.01 17:16:25 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.05.01 17:16:25 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.05.01 17:16:25 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

[2013.05.01 17:16:25 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll

[2013.05.01 17:16:25 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.05.01 17:16:24 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll

[2013.05.01 17:16:24 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll

[2013.05.01 17:16:24 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll

[2013.05.01 17:16:24 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll

[2013.05.01 17:16:24 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll

[2013.05.01 17:16:24 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll

[2013.05.01 17:16:24 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2013.05.01 17:16:24 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll

[2013.05.01 17:16:24 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll

[2013.05.01 17:16:24 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll

[2013.05.01 17:16:24 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll

[2013.05.01 17:16:24 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll

[2013.05.01 17:16:24 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll

[2013.05.01 17:16:24 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll

[2013.05.01 17:16:24 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll

[2013.05.01 17:16:24 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll

[2013.05.01 17:16:24 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.05.01 17:16:24 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.05.01 17:16:24 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.05.01 17:16:24 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.05.01 17:16:24 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.05.01 17:16:24 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.05.01 17:16:23 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll

[2013.05.01 17:16:23 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll

[2013.05.01 17:16:23 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll

[2013.05.01 17:16:23 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll

[2013.05.01 17:16:23 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll

[2013.05.01 17:16:23 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll

[2013.05.01 17:16:23 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll

[2013.04.12 14:41:49 | 003,717,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll

[2013.04.12 14:41:49 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll

[2013.04.12 14:41:47 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll

[2013.04.12 14:41:47 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll

[2013.04.12 14:41:47 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll

[2013.04.12 14:41:47 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll

[2013.04.12 14:40:26 | 005,550,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2013.04.12 14:40:24 | 003,913,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2013.04.12 14:40:23 | 003,968,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2013.04.12 14:40:22 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe

[2013.04.12 14:40:22 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll

[2013.04.12 14:40:21 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll

[2008.08.12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll

[1 C:\Users\ASUS\AppData\Local\*.tmp files -> C:\Users\ASUS\AppData\Local\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.04 21:04:08 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\ASUS\Desktop\OTL.exe

[2013.05.04 21:01:29 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.05.04 21:01:08 | 000,000,360 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job

[2013.05.04 20:59:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.04 20:42:10 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.05.04 20:35:56 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.04 20:35:56 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.04 20:17:50 | 3220,529,152 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.04 16:52:54 | 095,023,320 | ---- | M] () -- C:\ProgramData\4z6tot.pad

[2013.05.04 15:31:31 | 000,002,633 | ---- | M] () -- C:\ProgramData\4z6tot.js

[2013.05.04 15:31:31 | 000,000,152 | ---- | M] () -- C:\ProgramData\4z6tot.reg

[2013.05.04 15:31:31 | 000,000,056 | ---- | M] () -- C:\ProgramData\4z6tot.bat

[2013.05.04 15:31:18 | 000,148,992 | ---- | M] (Корпорация Майкрософт2) -- C:\ProgramData\tot6z4.dat

[2013.05.04 15:31:18 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe

[2013.05.01 17:19:32 | 001,054,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe

[2013.05.01 17:19:31 | 000,719,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll

[2013.05.01 17:19:31 | 000,226,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll

[2013.05.01 17:19:31 | 000,185,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll

[2013.05.01 17:19:31 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll

[2013.05.01 17:19:31 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe

[2013.05.01 17:19:31 | 000,138,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe

[2013.05.01 17:19:31 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll

[2013.05.01 17:19:31 | 000,079,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2013.05.01 17:19:31 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe

[2013.05.01 17:19:31 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll

[2013.05.01 17:19:30 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat

[2013.05.01 17:19:30 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2013.05.01 17:19:30 | 000,629,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll

[2013.05.01 17:19:30 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2013.05.01 17:19:30 | 000,361,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2013.05.01 17:19:30 | 000,232,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll

[2013.05.01 17:19:30 | 000,137,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe

[2013.05.01 17:19:30 | 000,125,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll

[2013.05.01 17:19:30 | 000,117,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2013.05.01 17:19:30 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll

[2013.05.01 17:19:30 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll

[2013.05.01 17:19:30 | 000,073,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe

[2013.05.01 17:19:30 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx

[2013.05.01 17:19:30 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll

[2013.05.01 17:19:30 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe

[2013.05.01 17:19:29 | 001,441,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl

[2013.05.01 17:19:29 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat

[2013.05.01 17:19:29 | 000,905,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll

[2013.05.01 17:19:29 | 000,762,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll

[2013.05.01 17:19:29 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll

[2013.05.01 17:19:29 | 000,441,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2013.05.01 17:19:29 | 000,281,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll

[2013.05.01 17:19:29 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll

[2013.05.01 17:19:29 | 000,216,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll

[2013.05.01 17:19:29 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll

[2013.05.01 17:19:29 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe

[2013.05.01 17:19:29 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll

[2013.05.01 17:19:29 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll

[2013.05.01 17:19:29 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll

[2013.05.01 17:19:29 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll

[2013.05.01 17:19:29 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe

[2013.05.01 17:19:29 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll

[2013.05.01 17:19:29 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll

[2013.05.01 17:19:29 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf

[2013.05.01 17:19:29 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf

[2013.05.01 17:19:29 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll

[2013.05.01 17:19:28 | 003,958,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll

[2013.05.01 17:19:28 | 001,509,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl

[2013.05.01 17:19:28 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2013.05.01 17:19:28 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2013.05.01 17:19:28 | 000,599,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2013.05.01 17:19:28 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe

[2013.05.01 17:19:28 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe

[2013.05.01 17:19:28 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll

[2013.05.01 17:19:28 | 000,144,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe

[2013.05.01 17:19:28 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2013.05.01 17:19:28 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll

[2013.05.01 17:19:28 | 000,102,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll

[2013.05.01 17:19:28 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2013.05.01 17:19:28 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe

[2013.05.01 17:19:28 | 000,062,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll

[2013.05.01 17:19:28 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll

[2013.05.01 17:19:28 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll

[2013.05.01 17:19:28 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2013.05.01 17:19:28 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe

[2013.05.01 17:19:28 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe

[2013.05.01 17:19:27 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2013.05.01 17:19:27 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll

[2013.05.01 17:19:27 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx

[2013.05.01 17:16:25 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.05.01 17:16:25 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.05.01 17:16:25 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.05.01 17:16:25 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.05.01 17:16:25 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

[2013.05.01 17:16:25 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll

[2013.05.01 17:16:25 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.05.01 17:16:24 | 003,928,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll

[2013.05.01 17:16:24 | 002,776,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll

[2013.05.01 17:16:24 | 002,565,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll

[2013.05.01 17:16:24 | 002,284,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll

[2013.05.01 17:16:24 | 001,887,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll

[2013.05.01 17:16:24 | 001,682,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll

[2013.05.01 17:16:24 | 001,643,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll

[2013.05.01 17:16:24 | 001,504,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll

[2013.05.01 17:16:24 | 001,238,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll

[2013.05.01 17:16:24 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll

[2013.05.01 17:16:24 | 000,522,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll

[2013.05.01 17:16:24 | 000,465,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll

[2013.05.01 17:16:24 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll

[2013.05.01 17:16:24 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll

[2013.05.01 17:16:24 | 000,363,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll

[2013.05.01 17:16:24 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll

[2013.05.01 17:16:24 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll

[2013.05.01 17:16:24 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.05.01 17:16:24 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.05.01 17:16:24 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.05.01 17:16:24 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.05.01 17:16:24 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.05.01 17:16:24 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.05.01 17:16:24 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.05.01 17:16:23 | 001,424,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll

[2013.05.01 17:16:23 | 000,648,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll

[2013.05.01 17:16:23 | 000,333,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll

[2013.05.01 17:16:23 | 000,221,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll

[2013.05.01 17:16:23 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll

[2013.05.01 17:16:23 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll

[2013.04.14 10:36:00 | 000,366,056 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[2013.04.12 14:45:16 | 000,002,185 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2013.04.08 15:00:18 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.04.08 15:00:18 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.04.08 15:00:18 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.04.08 15:00:18 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.04.08 15:00:18 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[1 C:\Users\ASUS\AppData\Local\*.tmp files -> C:\Users\ASUS\AppData\Local\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2013.05.04 15:31:31 | 000,002,633 | ---- | C] () -- C:\ProgramData\4z6tot.js

[2013.05.04 15:31:31 | 000,000,152 | ---- | C] () -- C:\ProgramData\4z6tot.reg

[2013.05.04 15:31:31 | 000,000,056 | ---- | C] () -- C:\ProgramData\4z6tot.bat

[2013.05.04 15:31:19 | 095,023,320 | ---- | C] () -- C:\ProgramData\4z6tot.pad

[2013.05.01 17:19:29 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf

[2013.05.01 17:19:29 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf

[2013.02.10 16:27:32 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll

[2012.04.09 13:18:35 | 000,098,344 | ---- | C] () -- C:\Windows\unTMV.exe

[2011.10.22 01:06:36 | 000,270,776 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe

[2011.10.22 01:04:29 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe

[2011.08.17 00:19:13 | 000,004,096 | -H-- | C] () -- C:\Users\ASUS\AppData\Local\keyfile3.drm

[2011.06.24 18:52:57 | 000,192,732 | ---- | C] () -- C:\Windows\hpoins51.dat

[2011.03.05 23:56:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2009.04.08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll

[2008.05.22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 

< End of report >

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

Code:

:OTL
 

SRV - (AddonsHelper) -- C:\Users\Markus\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe () 

SRV - (Application Updater) -- C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe (Spigot, Inc.) 

SRV - (SearchAnonymizer) -- C:\Users\Markus\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe () 

O3 - HKLM\..\Toolbar: (YTD Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files (x86)\YTD Toolbar\IE\7.0\ytdToolbarIE.dll (Spigot, Inc.) 

O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) 

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0 

[2013.05.04 15:31:18 | 000,148,992 | ---- | C] (Êîðïîðàöèÿ Ìàéêðîñîôò2) -- C:\ProgramData\tot6z4.dat 

[2013.05.04 15:31:18 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\rundll32.exe 

[2013.05.04 16:52:54 | 095,023,320 | ---- | M] () -- C:\ProgramData\4z6tot.pad 

[2013.05.04 15:31:31 | 000,002,633 | ---- | M] () -- C:\ProgramData\4z6tot.js 

[2013.05.04 15:31:31 | 000,000,152 | ---- | M] () -- C:\ProgramData\4z6tot.reg 

[2013.05.04 15:31:31 | 000,000,056 | ---- | M] () -- C:\ProgramData\4z6tot.bat 

[2013.05.04 21:01:08 | 000,000,360 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job 
 

:Files 

C:\ProgramData\*.exe

C:\ProgramData\*.dll

C:\ProgramData\*.tmp

C:\ProgramData\TEMP

C:\Users\ASUS\*.tmp

C:\Users\ASUS\AppData\*.dll

C:\Users\ASUS\AppData\*.exe

C:\Users\ASUS\AppData\Local\Temp\*.exe

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache

ipconfig /flushdns /c

:Commands

[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

2. Schritt
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

danach:

3. Schritt
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Code:

All processes killed

========== OTL ==========

Service AddonsHelper stopped successfully!

Service AddonsHelper deleted successfully!

C:\Users\Markus\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe moved successfully.

Service Application Updater stopped successfully!

Service Application Updater deleted successfully!

C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe moved successfully.

Service SearchAnonymizer stopped successfully!

Service SearchAnonymizer deleted successfully!

C:\Users\Markus\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{F3FEE66E-E034-436a-86E4-9690573BEE8A} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3FEE66E-E034-436a-86E4-9690573BEE8A}\ deleted successfully.

C:\Program Files (x86)\YTD Toolbar\IE\7.0\ytdToolbarIE.dll moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SearchSettings deleted successfully.

C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.

C:\ProgramData\tot6z4.dat moved successfully.

C:\ProgramData\rundll32.exe moved successfully.

C:\ProgramData\4z6tot.pad moved successfully.

File C:\ProgramData\4z6tot.js not found.

C:\ProgramData\4z6tot.reg moved successfully.

C:\ProgramData\4z6tot.bat moved successfully.

C:\Windows\Tasks\AmiUpdXp.job moved successfully.

========== FILES ==========

File\Folder C:\ProgramData\*.exe not found.

File\Folder C:\ProgramData\*.dll not found.

File\Folder C:\ProgramData\*.tmp not found.

C:\ProgramData\TEMP folder moved successfully.

File\Folder C:\Users\ASUS\*.tmp not found.

File\Folder C:\Users\ASUS\AppData\*.dll not found.

File\Folder C:\Users\ASUS\AppData\*.exe not found.

C:\Users\ASUS\AppData\Local\Temp\AMPing.exe moved successfully.

C:\Users\ASUS\AppData\Local\Temp\InstallManager_BAB_BAB.exe moved successfully.

C:\Users\ASUS\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe moved successfully.

C:\Users\ASUS\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe moved successfully.

C:\Users\ASUS\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe moved successfully.

C:\Users\ASUS\AppData\Local\Temp\SkypeSetup.exe moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.

C:\Users\ASUS\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
 < ipconfig /flushdns /c >

Windows-IP-Konfiguration

Der DNS-Aufl”sungscache wurde geleert.

C:\Users\ASUS\Desktop\cmd.bat deleted successfully.

C:\Users\ASUS\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: ASUS

->Temp folder emptied: 40149308 bytes

->Temporary Internet Files folder emptied: 139730039 bytes

->FireFox cache emptied: 326023467 bytes

->Google Chrome cache emptied: 322872746 bytes

->Apple Safari cache emptied: 16384 bytes

->Flash cache emptied: 84452 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 75 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Iris

->Temp folder emptied: 405409048 bytes

->Temporary Internet Files folder emptied: 130517608 bytes

->Java cache emptied: 21226279 bytes

->FireFox cache emptied: 303667165 bytes

->Google Chrome cache emptied: 78923223 bytes

->Apple Safari cache emptied: 16384 bytes

->Flash cache emptied: 21939 bytes

 

User: Markus

->Temp folder emptied: 1353204921 bytes

->Temporary Internet Files folder emptied: 485789126 bytes

->Java cache emptied: 13184809 bytes

->FireFox cache emptied: 430309155 bytes

->Google Chrome cache emptied: 228491321 bytes

->Opera cache emptied: 13188944 bytes

->Flash cache emptied: 69968 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 454354285 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42321897 bytes

RecycleBin emptied: 27572827 bytes

 

Total Files Cleaned = 4.594,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 05052013_101431
 

Files\Folders moved on Reboot...

C:\Users\ASUS\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Users\ASUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

C:\Users\ASUS\AppData\Local\Mozilla\Firefox\Profiles\jwgkru19.default\Cache\_CACHE_001_ moved successfully.

C:\Users\ASUS\AppData\Local\Mozilla\Firefox\Profiles\jwgkru19.default\Cache\_CACHE_002_ moved successfully.

C:\Users\ASUS\AppData\Local\Mozilla\Firefox\Profiles\jwgkru19.default\Cache\_CACHE_003_ moved successfully.

C:\Users\ASUS\AppData\Local\Mozilla\Firefox\Profiles\jwgkru19.default\Cache\_CACHE_MAP_ moved successfully.

C:\Users\ASUS\AppData\Local\Mozilla\Firefox\Profiles\jwgkru19.default\urlclassifier3.sqlite moved successfully.
 

PendingFileRenameOperations files...
 

Registry entries deleted on Reboot...

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.05.05.03
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16540

ASUS :: ASUS-PC [Administrator]
 

Schutz: Aktiviert
 

05.05.2013 11:03:23

mbam-log-2013-05-05 (11-03-23).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|K:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 421059

Laufzeit: 1 Stunde(n), 56 Minute(n), 40 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 7

HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Updater.AmiUpd.1 (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKCR\Updater.AmiUpd (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 5

C:\Users\Markus\AppData\Local\SwvUpdater\Updater.exe (PUP.Software.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\ASUS\Downloads\flashplayer_update_11_de.exe (PUP.LoadTubes) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\_OTL\MovedFiles\05052013_101431\C_ProgramData\tot6z4.dat (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.

D:\Call of Duty 5 Uncut\Call of Duty - World at War\Hack\1\Call of Duty - World at War V 1.6 RANK HAX.exe (HackTool.GamesCheat.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

D:\CoD6\TeknoGods_MW2SP.exe (Backdoor.Agent.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
 

(Ende)

So nach dem Neustart ist hier der 3. Schritt.

Code:

# AdwCleaner v2.300 - Datei am 05/05/2013 um 13:16:40 erstellt

# Aktualisiert am 28/04/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : ASUS - ASUS-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\ASUS\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi

Datei Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\searchplugins\icqplugin.xml

Datei Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\searchplugins\icqplugin-1.xml

Datei Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\searchplugins\icqplugin-2.xml

Datei Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\searchplugins\icqplugin-3.xml

Datei Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\searchplugins\SweetIM Search.xml

Datei Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\searchplugins\SweetIm.xml

Datei Gelöscht : C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\qlkytyn4.default\foxydeal.sqlite

Ordner Gelöscht : C:\Program Files (x86)\Application Updater

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\Program Files (x86)\Common Files\spigot

Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar

Ordner Gelöscht : C:\Program Files (x86)\SweetIM

Ordner Gelöscht : C:\Program Files (x86)\sweetpacks bundle uninstaller

Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar

Ordner Gelöscht : C:\ProgramData\SweetIM

Ordner Gelöscht : C:\ProgramData\Tarma Installer

Ordner Gelöscht : C:\Users\ASUS\AppData\LocalLow\Search Settings

Ordner Gelöscht : C:\Users\ASUS\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

Ordner Gelöscht : C:\Users\Iris\AppData\LocalLow\Search Settings

Ordner Gelöscht : C:\Users\Markus\AppData\Local\SwvUpdater

Ordner Gelöscht : C:\Users\Markus\AppData\LocalLow\Search Settings

Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\DesktopIconForAmazon

Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\HELPER

Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\qlkytyn4.default\extensions\firejump@firejump.net

Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\OCS

Ordner Gelöscht : C:\Users\Markus\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Windows\Installer\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}

Ordner Gelöscht : C:\Windows\SysWOW64\WNLT
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Search Settings

Schlüssel Gelöscht : HKCU\Software\IM

Schlüssel Gelöscht : HKCU\Software\ImInstaller

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\Search Settings

Schlüssel Gelöscht : HKCU\Software\WNLT

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

Schlüssel Gelöscht : HKLM\Software\Application Updater

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\B2FD9C0A5B9838449838816A28001F4B

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4B

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sim-packages

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe

Schlüssel Gelöscht : HKLM\Software\Search Settings

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F3FEE66E-E034-436A-86E4-9690573BEE8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SweetIM Bundle by SweetPacks

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WNLT

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer

Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{F3FEE66E-E034-436A-86E4-9690573BEE8A}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SweetIM]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{acaa314b-eeba-48e4-ad47-84e31c44796c}]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [dnshelp@dnshelp.com]

Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16537
 

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://start.icq.com/sm --> hxxp://www.google.com

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm --> hxxp://www.google.com
 

-\\ Mozilla Firefox v13.0.1 (de)
 

Datei : C:\Users\ASUS\AppData\Roaming\Mozilla\Firefox\Profiles\jwgkru19.default\prefs.js
 

Gelöscht : user_pref("browser.search.defaultenginename", "SweetIM Search");

Gelöscht : user_pref("browser.startup.homepage", "hxxp://home.sweetim.com/?barid={7824E0FD-B560-11E2-BC5D-E0CB4[...]

Gelöscht : user_pref("icqtoolbar.allowSendURL", false);

Gelöscht : user_pref("icqtoolbar.defSearchChange", true);

Gelöscht : user_pref("icqtoolbar.engineVerified", false);

Gelöscht : user_pref("icqtoolbar.facebookSmilesAddonShowedPopup", true);

Gelöscht : user_pref("icqtoolbar.firstTbRun", false);

Gelöscht : user_pref("icqtoolbar.geolastmodified", 1367694170);

Gelöscht : user_pref("icqtoolbar.history", "trojaner%20brd.de||heizung||enzym||reifung%20der%20mrna%20bei%20euk[...]

Gelöscht : user_pref("icqtoolbar.hpChange", true);

Gelöscht : user_pref("icqtoolbar.icqgeo", 49);

Gelöscht : user_pref("icqtoolbar.installTime", "1347024067");

Gelöscht : user_pref("icqtoolbar.installsource", "1");

Gelöscht : user_pref("icqtoolbar.newtab_most_visited_state", "1");

Gelöscht : user_pref("icqtoolbar.newtab_recently_closed_state", "1");

Gelöscht : user_pref("icqtoolbar.newtab_state", "1");

Gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);

Gelöscht : user_pref("icqtoolbar.previousFFVersion", "13.0.1");

Gelöscht : user_pref("icqtoolbar.skip_default_search", "no");

Gelöscht : user_pref("icqtoolbar.suggestions", false);

Gelöscht : user_pref("icqtoolbar.uniqueID", "131306918913130695051313164502363");

Gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1367694176);

Gelöscht : user_pref("icqtoolbar.userEngineApproved", true);

Gelöscht : user_pref("icqtoolbar.userHpApproved", true);

Gelöscht : user_pref("icqtoolbar.version", "1.5.3");

Gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);

Gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);

Gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);

Gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);

Gelöscht : user_pref("icqtoolbar.xmlEnableHomePageDsGuard", false);

Gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);

Gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "Search");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "hxxp://www.bing.com/search?FORM=WLE[...]

Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "ICQ Search");

Gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://de.search.yahoo.com/web?fr=vc[...]

Gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_i[...]

Gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com/?crg=3.1010000.10039&barid={7824[...]
 

Datei : C:\Users\Iris\AppData\Roaming\Mozilla\Firefox\Profiles\bqku02lc.default\prefs.js
 

[OK] Die Datei ist sauber.
 

Datei : C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\qlkytyn4.default\prefs.js
 

[OK] Die Datei ist sauber.
 

-\\ Google Chrome v26.0.1410.64
 

Datei : C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

Datei : C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

Datei : C:\Users\Markus\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [11265 octets] - [05/05/2013 13:16:40]
 

########## EOF - C:\AdwCleaner[S1].txt - [11326 octets] ##########

Sehr gut! :daumenhoc

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

danach:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

danach:

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

So Schritt 1 ist erstmal fertig. Schritt 2 musste ich leider abbrechen ,da ich jetzt los muss. Ich mache heute Abend weiter. Danke;)

Code:

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software

Run date: 2013-05-05 14:02:35

-----------------------------

14:02:35.868    OS Version: Windows x64 6.1.7601 Service Pack 1

14:02:35.868    Number of processors: 2 586 0x602

14:02:35.870    ComputerName: ASUS-PC  UserName: ASUS

14:02:36.717    Initialize success

14:06:48.050    AVAST engine defs: 13050500

14:06:55.476    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005f

14:06:55.482    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 11

14:06:55.499    Disk 0 MBR read successfully

14:06:55.505    Disk 0 MBR scan

14:06:55.517    Disk 0 Windows 7 default MBR code

14:06:55.524    Disk 0 Partition 1 00     1C Hidd FAT32 LBA MSDOS5.0    12000 MB offset 64

14:06:55.554    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        76311 MB offset 24576064

14:06:55.569    Disk 0 Partition - 00     0F Extended LBA            216932 MB offset 180862976

14:06:55.599    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       216931 MB offset 180865024

14:06:55.664    Disk 0 scanning C:\Windows\system32\drivers

14:07:20.487    Service scanning

14:08:05.923    Modules scanning

14:08:05.943    Disk 0 trace - called modules:

14:08:06.355    ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xfffffa80046dd2c0]<<spfb.sys amdxata.sys storport.sys hal.dll amdsata.sys 

14:08:06.367    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800498e180]

14:08:06.379    3 CLASSPNP.SYS[fffff88001ad443f] -> nt!IofCallDriver -> [0xfffffa8004913b60]

14:08:06.392    \Driver\amdxata[0xfffffa8004787060] -> IRP_MJ_CREATE -> 0xfffffa80046dd2c0

14:08:06.406    5 amdxata.sys[fffff88000e90917] -> nt!IofCallDriver -> \Device\0000005f[0xfffffa800490e060]

14:08:06.419    \Driver\amdsata[0xfffffa8004786d10] -> IRP_MJ_CREATE -> 0xfffffa80046db2c0

14:08:08.148    AVAST engine scan C:\Windows

14:08:13.576    AVAST engine scan C:\Windows\system32

14:16:51.365    AVAST engine scan C:\Windows\system32\drivers

14:17:16.908    AVAST engine scan C:\Users\ASUS

14:23:06.981    AVAST engine scan C:\ProgramData

14:25:23.765    Scan finished successfully

14:26:39.890    Disk 0 MBR has been saved successfully to "C:\Users\ASUS\Desktop\MBR.dat"

14:26:39.905    The log file has been saved successfully to "C:\Users\ASUS\Desktop\aswMBR.txt"

Zitat:

Ich mache heute Abend weiter. Danke;)

Alles klar.

Hallo ich wollte mal fragen,was diese Scans machen?;)

Sie scannen nach schaedlichen Dateien.

Okay danke für die Antwort.

Ich hab nochmal ein paar generelle Fragen:

Kann ich den 2. Account jetzt problemlos bzw. ohne Sorge benutzen? Oder sollte ich noch aufpassen ihn zu benutzen?
Außerdem wie sieht es mit Passwörtern aus? Eingegebende Passwörter werden ausspioniert oder? Oder sollte man aus reiner Vorsicht alle Passwörter umbennen?
Und,wenn der Trojaner entfernt wurde ist dan der Pc relativ sicher? Oder kriegt man den nie ganz weg?;)

Okay ich hab mal ausprobiert,ob ich das gesperrte Konto nutzen kann und es geht.es sit wieder nutzbar.Heißt das jetzt ,dass der Trojaner enternt werden konnte oder läuft er i Hintergrund weiter?

So ich hoffe das ist so richtig,denn ein anderer hat das Programm beendet und nicht ich und ich habe noch nicht mit demjenigen gesprochen.

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=1e6bdf5c55322341a4cb64addae2e9aa

# engine=13757

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-05-05 01:11:51

# local_time=2013-05-05 03:11:51 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=1799 16775165 100 96 18717 233179201 11468 0

# compatibility_mode=5893 16776573 100 94 7244 119389361 0 0

# scanned=6610

# found=0

# cleaned=0

# scan_time=2360

Achso. Den werde ich machen. Hab mir nur Sorgen gemach t,weil ich keien Antwort bekommen hab.

Code:

 Results of screen317's Security Check version 0.99.63  

 Windows 7 Service Pack 1 x64   

 Internet Explorer 9  
 ``````````````Antivirus/Firewall Check:`````````````` 

Avira Desktop   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java(TM) 6 Update 37  

 Java version out of Date! 

 Adobe Flash Player 10 Flash Player out of Date! 

 Adobe Reader XI  

 Mozilla Firefox (For.) 

 Google Chrome 26.0.1410.43  

 Google Chrome 26.0.1410.64  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Avira Antivir avgnt.exe 

 Avira Antivir avguard.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   

 AStA Paderborn AStA Copyclient AStACopyclientFirewallService.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die .exe-Datei
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 21 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck

So das ist das erste Log File .WIrd das zweite auch gebraucht?ALso von dem zweiten Scan.

Code:

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

www.malwarebytes.org
 

Database version: v2013.05.17.06
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16540

Markus :: ASUS-PC [administrator]
 

17.05.2013 21:22:13

mbar-log-2013-05-17 (21-22-13).txt
 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

Scan options disabled: 

Objects scanned: 29535

Time elapsed: 20 minute(s), 58 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 1

HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|ctfmon.exe (Trojan.Agent) -> Data: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\tot6z4.dat,FG00 -> Delete on reboot.
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 1

c:\Users\Markus\8604010.dll (Trojan.FakeMS) -> Delete on reboot.
 

(end)

Code:

PluginCheck
 

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.

Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
 

    Firefox 13.0.1 ist veraltet!
 

    Flash 10,3,183,10 ist veraltet!

    Aktualisieren Sie bitte auf die neueste Version!
 

    Java (1,7,0,21) ist aktuell.
 

    Adobe Reader 11,0,0,379 ist aktuell.

Danach hab ich Java im Browser aktiviert :

Code:

PluginCheck
 

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.

Überprüft wird: Browser, Flash, Java und Adobe Reader Version.
 

    Firefox 13.0.1 ist veraltet!
 

    Flash 10,3,183,10 ist veraltet!

    Aktualisieren Sie bitte auf die neueste Version!
 

    Java ist nicht Installiert oder nicht aktiviert.
 

    Adobe Reader 11,0,0,379 ist aktuell.

OK:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Code:

ComboFix 13-05-18.04 - Markus 19.05.2013  18:23:03.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4095.2622 [GMT 2:00]

ausgeführt von:: c:\users\Markus\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\Common Files\ASPG_icon.ico

c:\users\Iris\Documents\~WRL2007.tmp

c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe

c:\windows\IsUn0407.exe

c:\windows\msvcr71.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-04-19 bis 2013-05-19  ))))))))))))))))))))))))))))))

.

.

2013-05-19 16:39 . 2013-05-19 16:39        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-05-19 16:13 . 2013-05-19 16:13        --------        d-----w-        c:\users\Markus\AppData\Roaming\Malwarebytes

2013-05-17 23:57 . 2013-04-05 06:50        15404032        ----a-w-        c:\windows\system32\ieframe.dll

2013-05-17 20:44 . 2013-05-17 20:44        --------        d-----w-        c:\program files (x86)\Common Files\Java

2013-05-17 20:43 . 2013-05-17 20:43        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-05-17 15:17 . 2013-05-17 16:43        --------        d-----w-        c:\users\Markus\AppData\Local\Ubisoft Game Launcher

2013-05-17 14:33 . 2013-05-17 14:33        --------        d-----w-        c:\program files (x86)\Ubisoft

2013-05-17 13:30 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2013-05-17 13:30 . 2013-04-10 06:01        983400        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2013-05-17 13:30 . 2011-02-03 11:25        144384        ----a-w-        c:\windows\system32\cdd.dll

2013-05-17 13:29 . 2013-04-10 03:30        3153920        ----a-w-        c:\windows\system32\win32k.sys

2013-05-17 13:29 . 2013-02-27 05:52        14172672        ----a-w-        c:\windows\system32\shell32.dll

2013-05-17 13:29 . 2013-02-27 05:48        1930752        ----a-w-        c:\windows\system32\authui.dll

2013-05-17 13:29 . 2013-02-27 05:52        197120        ----a-w-        c:\windows\system32\shdocvw.dll

2013-05-17 13:29 . 2013-02-27 06:02        111448        ----a-w-        c:\windows\system32\consent.exe

2013-05-17 13:29 . 2013-02-27 05:47        70144        ----a-w-        c:\windows\system32\appinfo.dll

2013-05-17 13:29 . 2013-02-27 04:49        1796096        ----a-w-        c:\windows\SysWow64\authui.dll

2013-05-17 13:28 . 2013-03-19 05:53        48640        ----a-w-        c:\windows\system32\wwanprotdim.dll

2013-05-17 13:28 . 2013-03-19 05:53        230400        ----a-w-        c:\windows\system32\wwansvc.dll

2013-05-17 13:28 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5B3F22D5-B435-47AF-8D45-B9654B126C5F}\mpengine.dll

2013-05-09 16:23 . 2013-05-09 16:23        --------        d-----w-        c:\users\Markus\AppData\Local\SKIDROW

2013-05-07 15:48 . 2013-05-07 15:47        83160        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-05-05 12:28 . 2013-05-05 12:28        --------        d-----w-        c:\program files (x86)\ESET

2013-05-05 11:13 . 2013-05-05 11:13        --------        d-----w-        c:\program files (x86)\7-Zip

2013-05-05 08:57 . 2013-05-05 08:57        --------        d-----w-        c:\users\ASUS\AppData\Roaming\Malwarebytes

2013-05-05 08:56 . 2013-05-05 08:56        --------        d-----w-        c:\programdata\Malwarebytes

2013-05-05 08:56 . 2013-04-04 12:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-05-05 08:56 . 2013-05-05 08:56        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2013-05-05 08:56 . 2013-05-05 08:56        --------        d-----w-        c:\users\ASUS\AppData\Local\Programs

2013-05-05 08:48 . 2013-05-05 08:48        --------        d-----w-        c:\windows\SysWow64\jmdp

2013-05-05 08:48 . 2013-05-05 08:48        --------        d-----w-        c:\windows\SysWow64\ARFC

2013-05-05 08:48 . 2013-02-27 11:24        1273648        ----a-w-        c:\windows\system32\dmwu.exe

2013-05-05 08:48 . 2013-02-27 11:23        35328        ----a-w-        c:\windows\system32\ImHttpComm.dll

2013-05-05 08:14 . 2013-05-05 08:14        --------        d-----w-        C:\_OTL

2013-05-04 09:45 . 2013-05-04 09:45        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2013-05-01 15:36 . 2013-05-01 15:36        --------        d-----w-        c:\windows\SysWow64\wbem\en-US

2013-05-01 15:36 . 2013-05-01 15:36        --------        d-----w-        c:\windows\system32\wbem\en-US

2013-05-01 15:16 . 2013-05-01 15:16        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-04-26 12:02 . 2013-04-12 14:45        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-18 00:11 . 2011-01-11 15:02        75016696        ----a-w-        c:\windows\system32\MRT.exe

2013-05-17 20:43 . 2012-07-01 17:52        866720        ----a-w-        c:\windows\SysWow64\npdeployJava1.dll

2013-05-17 20:43 . 2011-01-22 18:43        788896        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2013-05-17 14:33 . 2011-10-21 23:06        189248        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe

2013-05-07 15:43 . 2012-08-09 14:01        45056        ----a-w-        c:\windows\system32\acovcnt.exe

2013-05-02 00:06 . 2011-01-11 14:26        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-05-01 14:45 . 2010-06-24 10:33        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-04-13 05:49 . 2013-05-17 13:30        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-17 13:30        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-17 13:30        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-17 13:30        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-17 13:30        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-17 13:30        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll

2013-04-02 14:09 . 2013-04-02 14:09        4550656        ----a-w-        c:\windows\SysWow64\GPhotos.scr

2013-04-02 09:52 . 2013-04-02 09:53        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2013-04-02 09:52 . 2013-04-02 09:53        130016        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2013-04-02 09:52 . 2013-04-02 09:53        100712        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2013-03-29 21:29 . 2011-10-21 23:06        270776        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr

2013-03-19 06:04 . 2013-04-12 12:40        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-03-19 05:46 . 2013-04-12 12:40        43520        ----a-w-        c:\windows\system32\csrsrv.dll

2013-03-19 05:04 . 2013-04-12 12:40        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04 . 2013-04-12 12:40        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47 . 2013-04-12 12:40        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll

2013-03-19 03:06 . 2013-04-12 12:40        112640        ----a-w-        c:\windows\system32\smss.exe

2009-04-08 17:31 . 2009-04-08 17:31        106496        ----a-w-        c:\program files (x86)\Common Files\CPInstallAction.dll

2008-08-12 04:45 . 2008-08-12 04:45        155648        ----a-w-        c:\program files (x86)\Common Files\MSIactionall.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{9B6B03F1-16CF-4491-BBBB-E872802DD717}]

2013-02-10 14:27        138752        ----a-w-        c:\programdata\DNSErrorHelper\bho.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{FE163F11-1919-4257-A280-FF5AF8DAEECB}]

2011-08-25 07:15        50240        ----a-w-        c:\program files (x86)\icq\Internet Explorer\icq.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]

@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"

[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]

2007-06-02 00:08        143360        ----a-w-        c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2013-03-29 1631144]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18642024]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-06-26 98304]

"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2009-08-17 6859392]

"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-17 2245120]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2009-04-20 159744]

"MSN Toolbar"="c:\program files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe" [2009-11-16 240992]

"Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]

"openvpn-gui"="c:\program files (x86)\OpenVPN\bin\openvpn-gui.exe" [2012-07-04 370384]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-05-07 345312]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-12-10 2254768]

.

c:\users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

msconfig.lnk - c:\windows\System32\rundll32.exe [2009-7-14 45568]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

AStA Copyclient.lnk - c:\program files (x86)\AStA Paderborn\AStA Copyclient\asta-copyclient-helper.exe [2012-9-25 94720]

FancyStart daemon.lnk - c:\windows\Installer\{F0DF4513-3C4C-4EB8-8012-2C5F70AF3988}\_A1DDD39913A1970387B7B3.exe [2010-5-18 12862]

HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]

SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-08-21 44032]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [2009-06-18 15928]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-10-14 834544]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-04-02 28600]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-10-12 279616]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-09-17 359552]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-06-25 203264]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2013-04-02 86752]

S2 ASMMAP64;ASMMAP64;c:\program files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]

S2 AstaCopyclientFirewallService;AstaCopyclientFirewallService;c:\program files (x86)\AStA Paderborn\AStA Copyclient\AStACopyclientFirewallService.exe [2012-09-25 18944]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-12-10 2465712]

S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-06-12 112128]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-06-23 344680]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-06-05 34872]

S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-07-09 1222144]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-12 12:44        1642448        ----a-w-        c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-29 15:30]

.

2013-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-29 15:30]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]

@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"

[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]

2007-06-01 23:52        159744        ----a-w-        c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-06-12 619392]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-01 323584]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService

FontCache

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://de.search.yahoo.com/web?fr=vc_trans_de_8197&type=dshp

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube Download - c:\users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - c:\users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files (x86)\ICQ7.6\ICQ.exe

FF - ProfilePath - c:\users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\qlkytyn4.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://de.search.yahoo.com/web?fr=vc_trans_de_8197&type=dshp

FF - prefs.js: network.proxy.type - 0

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

Toolbar-Locked - (no file)

HKLM-Run-Ocs_SM - c:\users\Markus\AppData\Roaming\OCS\SM\SearchAnonymizer.exe

AddRemove-Birth of the Federation - c:\windows\IsUn0407.exe

AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe

AddRemove-{EEE6C374-6118-11DC-9C72-001320C79847} - c:\program files (x86)\SweetIM\Installers\uninstff2.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1302862512-3681644172-702645094-1002\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:9c,74,09,65,bb,35,64,8b,52,d9,4d,e4,21,0c,a5,dd,4e,78,b8,06,55,c9,3c,

   fd,0f,e9,4a,6a,58,8b,1f,13,3a,72,e0,36,a6,72,62,71,01,a1,c0,07,94,f8,cd,ad,\

"??"=hex:32,f2,d5,f8,9c,37,c2,3a,fa,f1,51,93,1c,49,5b,8a

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-05-19  18:45:03

ComboFix-quarantined-files.txt  2013-05-19 16:45

.

Vor Suchlauf: 6.225.563.648 Bytes frei

Nach Suchlauf: 6.129.610.752 Bytes frei

.

- - End Of File - - 138497716269A0FAAAF8863204DA2E70

Firefox updaten!
Aktuell ist 21!

Sehr gut! :daumenhoc

damit bist Du sauber und entlassen! :)

adwCleaner entfernen

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Uninstall.
Bestätige mit Ja.

Tool-Bereinigung
Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html

Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
http://www.trojaner-board.de/109844-...ren-seite.html
PC wird immer langsamer - was tun?

Ok vielen Dank;)
Ich hab alles gemacht.Danke.

wuensche eine virenfreie Zeit ;)