Trojaner-Board - WORM/Juske.LC mit AntiVir gefunden

Einen wunderschönen guten Abend!

Ich habe heute am Netbook meiner Schwester (Asus Eee PC mit Windows 7 Starter, SP 1, 32-bit) angefangen, etwas aufzuräumen. Es sind ihr zwar keine besonderen Vorkommnisse aufgefallen, aber sie hat sich beklagt, dass das Netbook schon seit Monaten immer langsamer werde und sehr lange zum booten braucht. Sie hatte eine ganze Reihe veralteter Software-Versionen und auch keine Antiviren-Software installiert, darum habe ich zuerst Avira Free Antivirus heruntergeladen und laufen lassen, was mir auch einen Fund geliefert hat. Diesen Fund habe ich dann in die Quarantäne verschoben. Hier das log-file von Antivirus

Code:



Avira Free Antivirus

Erstellungsdatum der Reportdatei: Freitag, 24. Mai 2013  14:18
 
 

Das Programm läuft als uneingeschränkte Vollversion.

Online-Dienste stehen zur Verfügung.
 

Lizenznehmer   : Avira Free Antivirus

Seriennummer   : 0000149996-ADJIE-0000001

Plattform      : Windows 7 Starter

Windowsversion : (Service Pack 1)  [6.1.7601]

Boot Modus     : Normal gebootet

Benutzername   : SYSTEM

Computername   : LOPI-PC
 

Versionsinformationen:

BUILD.DAT      : 13.0.0.3640    54852 Bytes  18.04.2013 13:29:00

AVSCAN.EXE     : 13.6.0.1262   636984 Bytes  24.05.2013 11:53:09

AVSCANRC.DLL   : 13.4.0.360     64800 Bytes  24.05.2013 11:53:09

LUKE.DLL       : 13.6.0.1262    65080 Bytes  24.05.2013 11:53:58

AVSCPLR.DLL    : 13.6.0.1262    92216 Bytes  24.05.2013 12:17:20

AVREG.DLL      : 13.6.0.1262   247864 Bytes  24.05.2013 12:17:20

avlode.dll     : 13.6.2.1262   432184 Bytes  24.05.2013 11:53:04

avlode.rdf     : 13.0.1.12      25921 Bytes  24.05.2013 11:55:19

VBASE000.VDF   : 7.11.70.0   66736640 Bytes  04.04.2013 11:51:10

VBASE001.VDF   : 7.11.74.226  2201600 Bytes  30.04.2013 11:51:19

VBASE002.VDF   : 7.11.74.227     2048 Bytes  30.04.2013 11:51:19

VBASE003.VDF   : 7.11.74.228     2048 Bytes  30.04.2013 11:51:19

VBASE004.VDF   : 7.11.74.229     2048 Bytes  30.04.2013 11:51:19

VBASE005.VDF   : 7.11.74.230     2048 Bytes  30.04.2013 11:51:19

VBASE006.VDF   : 7.11.74.231     2048 Bytes  30.04.2013 11:51:19

VBASE007.VDF   : 7.11.74.232     2048 Bytes  30.04.2013 11:51:19

VBASE008.VDF   : 7.11.74.233     2048 Bytes  30.04.2013 11:51:19

VBASE009.VDF   : 7.11.74.234     2048 Bytes  30.04.2013 11:51:19

VBASE010.VDF   : 7.11.74.235     2048 Bytes  30.04.2013 11:51:19

VBASE011.VDF   : 7.11.74.236     2048 Bytes  30.04.2013 11:51:20

VBASE012.VDF   : 7.11.74.237     2048 Bytes  30.04.2013 11:51:20

VBASE013.VDF   : 7.11.74.238     2048 Bytes  30.04.2013 11:51:20

VBASE014.VDF   : 7.11.75.97    181248 Bytes  02.05.2013 11:51:20

VBASE015.VDF   : 7.11.75.183   217600 Bytes  03.05.2013 11:51:21

VBASE016.VDF   : 7.11.76.27    183808 Bytes  04.05.2013 11:51:22

VBASE017.VDF   : 7.11.76.101   194048 Bytes  06.05.2013 11:51:23

VBASE018.VDF   : 7.11.76.213   163328 Bytes  07.05.2013 11:51:24

VBASE019.VDF   : 7.11.77.41    134656 Bytes  08.05.2013 11:51:25

VBASE020.VDF   : 7.11.77.145   141312 Bytes  10.05.2013 11:51:26

VBASE021.VDF   : 7.11.77.225   155648 Bytes  12.05.2013 11:51:27

VBASE022.VDF   : 7.11.78.21    202752 Bytes  13.05.2013 11:51:28

VBASE023.VDF   : 7.11.78.71    140800 Bytes  13.05.2013 11:51:29

VBASE024.VDF   : 7.11.78.147   167936 Bytes  15.05.2013 11:51:30

VBASE025.VDF   : 7.11.78.207   147456 Bytes  16.05.2013 11:51:31

VBASE026.VDF   : 7.11.79.17    198656 Bytes  17.05.2013 11:51:32

VBASE027.VDF   : 7.11.79.194   659968 Bytes  23.05.2013 11:51:36

VBASE028.VDF   : 7.11.79.195     2048 Bytes  23.05.2013 11:51:36

VBASE029.VDF   : 7.11.79.196     2048 Bytes  23.05.2013 11:51:36

VBASE030.VDF   : 7.11.79.197     2048 Bytes  23.05.2013 11:51:36

VBASE031.VDF   : 7.11.79.238   185344 Bytes  24.05.2013 11:51:36

Engineversion  : 8.2.12.48 

AEVDF.DLL      : 8.1.2.10      102772 Bytes  24.05.2013 11:51:57

AESCRIPT.DLL   : 8.1.4.118     487805 Bytes  24.05.2013 11:51:56

AESCN.DLL      : 8.1.10.4      131446 Bytes  24.05.2013 11:51:55

AESBX.DLL      : 8.2.5.12      606578 Bytes  24.05.2013 11:51:59

AERDL.DLL      : 8.2.0.88      643444 Bytes  24.05.2013 11:51:55

AEPACK.DLL     : 8.3.2.12      754040 Bytes  24.05.2013 11:51:54

AEOFFICE.DLL   : 8.1.2.56      205180 Bytes  24.05.2013 11:51:52

AEHEUR.DLL     : 8.1.4.378    5910905 Bytes  24.05.2013 11:51:51

AEHELP.DLL     : 8.1.25.10     258425 Bytes  24.05.2013 11:51:40

AEGEN.DLL      : 8.1.7.4       442741 Bytes  24.05.2013 11:51:39

AEEXP.DLL      : 8.4.0.32      201078 Bytes  24.05.2013 11:51:59

AEEMU.DLL      : 8.1.3.2       393587 Bytes  24.05.2013 11:51:38

AECORE.DLL     : 8.1.31.2      201080 Bytes  24.05.2013 11:51:38

AEBB.DLL       : 8.1.1.4        53619 Bytes  24.05.2013 11:51:38

AVWINLL.DLL    : 13.6.0.480     26480 Bytes  24.05.2013 11:45:57

AVPREF.DLL     : 13.6.0.480     51056 Bytes  24.05.2013 11:53:07

AVREP.DLL      : 13.6.0.480    178544 Bytes  24.05.2013 11:55:19

AVARKT.DLL     : 13.6.0.1262   258104 Bytes  24.05.2013 11:52:49

AVEVTLOG.DLL   : 13.6.0.1262   164920 Bytes  24.05.2013 11:52:56

SQLITE3.DLL    : 3.7.0.1       397704 Bytes  24.05.2013 11:54:34

AVSMTP.DLL     : 13.6.0.480     62832 Bytes  24.05.2013 11:53:11

NETNT.DLL      : 13.6.0.480     16240 Bytes  24.05.2013 11:54:13

RCIMAGE.DLL    : 13.4.0.360   4780832 Bytes  24.05.2013 11:46:00

RCTEXT.DLL     : 13.6.0.976     69344 Bytes  24.05.2013 11:46:00
 

Konfiguration für den aktuellen Suchlauf:

Job Name..............................: Vollständige Systemprüfung

Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp

Protokollierung.......................: standard

Primäre Aktion........................: interaktiv

Sekundäre Aktion......................: ignorieren

Durchsuche Masterbootsektoren.........: ein

Durchsuche Bootsektoren...............: ein

Bootsektoren..........................: C:, D:, 

Durchsuche aktive Programme...........: ein

Laufende Programme erweitert..........: ein

Durchsuche Registrierung..............: ein

Suche nach Rootkits...................: ein

Integritätsprüfung von Systemdateien..: aus

Datei Suchmodus.......................: Alle Dateien

Durchsuche Archive....................: ein

Rekursionstiefe einschränken..........: 20

Archiv Smart Extensions...............: ein

Makrovirenheuristik...................: ein

Dateiheuristik........................: erweitert
 

Beginn des Suchlaufs: Freitag, 24. Mai 2013  14:18
 

Der Suchlauf über die Masterbootsektoren wird begonnen:

Masterbootsektor HD0

    [INFO]      Es wurde kein Virus gefunden!
 

Der Suchlauf über die Bootsektoren wird begonnen:

Bootsektor 'C:\'

    [INFO]      Es wurde kein Virus gefunden!

Bootsektor 'D:\'

    [INFO]      Es wurde kein Virus gefunden!
 

Der Suchlauf nach versteckten Objekten wird begonnen.
 

Der Suchlauf über gestartete Prozesse wird begonnen:

Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskeng.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchProtocolHost.exe' - '78' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht

Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht

Durchsuche Prozess 'avscan.exe' - '120' Modul(e) wurden durchsucht

Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht

Durchsuche Prozess 'avguard.exe' - '71' Modul(e) wurden durchsucht

Durchsuche Prozess 'avcenter.exe' - '91' Modul(e) wurden durchsucht

Durchsuche Prozess 'avgnt.exe' - '89' Modul(e) wurden durchsucht

Durchsuche Prozess 'sched.exe' - '43' Modul(e) wurden durchsucht

Durchsuche Prozess 'SeaPort.exe' - '51' Modul(e) wurden durchsucht

Durchsuche Prozess 'wuauclt.exe' - '37' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht

Durchsuche Prozess 'BtStackServer.exe' - '78' Modul(e) wurden durchsucht

Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht

Durchsuche Prozess 'CCC.exe' - '169' Modul(e) wurden durchsucht

Durchsuche Prozess 'soffice.bin' - '92' Modul(e) wurden durchsucht

Durchsuche Prozess 'soffice.exe' - '18' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dropbox.exe' - '90' Modul(e) wurden durchsucht

Durchsuche Prozess 'BTTray.exe' - '63' Modul(e) wurden durchsucht

Durchsuche Prozess 'sidebar.exe' - '97' Modul(e) wurden durchsucht

Durchsuche Prozess 'ETDCtrlHelper.exe' - '29' Modul(e) wurden durchsucht

Durchsuche Prozess 'SearchIndexer.exe' - '110' Modul(e) wurden durchsucht

Durchsuche Prozess 'jusched.exe' - '74' Modul(e) wurden durchsucht

Durchsuche Prozess 'iTunesHelper.exe' - '80' Modul(e) wurden durchsucht

Durchsuche Prozess 'Boingo Wi-Fi.exe' - '48' Modul(e) wurden durchsucht

Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht

Durchsuche Prozess 'HotKeyMon.exe' - '17' Modul(e) wurden durchsucht

Durchsuche Prozess 'RtHDVCpl.exe' - '41' Modul(e) wurden durchsucht

Durchsuche Prozess 'HotkeyService.exe' - '45' Modul(e) wurden durchsucht

Durchsuche Prozess 'LiveUpdate.exe' - '77' Modul(e) wurden durchsucht

Durchsuche Prozess 'CapsHook.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'SuperHybridEngine.exe' - '39' Modul(e) wurden durchsucht

Durchsuche Prozess 'Eee Docking.exe' - '24' Modul(e) wurden durchsucht

Durchsuche Prozess 'MOM.exe' - '70' Modul(e) wurden durchsucht

Durchsuche Prozess 'AsScrPro.exe' - '30' Modul(e) wurden durchsucht

Durchsuche Prozess 'ETDCtrl.exe' - '45' Modul(e) wurden durchsucht

Durchsuche Prozess 'rundll32.exe' - '35' Modul(e) wurden durchsucht

Durchsuche Prozess 'uiSeAgnt.exe' - '76' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht

Durchsuche Prozess 'Explorer.exe' - '178' Modul(e) wurden durchsucht

Durchsuche Prozess 'UIWatchDog.exe' - '22' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht

Durchsuche Prozess 'btwdins.exe' - '50' Modul(e) wurden durchsucht

Durchsuche Prozess 'WallPaperAgent.exe' - '27' Modul(e) wurden durchsucht

Durchsuche Prozess 'mDNSResponder.exe' - '40' Modul(e) wurden durchsucht

Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht

Durchsuche Prozess 'taskhost.exe' - '66' Modul(e) wurden durchsucht

Durchsuche Prozess 'AsusService.exe' - '24' Modul(e) wurden durchsucht

Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht

Durchsuche Prozess 'coreFrameworkHost.exe' - '92' Modul(e) wurden durchsucht

Durchsuche Prozess 'AppleMobileDeviceService.exe' - '49' Modul(e) wurden durchsucht

Durchsuche Prozess 'coreServiceShell.exe' - '29' Modul(e) wurden durchsucht

Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht

Durchsuche Prozess 'spoolsv.exe' - '77' Modul(e) wurden durchsucht

Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht

Durchsuche Prozess 'WLANExt.exe' - '34' Modul(e) wurden durchsucht

Durchsuche Prozess 'atieclxx.exe' - '29' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '146' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '93' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '84' Modul(e) wurden durchsucht

Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht

Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht

Durchsuche Prozess 'lsass.exe' - '62' Modul(e) wurden durchsucht

Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht

Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht

Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht

Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht

Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
 

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:

Die Registry wurde durchsucht ( '2626' Dateien ).
 
 

Der Suchlauf über die ausgewählten Dateien wird begonnen:
 

Beginne mit der Suche in 'C:\'

C:\Users\Lopi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LF0X9ZEY\facebook-pic000934519[1].exe

  [FUND]      Enthält Erkennungsmuster des Wurmes WORM/Juske.LC

Beginne mit der Suche in 'D:\'
 

Beginne mit der Desinfektion:

C:\Users\Lopi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LF0X9ZEY\facebook-pic000934519[1].exe

  [FUND]      Enthält Erkennungsmuster des Wurmes WORM/Juske.LC

  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57de2686.qua' verschoben!
 
 

Ende des Suchlaufs: Freitag, 24. Mai 2013  17:19

Benötigte Zeit:  2:47:28 Stunde(n)
 

Der Suchlauf wurde vollständig durchgeführt.
 

  25446 Verzeichnisse wurden überprüft

 649252 Dateien wurden geprüft

      1 Viren bzw. unerwünschte Programme wurden gefunden

      0 Dateien wurden als verdächtig eingestuft

      0 Dateien wurden gelöscht

      0 Viren bzw. unerwünschte Programme wurden repariert

      1 Dateien wurden in die Quarantäne verschoben

      0 Dateien wurden umbenannt

      0 Dateien konnten nicht durchsucht werden

 649251 Dateien ohne Befall

   7299 Archive wurden durchsucht

      0 Warnungen

      1 Hinweise

 589276 Objekte wurden beim Rootkitscan durchsucht

      0 Versteckte Objekte wurden gefunden

Als nächstes habe ich Malwarebytes gestartet, keine Funde

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.05.24.05
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 10.0.9200.16576

Lopi :: LOPI-PC [Administrator]
 

24.05.2013 17:27:40

mbam-log-2013-05-24 (17-27-40).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 355452

Laufzeit: 2 Stunde(n), 25 Minute(n), 6 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

In der Zwischenzeit habe ich mich im Internet schlau gemacht und bin auf eure Seite gestoßen. Deshalb habe ich zuerst Defogger ausgeführt, wie in euren ersten Schritten beschreiben. Dann habe ich OTL laufen lassen.
OTL.txt

Code:

OTL logfile created on: 24.05.2013 19:55:39 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lopi\Desktop

 Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

767,12 Mb Total Physical Memory | 340,00 Mb Available Physical Memory | 44,32% Memory free

1,84 Gb Paging File | 0,80 Gb Available in Paging File | 43,19% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 100,00 Gb Total Space | 50,27 Gb Free Space | 50,27% Space Free | Partition Type: NTFS

Drive D: | 117,87 Gb Total Space | 47,24 Gb Free Space | 40,08% Space Free | Partition Type: NTFS

 

Computer Name: LOPI-PC | User Name: Lopi | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.05.24 19:27:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lopi\Desktop\OTL.exe

PRC - [2013.05.24 13:54:22 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2013.05.24 13:53:11 | 000,079,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2013.05.24 13:52:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2013.05.24 13:52:57 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2013.05.23 20:10:52 | 028,712,088 | ---- | M] (Dropbox, Inc.) -- C:\Users\Lopi\AppData\Roaming\Dropbox\bin\Dropbox.exe

PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2012.11.30 04:55:25 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2012.11.23 04:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2012.06.11 17:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.09.01 22:31:48 | 003,058,304 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe

PRC - [2010.08.24 04:06:34 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe

PRC - [2010.08.24 04:06:32 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe

PRC - [2010.08.10 00:04:58 | 001,244,592 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\EeePC\HotkeyService\HotkeyService.exe

PRC - [2010.06.12 06:56:42 | 000,976,872 | ---- | M] (AsusTek Computer Inc.) -- C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe

PRC - [2010.06.10 22:12:06 | 000,414,384 | ---- | M] () -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe

PRC - [2010.06.10 09:57:18 | 000,548,744 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDCtrl.exe

PRC - [2010.06.09 23:26:34 | 000,412,600 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\EeePC\SHE\SuperHybridEngine.exe

PRC - [2010.05.29 01:41:36 | 000,445,344 | ---- | M] (ASUS) -- C:\Program Files\EeePC\CapsHook\CapsHook.exe

PRC - [2010.05.21 01:52:06 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin

PRC - [2010.05.21 01:52:04 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe

PRC - [2010.04.17 02:56:44 | 002,843,936 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

PRC - [2010.04.17 02:56:44 | 000,828,704 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2010.04.17 02:56:44 | 000,644,384 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

PRC - [2010.04.07 07:16:52 | 001,599,880 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDCtrlHelper.exe

PRC - [2009.12.10 02:51:18 | 000,115,888 | ---- | M] (Oceanis) -- C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe

PRC - [2009.09.11 20:41:02 | 000,100,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe

PRC - [2009.08.19 02:35:56 | 000,219,136 | ---- | M] () -- C:\Windows\System32\AsusService.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.04.21 21:44:32 | 000,087,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

MOD - [2013.04.21 21:44:04 | 001,242,952 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

MOD - [2013.03.26 12:54:14 | 001,670,144 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7366a39c36523a084bc11c230929ff92\Microsoft.VisualBasic.ni.dll

MOD - [2013.03.26 12:23:21 | 011,833,344 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll

MOD - [2013.03.26 12:23:06 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll

MOD - [2013.03.26 12:23:03 | 000,628,224 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\01c6cb58745f397c9b7ccf3ab7bfc9cd\System.EnterpriseServices.ni.dll

MOD - [2013.03.26 12:23:02 | 000,627,200 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\536d704e93ffec9b54e4a0312fb5b996\System.Transactions.ni.dll

MOD - [2013.03.26 12:23:01 | 006,611,456 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\5f1ed9259488bd5e34e4ff4bf2f01687\System.Data.ni.dll

MOD - [2013.03.26 12:20:10 | 012,436,480 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll

MOD - [2013.03.26 12:19:41 | 001,592,832 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll

MOD - [2013.03.26 12:19:04 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll

MOD - [2013.03.26 12:18:57 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll

MOD - [2013.03.26 12:18:54 | 007,989,760 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll

MOD - [2013.03.26 12:18:32 | 011,493,376 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll

MOD - [2013.03.13 22:48:52 | 024,978,944 | ---- | M] () -- C:\Users\Lopi\AppData\Roaming\Dropbox\bin\libcef.dll

MOD - [2012.11.14 01:32:50 | 003,558,400 | ---- | M] () -- C:\Users\Lopi\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll

MOD - [2010.11.13 01:19:05 | 000,434,176 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll

MOD - [2010.11.13 01:19:04 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll

MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll

MOD - [2010.09.01 22:40:44 | 000,030,032 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\SqliteShared\2.2.0.26258__0d0f4b69e50e559b\SqliteShared.dll

MOD - [2010.09.01 22:40:38 | 000,839,680 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Data.SQLite\1.0.60.0__db937bc2d44ff139\System.Data.SQLite.dll

MOD - [2010.07.19 22:48:14 | 000,270,336 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

MOD - [2010.06.15 09:24:18 | 000,124,240 | ---- | M] () -- C:\PROGRA~1\ASUS\ASUSWE~1\2232~1.76\ASUSWS~1.DLL

MOD - [2010.06.10 22:12:06 | 000,414,384 | ---- | M] () -- C:\Program Files\ASUS\Eee Docking\Eee Docking.exe

MOD - [2010.05.04 16:36:28 | 000,970,752 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll

MOD - [2010.04.17 02:56:56 | 000,132,384 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll

MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll

MOD - [2008.10.24 20:29:16 | 000,016,384 | R--- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll

 

 
 ========== Services (SafeList) ==========

 

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)

SRV - [2013.05.24 14:00:35 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.05.24 13:54:22 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2013.05.24 13:52:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2013.05.12 00:26:17 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.06.11 17:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe -- (BBUpdate)

SRV - [2012.06.11 17:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe -- (BBSvc)

SRV - [2010.08.24 04:06:32 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)

SRV - [2010.04.17 02:56:44 | 000,644,384 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV - [2009.08.19 02:35:56 | 000,219,136 | ---- | M] () [Auto | Running] -- C:\Windows\System32\AsusService.exe -- (AsusService)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | Disabled | Running] -- system32\DRIVERS\tmtdi.sys -- (tmtdi)

DRV - [2013.05.24 13:55:15 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2013.05.24 13:55:15 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2013.05.24 13:55:15 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2013.05.24 13:55:15 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.08.24 04:10:00 | 000,100,352 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)

DRV - [2010.08.24 04:09:50 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)

DRV - [2010.08.24 04:06:28 | 006,095,360 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)

DRV - [2010.08.24 04:06:04 | 000,214,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)

DRV - [2010.05.10 11:28:15 | 000,068,208 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C)

DRV - [2010.03.31 03:40:20 | 000,011,520 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\AsUpIO.sys -- (AsUpIO)

DRV - [2009.07.20 11:29:40 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)

DRV - [2009.07.14 00:02:46 | 001,096,704 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\URLSearchHook: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFree.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1708250

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com [binary data]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://eeepc.asus.com/hxxp://www. [Binary data over 200 bytes]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=MAAU&ocid=bb7hp

IE - HKCU\..\URLSearchHook: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFree.dll (Conduit Ltd.)

IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox

IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1708250

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Bing"

FF - prefs.js..browser.search.defaultthis.engineName: "Free Lunch Design Customized Web Search"

FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=ASUBDF&PC=MAAU&q="

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/"

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..extensions.enabledItems: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}:2.0.4.1

FF - prefs.js..keyword.URL: "hxxp://www.bing.com/search?FORM=ASUBDF&PC=MAAU&q="

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.24 13:32:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.05.24 13:32:00 | 000,000,000 | ---D | M]

 

[2010.12.27 19:30:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lopi\AppData\Roaming\mozilla\Extensions

[2013.05.24 12:18:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lopi\AppData\Roaming\mozilla\Firefox\Profiles\0wp51ui5.default\extensions

[2011.03.01 10:20:45 | 000,000,000 | ---D | M] (Free Lunch Design Toolbar) -- C:\Users\Lopi\AppData\Roaming\mozilla\Firefox\Profiles\0wp51ui5.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}

[2012.05.13 12:23:52 | 000,001,840 | ---- | M] () -- C:\Users\Lopi\AppData\Roaming\mozilla\firefox\profiles\0wp51ui5.default\searchplugins\bing.xml

[2009.05.31 19:45:28 | 000,000,896 | ---- | M] () -- C:\Users\Lopi\AppData\Roaming\mozilla\firefox\profiles\0wp51ui5.default\searchplugins\conduit.xml

[2013.05.24 12:29:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2011.02.05 22:27:31 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2013.05.24 12:29:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions

[2013.05.24 12:29:47 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}

CHR - homepage: hxxp://www.google.com/

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

 

O1 HOSTS File: ([2011.02.09 21:46:41 | 000,000,822 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Free Lunch Design Toolbar) - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFree.dll (Conduit Ltd.)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Windows 7 Starter Helper) - {D381FF29-7CFB-4D4E-B92A-C4EDDC696614} - C:\Program Files\Oceanis\SystemSetting\StarterHelper.dll (Oceanis)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Free Lunch Design Toolbar) - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFree.dll (Conduit Ltd.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (Free Lunch Design Toolbar) - {57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC} - C:\Program Files\Free_Lunch_Design\tbFree.dll (Conduit Ltd.)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files\ASUS\ASUS WebStorage\2.2.32.76\ASUSWSDashBoard.exe (eCareme)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CapsHook] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()

O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)

O4 - HKLM..\Run: [GraphicsSwitch] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [HotkeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [LiveUpdate] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKCU..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background File not found

O4 - Startup: C:\Users\Lopi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Lopi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\Lopi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll File not found

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll File not found

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F71BD069-DDE1-4DF2-A57C-ADDF49C6A4D3}: DhcpNameServer = 10.0.0.138

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL File not found

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL File not found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKCU Winlogon: Shell - (C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe) - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.24 19:27:06 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Lopi\Desktop\OTL.exe

[2013.05.24 17:26:34 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Roaming\Malwarebytes

[2013.05.24 17:26:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.05.24 17:26:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.05.24 17:26:12 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2013.05.24 17:26:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2013.05.24 17:25:46 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Local\Programs

[2013.05.24 14:17:27 | 000,066,656 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avnetflt.sys

[2013.05.24 14:03:53 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Roaming\Avira

[2013.05.24 13:57:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2013.05.24 13:57:18 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys

[2013.05.24 13:57:16 | 000,135,136 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avipbb.sys

[2013.05.24 13:57:16 | 000,084,744 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avgntflt.sys

[2013.05.24 13:57:16 | 000,037,352 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avkmgr.sys

[2013.05.24 13:57:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2013.05.24 13:57:13 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2013.05.24 13:31:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

[2013.05.24 13:26:54 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update

[2013.05.24 13:20:58 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Local\Macromedia

[2013.05.24 13:18:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2013.05.24 13:13:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2013.05.24 12:30:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2013.05.24 12:30:03 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service

[2013.05.14 14:13:44 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.24 19:58:02 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job

[2013.05.24 19:39:10 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.05.24 19:27:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lopi\Desktop\OTL.exe

[2013.05.24 19:22:36 | 000,000,000 | ---- | M] () -- C:\Users\Lopi\defogger_reenable

[2013.05.24 15:04:44 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2013.05.24 14:17:20 | 000,066,656 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avnetflt.sys

[2013.05.24 13:57:41 | 000,002,012 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2013.05.24 13:55:15 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avipbb.sys

[2013.05.24 13:55:15 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avgntflt.sys

[2013.05.24 13:55:15 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avkmgr.sys

[2013.05.24 13:55:15 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys

[2013.05.24 13:48:30 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.24 13:48:30 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.24 13:40:18 | 000,001,847 | ---- | M] () -- C:\Users\Lopi\Desktop\MySyncFolder.lnk

[2013.05.24 13:38:17 | 000,001,090 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.05.24 13:36:59 | 603,283,456 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.24 13:19:55 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.24 12:42:08 | 000,002,129 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2013.05.24 12:40:06 | 000,654,166 | ---- | M] () -- C:\windows\System32\perfh007.dat

[2013.05.24 12:40:06 | 000,299,718 | ---- | M] () -- C:\windows\System32\perfh009.dat

[2013.05.24 12:40:06 | 000,130,006 | ---- | M] () -- C:\windows\System32\perfc007.dat

[2013.05.24 12:40:06 | 000,037,582 | ---- | M] () -- C:\windows\System32\perfc009.dat

[2013.05.24 12:30:16 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2013.05.24 12:28:50 | 000,001,010 | ---- | M] () -- C:\Users\Lopi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2013.05.24 12:24:43 | 000,000,976 | ---- | M] () -- C:\Users\Lopi\Desktop\Dropbox.lnk

[2013.05.13 21:49:37 | 000,057,891 | ---- | M] () -- C:\Users\Lopi\Documents\woman churchs history.odt

[2013.05.04 16:42:49 | 000,025,185 | ---- | M] () -- C:\windows\System32\ieuinit.inf

[2013.04.26 19:24:03 | 000,531,700 | ---- | M] () -- C:\Users\Lopi\Documents\Irisches Segenslied.odt

[2013.04.25 17:01:40 | 000,020,496 | ---- | M] () -- C:\Users\Lopi\Documents\Maturastoffübersicht Did 2013.odt

 
 ========== Files Created - No Company Name ==========

 

[2013.05.24 19:22:36 | 000,000,000 | ---- | C] () -- C:\Users\Lopi\defogger_reenable

[2013.05.24 13:57:41 | 000,002,012 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2013.05.24 13:19:55 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.24 13:19:54 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

[2013.05.24 13:08:33 | 000,000,884 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job

[2013.05.24 12:30:16 | 000,001,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2013.05.13 21:49:34 | 000,057,891 | ---- | C] () -- C:\Users\Lopi\Documents\woman churchs history.odt

[2013.05.04 16:42:49 | 000,025,185 | ---- | C] () -- C:\windows\System32\ieuinit.inf

[2013.04.26 18:55:59 | 000,531,700 | ---- | C] () -- C:\Users\Lopi\Documents\Irisches Segenslied.odt

[2013.04.25 17:01:37 | 000,020,496 | ---- | C] () -- C:\Users\Lopi\Documents\Maturastoffübersicht Did 2013.odt

[2013.04.17 19:09:37 | 040,305,924 | ---- | C] () -- C:\Users\Lopi\Präsentation.odp

[2012.12.19 10:48:14 | 000,022,591 | ---- | C] () -- C:\Users\Lopi\Pädagogische Orientierung.sxw

[2011.02.05 22:49:33 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.01.11 16:16:01 | 000,027,623 | ---- | C] () -- C:\Users\Lopi\AppData\Roaming\UserTile.png

[2010.12.28 18:13:11 | 000,006,144 | ---- | C] () -- C:\Users\Lopi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.09.01 22:32:15 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== LOP Check ==========

 

[2010.09.01 22:47:41 | 000,000,000 | ---D | M] -- C:\Users\Lopi\AppData\Roaming\ASUS WebStorage

[2010.12.27 18:52:53 | 000,000,000 | ---D | M] -- C:\Users\Lopi\AppData\Roaming\com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1

[2013.05.24 13:41:38 | 000,000,000 | ---D | M] -- C:\Users\Lopi\AppData\Roaming\Dropbox

[2010.09.01 22:32:34 | 000,000,000 | ---D | M] -- C:\Users\Lopi\AppData\Roaming\E-Cam

[2010.12.27 19:03:17 | 000,000,000 | ---D | M] -- C:\Users\Lopi\AppData\Roaming\OpenOffice.org

 
 ========== Purity Check ==========

 

 

 
 ========== Files - Unicode (All) ==========

[2010.12.27 18:45:45 | 000,000,059 | ---- | M] ()(C:\windows\System32\??) -- C:\windows\System32\ʡ

[2010.12.27 18:45:45 | 000,000,059 | ---- | C] ()(C:\windows\System32\??) -- C:\windows\System32\ʡ
 

< End of report >

Extras.txt

Code:

OTL Extras logfile created on: 24.05.2013 19:55:39 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lopi\Desktop

 Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

767,12 Mb Total Physical Memory | 340,00 Mb Available Physical Memory | 44,32% Memory free

1,84 Gb Paging File | 0,80 Gb Available in Paging File | 43,19% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 100,00 Gb Total Space | 50,27 Gb Free Space | 50,27% Space Free | Partition Type: NTFS

Drive D: | 117,87 Gb Total Space | 47,24 Gb Free Space | 40,08% Space Free | Partition Type: NTFS

 

Computer Name: LOPI-PC | User Name: Lopi | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{4418ADA9-4C10-40E3-9FAC-D30EFDE3C6C4}" = lport=8182 | protocol=6 | dir=in | name=java(tm) platform se binary | 

"{6BED87B6-7640-45E7-9989-313EEA960EBB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{AB1CE0D2-A694-4E53-93A0-982E93350642}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{FC814DFC-899D-4F94-BBE4-896B28022593}" = lport=5353 | protocol=17 | dir=in | name=java(tm) platform se binary | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{2AEF72F3-2B3C-4232-B0CF-ADB463C62641}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2B2BD4FA-DAD3-45A1-8B95-EAE04EA5584C}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 

"{2E977E36-A016-4C9B-B45E-06DF0ABA91B6}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{62F73A88-7854-424C-BAEA-8ED9552CBBDE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{658641BF-F689-47D9-B965-2D27A66B9846}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 

"{70FFE384-997B-4D9E-8CB9-E61BCEC14888}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{85962DAC-BD3E-4533-8BE4-ECB963AA14C1}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 

"{A88651BD-EA56-4F5C-B297-3E57CF245A37}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"{E9ACA455-9903-4453-A751-F4B28DF9F541}" = protocol=17 | dir=in | app=c:\users\lopi\appdata\roaming\dropbox\bin\dropbox.exe | 

"{F00FBF10-9484-427B-803F-02C80E72D4A9}" = protocol=6 | dir=in | app=c:\users\lopi\appdata\roaming\dropbox\bin\dropbox.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{08D0A290-E98B-62B5-A423-CAF77EF910F4}" = CCC Help Finnish

"{10BDB7F2-3760-49CC-3F02-4E10DC9C9D84}" = Catalyst Control Center Graphics Previews Vista

"{15787831-3BEE-3F24-CF5D-86A297C2BE34}" = Catalyst Control Center InstallProxy

"{17780F99-A9DF-450B-81B3-6781B20A17A8}" = FontResizer

"{185AFA7A-F63E-450B-94AA-011CAC18090E}" = E-Cam

"{18D33A7B-5EB5-64A9-6759-2D7EC4D085D0}" = ATI Catalyst Install Manager

"{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}" = Bing Bar

"{1B343C8C-F170-4829-8481-E163317C5830}" = iTunes

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{25D1FAA5-89E4-55A8-FABA-671E9B7C1BAF}" = Catalyst Control Center Localization All

"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program

"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie

"{2CA34767-F6D1-B207-2B61-0BC0F71888BA}" = CCC Help Swedish

"{300A98D6-8DA2-45FF-9314-A6861D76A535}" = syncables desktop SE

"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver

"{321F3B6B-3736-C9BF-5273-BE3779059661}" = CCC Help Spanish

"{38E5A3B1-ADF1-47E0-8024-76310A30EB36}" = LiveUpdate

"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger

"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4B5092B6-F231-4D18-83BC-2618B729CA45}" = CapsHook

"{4E9BB299-32C5-F701-F2F2-251903A6286A}" = CCC Help Danish

"{4FCBCF89-1823-4D97-A6F2-0E8DD66E273A}" = Broadcom Wireless Network Adapter

"{50D570C5-9227-8756-06CE-1A69740ECF82}" = CCC Help Turkish

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC

"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support

"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call

"{65F69FE7-D0A0-9B54-1166-61697BC89701}" = ccc-core-static

"{6A193E0C-113E-ACE1-57E9-2CB4B7315AEB}" = CCC Help Greek

"{6AD81B3D-7411-5A4D-4312-072A0D33CAE9}" = ccc-utility

"{6F9375BA-521F-253A-F24D-F9332F2C4E9A}" = CCC Help Portuguese

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{71C0E38E-09F2-4386-9977-404D4F6640CD}" = Hotkey Service

"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{81601299-AD02-403C-9A47-93C509FE2EC2}" = Catalyst Control Center - Branding

"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}" = Chicken Invaders 2

"{859D40CF-8491-44AD-8FA8-7389CB418C64}" = 32 Bit HP CIO Components Installer

"{88F08F98-12BC-4613-81A2-8F9B88CFC73E}" = Super Hybrid Engine

"{89B48354-7F0E-EA42-ACDE-8BFA1AEC2114}" = CCC Help Japanese

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8AF7BEBB-0474-ED16-2E60-CE38B7E16D3E}" = CCC Help French

"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Ralink RT2860 Wireless LAN Card

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010

"{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety

"{99E77016-BCF2-48C8-9119-43ECF5815F65}" = AsusScreensaver

"{9BAB0084-8F54-CCC3-1CEA-AC5A303885BE}" = WMV9/VC-1 Video Playback

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A5257FB6-14AA-1759-C61C-3A30EFE0DA6B}" = CCC Help Korean

"{A8C1B99F-7F88-1B7C-8338-DB4F5A567A07}" = CCC Help Norwegian

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A9D6240D-5429-5988-EF3A-42528F4E9BFA}" = CCC Help Chinese Standard

"{ABBD4BA9-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro Titanium

"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch

"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{BEC93D7E-F18F-55D0-B4C4-C1928D39C05A}" = CCC Help Hungarian

"{C006FC2F-87C6-475D-68FF-5F815642A0F9}" = CCC Help Czech

"{C186E4BD-8232-30D6-E4B5-E1473CA52BA3}" = CCC Help Russian

"{C365387E-8522-A75E-3285-13F45EC71AA0}" = CCC Help Thai

"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail

"{C54467C6-7D42-5350-BDEB-7FE6761889D5}" = CCC Help Italian

"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support

"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars

"{D44AA979-47C2-4BC0-A860-09A54224EA44}_is1" = Game Park Console

"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2

"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer

"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10

"{EE7F2111-1D57-E2CF-9F29-E276FB96ACE0}" = CCC Help German

"{F06BA163-14BB-4977-080B-A7FC89192532}" = CCC Help Dutch

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3D2DEDC-4732-4188-8A3A-1A3FFBD4D6C8}" = ebi.BookReader3J

"{F49E63FC-4E83-E354-7199-B1DB08CC15A5}" = CCC Help English

"{F539B841-DF49-954D-ADE8-D9FB4EAD6E98}" = CCC Help Chinese Traditional

"{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}" = LocaleMe

"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials

"{FF401EA7-0185-E31F-96B3-2A00E14BDF94}" = CCC Help Polish

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"ASUS VIBE" = ASUS VIBE

"ASUS WebStorage" = ASUS WebStorage

"Avira AntiVir Desktop" = Avira Free Antivirus

"Eee Docking_is1" = Eee Docking 3.8.1

"Elantech" = ETDWare PS/2-x86 7.0.5.13_WHQL

"Free_Lunch_Design Toolbar" = Free_Lunch_Design Toolbar

"Google Chrome" = Google Chrome

"Icy Tower v1.4_is1" = Icy Tower v1.4

"InstallShield_{17780F99-A9DF-450B-81B3-6781B20A17A8}" = FontResizer

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Oceanis Change Background Windows 7_is1" = Oceanis Change Background Windows 7

"VLC media player" = VLC media player 1.0.3

"WinLiveSuite_Wave3" = Windows Live Essentials

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 02.04.2013 11:52:48 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 02.04.2013 11:52:51 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 10974249

 

Error - 02.04.2013 11:52:51 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 10974249

 

Error - 21.04.2013 13:13:21 | Computer Name = Lopi-PC | Source = Microsoft-Windows-Backup | ID = 517

Description = Fehler bei der um 2013-04-21T17:00:34.301706800Z gestarteten Sicherung.

 Fehlercode: "2147942413" (%%2147942413). Suchen Sie in den Ereignisdetails nach

 einer Lösung, und führen Sie die Sicherung erneut aus, nachdem das Problem behoben

 wurde.

 

Error - 22.04.2013 10:24:13 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common

 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei

 "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.

Der

 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs

 im assemblyIdentity-Element ist ungültig.

 

Error - 22.04.2013 10:25:04 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend

 micro\AMSP\temp\patch\PatchUI.exe".  Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 26.04.2013 11:38:38 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common

 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei

 "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.

Der

 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs

 im assemblyIdentity-Element ist ungültig.

 

Error - 26.04.2013 11:39:42 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend

 micro\AMSP\temp\patch\PatchUI.exe".  Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 28.04.2013 13:16:10 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 28.04.2013 13:16:11 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 3920414

 

Error - 28.04.2013 13:16:11 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 3920414

 

[ System Events ]

Error - 06.08.2011 15:53:50 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 09.08.2011 14:45:01 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 31.08.2011 15:02:14 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 18.09.2011 15:17:30 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 21.09.2011 08:20:06 | Computer Name = Lopi-PC | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 21.09.2011 08:20:06 | Computer Name = Lopi-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 21.09.2011 08:20:08 | Computer Name = Lopi-PC | Source = DCOM | ID = 10005

Description = 

 

Error - 29.09.2011 15:39:11 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 14.10.2011 09:50:04 | Computer Name = Lopi-PC | Source = Service Control Manager | ID = 7011

Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung

 von Dienst Wlansvc erreicht.

 

Error - 05.11.2011 12:51:40 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

 

< End of report >

Abschließend habe ich Gmer heruntergeladen und laufen lassen.

Code:

GMER 2.1.19163 - hxxp://www.gmer.net

Rootkit scan 2013-05-24 21:51:11

Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\00000058 WDC_WD25 rev.01.0 232,89GB

Running: gmer_2.1.19163.exe; Driver: C:\Users\Lopi\AppData\Local\Temp\kxldapod.sys
 
 

---- System - GMER 2.1 ----
 

SSDT            80583FBE                                                                                         ZwCreateSection

SSDT            80583FC8                                                                                         ZwRequestWaitReplyPort

SSDT            80583FC3                                                                                         ZwSetContextThread

SSDT            80583FCD                                                                                         ZwSetSecurityObject

SSDT            80583FD2                                                                                         ZwSystemDebugControl

SSDT            80583F5F                                                                                         ZwTerminateProcess
 

---- Kernel code sections - GMER 2.1 ----
 

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                         81E55A09 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                           81E8F1F2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                              81E9634C 4 Bytes  [BE, 3F, 58, 80]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                              81E966A8 4 Bytes  [C8, 3F, 58, 80] {ENTER 0x583f, 0x80}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                              81E966EC 4 Bytes  [C3, 3F, 58, 80]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                              81E96768 4 Bytes  [CD, 3F, 58, 80]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1668                                                              81E967BD 3 Bytes  [3F, 58, 80]

.text           ...                                                                                              

.text           C:\windows\system32\DRIVERS\atikmdag.sys                                                         section is writeable [0x9141B000, 0x331648, 0xE8000020]
 

---- Devices - GMER 2.1 ----
 

Device          \FileSystem\fastfat \Fat                                                                         9C170130
 

AttachedDevice  \FileSystem\fastfat \Fat                                                                         fltmgr.sys
 

---- Threads - GMER 2.1 ----
 

Thread          System [4:352]                                                                                   91373E28

Thread          System [4:360]                                                                                   9800B83C

Thread          System [4:364]                                                                                   98082BB8

Thread          System [4:1348]                                                                                  9C107F2E
 

---- Registry - GMER 2.1 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74f06dab8939                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\74f06dacd68d                      

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74f06dab8939 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\74f06dacd68d (not active ControlSet)  
 

---- EOF - GMER 2.1 ----

Ich wäre euch sehr dankbar, wenn ihr mir helfen könntet, wie ich jetzt weiter vorgehen muss.

mfg
pa_ma

Hallo,

ich habe Schritt 1 wie beschrieben ausgeführt. MBAR hat keine Funde angezeigt und deshalb auch keinen Neustart vorgeschlagen.

Code:

Malwarebytes Anti-Rootkit BETA 1.06.0.1003

www.malwarebytes.org
 

Database version: v2013.05.25.05
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 10.0.9200.16576

Lopi :: LOPI-PC [administrator]
 

25.05.2013 17:30:28

mbar-log-2013-05-25 (17-30-28).txt
 

Scan type: Quick scan

Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P

Scan options disabled: Deep Anti-Rootkit Scan | PUP

Objects scanned: 238993

Time elapsed: 25 minute(s), 9 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 0

(No malicious items detected)
 

Registry Values Detected: 0

(No malicious items detected)
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 0

(No malicious items detected)
 

Files Detected: 0

(No malicious items detected)
 

Physical Sectors Detected: 0

(No malicious items detected)
 

(end)

Der AdwCleaner hat dann einige Dateien entfernt.

AdwCleaner Logfile:

Code:

# AdwCleaner v2.301 - Datei am 25/05/2013 um 17:59:29 erstellt

# Aktualisiert am 16/05/2013 von Xplode

# Betriebssystem : Windows 7 Starter Service Pack 1 (32 bits)

# Benutzer : Lopi - LOPI-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Lopi\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Datei Gelöscht : C:\Users\Lopi\AppData\Roaming\Mozilla\Firefox\Profiles\0wp51ui5.default\searchplugins\Conduit.xml

Ordner Gelöscht : C:\Program Files\Conduit

Ordner Gelöscht : C:\Program Files\Free_Lunch_Design

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Lunch Design

Ordner Gelöscht : C:\Users\Lopi\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Lopi\AppData\LocalLow\Free_Lunch_Design

Ordner Gelöscht : C:\Users\Lopi\AppData\Roaming\Mozilla\Firefox\Profiles\0wp51ui5.default\CT1708250

Ordner Gelöscht : C:\Users\Lopi\AppData\Roaming\Mozilla\Firefox\Profiles\0wp51ui5.default\extensions\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Free_Lunch_Design

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD

Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\Software\Free_Lunch_Design

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\90C64EA18BA25EE488BF80DCF07F2FFD

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Free_Lunch_Design Toolbar

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}]
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v10.0.9200.16576
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Mozilla Firefox v21.0 (de)
 

Datei : C:\Users\Lopi\AppData\Roaming\Mozilla\Firefox\Profiles\0wp51ui5.default\prefs.js
 

Gelöscht : user_pref("CT1708250.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");

Gelöscht : user_pref("CT1708250.AllowNonPrivacy", true);

Gelöscht : user_pref("CT1708250.CTID", "CT1708250");

Gelöscht : user_pref("CT1708250.CommunitiesChangesLastCheckTime", "Fri May 24 2013 12:15:57 GMT+0200");

Gelöscht : user_pref("CT1708250.CommunityChanged", false);

Gelöscht : user_pref("CT1708250.DialogsAlignMode", "LTR");

Gelöscht : user_pref("CT1708250.DownloadDomainsCheckInterval", "168");

Gelöscht : user_pref("CT1708250.DownloadDomainsListLastCheckTime", "Fri May 24 2013 12:15:57 GMT+0200");

Gelöscht : user_pref("CT1708250.DownloadDomainsListLastServerUpdateTime", "1201069983");

Gelöscht : user_pref("CT1708250.EMailNotifierPollDate", "Fri May 24 2013 12:21:09 GMT+0200");

Gelöscht : user_pref("CT1708250.FirstTime", true);

Gelöscht : user_pref("CT1708250.FirstTimeFF3", true);

Gelöscht : user_pref("CT1708250.FixPageNotFoundErrors", true);

Gelöscht : user_pref("CT1708250.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");

Gelöscht : user_pref("CT1708250.Initialize", true);

Gelöscht : user_pref("CT1708250.InitializeCommonPrefs", true);

Gelöscht : user_pref("CT1708250.InvalidateCache", false);

Gelöscht : user_pref("CT1708250.IsGrouping", false);

Gelöscht : user_pref("CT1708250.IsMulticommunity", true);

Gelöscht : user_pref("CT1708250.IsOpenThankYouPage", true);

Gelöscht : user_pref("CT1708250.IsOpenUninstallPage", true);

Gelöscht : user_pref("CT1708250.LanguagePackLastCheckTime", "Fri May 24 2013 12:16:04 GMT+0200");

Gelöscht : user_pref("CT1708250.LanguagePackReloadIntervalMM", 1440);

Gelöscht : user_pref("CT1708250.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]

Gelöscht : user_pref("CT1708250.LastLogin", "Fri May 24 2013 12:15:59 GMT+0200");

Gelöscht : user_pref("CT1708250.Locale", "en-us");

Gelöscht : user_pref("CT1708250.LoginCache", "4");

Gelöscht : user_pref("CT1708250.MCDetectTooltipHeight", "83");

Gelöscht : user_pref("CT1708250.MCDetectTooltipShow", true);

Gelöscht : user_pref("CT1708250.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");

Gelöscht : user_pref("CT1708250.MCDetectTooltipWidth", "295");

Gelöscht : user_pref("CT1708250.RadioIsPodcast", false);

Gelöscht : user_pref("CT1708250.RadioLastCheckTime", "Fri May 24 2013 12:16:12 GMT+0200");

Gelöscht : user_pref("CT1708250.RadioLastUpdateIPServer", "3");

Gelöscht : user_pref("CT1708250.RadioLastUpdateServer", "128929877726170000");

Gelöscht : user_pref("CT1708250.RadioMediaID", "10082494");

Gelöscht : user_pref("CT1708250.RadioMediaType", "Media Player");

Gelöscht : user_pref("CT1708250.RadioMenuSelectedID", "EBRadioMenu_CT1708250_RECENT10082494");

Gelöscht : user_pref("CT1708250.RadioStationName", "Ultimate%20Oldies");

Gelöscht : user_pref("CT1708250.RadioStationURL", "hxxp://ultimateoldieschannel.com/listen.asx");

Gelöscht : user_pref("CT1708250.SHRINK_TOOLBAR", 1);

Gelöscht : user_pref("CT1708250.SearchFromAddressBarIsInit", true);

Gelöscht : user_pref("CT1708250.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT170[...]

Gelöscht : user_pref("CT1708250.Server", "hxxp://users.conduit.com");

Gelöscht : user_pref("CT1708250.SettingsInvalidateCache", false);

Gelöscht : user_pref("CT1708250.SettingsLastUpdate", "1368519173");

Gelöscht : user_pref("CT1708250.ThirdPartyComponentsInterval", "504");

Gelöscht : user_pref("CT1708250.ThirdPartyComponentsLastCheck", "Tue Mar 01 2011 18:27:53 GMT+0100");

Gelöscht : user_pref("CT1708250.ThirdPartyComponentsLastUpdate", "1246790578");

Gelöscht : user_pref("CT1708250.ToolbarAlignMode", "SYSTEM");

Gelöscht : user_pref("CT1708250.ToolbarName", "Free Lunch Design");

Gelöscht : user_pref("CT1708250.UserID", "UN41658948112012995");

Gelöscht : user_pref("CT1708250.VusualLastUpdateTime", "1369379186");

Gelöscht : user_pref("CT1708250.WeatherNetwork", "");

Gelöscht : user_pref("CT1708250.WeatherPollDate", "Fri May 24 2013 12:16:09 GMT+0200");

Gelöscht : user_pref("CT1708250.WeatherUnit", "C");

Gelöscht : user_pref("CT1708250.clientLogIsEnabled", false);

Gelöscht : user_pref("CT1708250.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]

Gelöscht : user_pref("CT1708250.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]

Gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.pr[...]

Gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT1708250");

Gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT1708250");

Gelöscht : user_pref("browser.search.defaultthis.engineName", "Free Lunch Design Customized Web Search");
 

-\\ Google Chrome v27.0.1453.94
 

Datei : C:\Users\Lopi\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[S1].txt - [8502 octets] - [25/05/2013 17:59:29]
 

########## EOF - C:\AdwCleaner[S1].txt - [8562 octets] ##########

--- --- ---

Und dann habe ich OTL noch einmal laufen lassen, diesmal mit den beschriebenen Einstellungen (da habe ich beim ersten Mal wohl etwas missverstanden...)

OTL Logfile:

Code:

OTL logfile created on: 25.05.2013 18:13:37 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lopi\Desktop

 Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

767,12 Mb Total Physical Memory | 184,48 Mb Available Physical Memory | 24,05% Memory free

1,75 Gb Paging File | 0,74 Gb Available in Paging File | 42,13% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 100,00 Gb Total Space | 50,06 Gb Free Space | 50,06% Space Free | Partition Type: NTFS

Drive D: | 117,87 Gb Total Space | 47,24 Gb Free Space | 40,08% Space Free | Partition Type: NTFS

 

Computer Name: LOPI-PC | User Name: Lopi | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Lopi\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Users\Lopi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (Microsoft Corporation.)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Windows\AsScrPro.exe (ASUS)

PRC - C:\Windows\System32\atieclxx.exe (AMD)

PRC - C:\Windows\System32\atiesrxx.exe (AMD)

PRC - C:\Program Files\EeePC\HotkeyService\HotkeyService.exe (ASUSTeK Computer Inc.)

PRC - C:\Program Files\Asus\LiveUpdate\LiveUpdate.exe (AsusTek Computer Inc.)

PRC - C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()

PRC - C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)

PRC - C:\Program Files\EeePC\SHE\SuperHybridEngine.exe (ASUSTeK Computer Inc.)

PRC - C:\Program Files\EeePC\CapsHook\CapsHook.exe (ASUS)

PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)

PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe (Broadcom Corporation.)

PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

PRC - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)

PRC - C:\Program Files\Elantech\ETDCtrlHelper.exe (ELAN Microelectronic Corp.)

PRC - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)

PRC - C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe (ASUSTeK Computer Inc.)

PRC - C:\Windows\System32\AsusService.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\30e3a21202000677d0a9270572251477\System.Windows.Forms.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\764f15e86c82662e977bd418bd6318c1\System.Configuration.ni.dll ()

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7366a39c36523a084bc11c230929ff92\Microsoft.VisualBasic.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5ecf01964c70e453d71e5d7653912ff9\System.Web.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\01c6cb58745f397c9b7ccf3ab7bfc9cd\System.EnterpriseServices.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\536d704e93ffec9b54e4a0312fb5b996\System.Transactions.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\5f1ed9259488bd5e34e4ff4bf2f01687\System.Data.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll ()

MOD - C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()

MOD - C:\Users\Lopi\AppData\Roaming\Dropbox\bin\libcef.dll ()

MOD - C:\Users\Lopi\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()

MOD - C:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()

MOD - C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - C:\windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll ()

MOD - C:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()

MOD - C:\windows\assembly\GAC_MSIL\SqliteShared\2.2.0.26258__0d0f4b69e50e559b\SqliteShared.dll ()

MOD - C:\windows\assembly\GAC_32\System.Data.SQLite\1.0.60.0__db937bc2d44ff139\System.Data.SQLite.dll ()

MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll ()

MOD - C:\PROGRA~1\ASUS\ASUSWE~1\2232~1.76\ASUSWS~1.DLL ()

MOD - C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()

MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()

MOD - C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll ()

MOD - C:\windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()

MOD - C:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()

MOD - C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll ()

 

 
 ========== Services (SafeList) ==========

 

SRV - (fsssvc) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe File not found

SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)

SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)

SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\SeaPort.exe (Microsoft Corporation.)

SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\7.1.391.0\BBSvc.exe (Microsoft Corporation.)

SRV - (AMD External Events Utility) -- C:\Windows\System32\atiesrxx.exe (AMD)

SRV - (btwdins) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)

SRV - (AsusService) -- C:\Windows\System32\AsusService.exe ()

SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)

DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)

DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (AtiHdmiService) -- C:\Windows\System32\drivers\AtiHdmi.sys (ATI Technologies, Inc.)

DRV - (AtiPcie) -- C:\Windows\System32\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)

DRV - (amdkmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - (amdkmdap) -- C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)

DRV - (L1C) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)

DRV - (AsUpIO) -- C:\Windows\System32\drivers\AsUpIO.sys ()

DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )

DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = 

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox

 

 

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 

 

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://eeepc.asus.com [binary data]

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://eeepc.asus.com/hxxp://www. [Binary data over 200 bytes]

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=MAAU&ocid=bb7hp

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\..\SearchScopes,DefaultScope = 

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Bing"

FF - prefs.js..browser.search.defaulturl: "hxxp://www.bing.com/search?FORM=ASUBDF&PC=MAAU&q="

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/"

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0

FF - prefs.js..extensions.enabledItems: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}:2.0.4.1

FF - prefs.js..keyword.URL: "hxxp://www.bing.com/search?FORM=ASUBDF&PC=MAAU&q="

FF - user.js - File not found

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.24 13:32:00 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.05.24 13:32:00 | 000,000,000 | ---D | M]

 

[2010.12.27 19:30:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lopi\AppData\Roaming\mozilla\Extensions

[2013.05.25 17:59:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lopi\AppData\Roaming\mozilla\Firefox\Profiles\0wp51ui5.default\extensions

[2012.05.13 12:23:52 | 000,001,840 | ---- | M] () -- C:\Users\Lopi\AppData\Roaming\mozilla\firefox\profiles\0wp51ui5.default\searchplugins\bing.xml

[2013.05.24 12:29:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions

[2011.02.05 22:27:31 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2013.05.24 12:29:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\browser\extensions

[2013.05.24 12:29:47 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

 
 ========== Chrome  ==========

 

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}

CHR - homepage: hxxp://www.google.com/

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\26.0.1410.64\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

 

O1 HOSTS File: ([2011.02.09 21:46:41 | 000,000,822 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O2 - BHO: (Windows 7 Starter Helper) - {D381FF29-7CFB-4D4E-B92A-C4EDDC696614} - C:\Program Files\Oceanis\SystemSetting\StarterHelper.dll (Oceanis)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O3 - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS)

O4 - HKLM..\Run: [ASUSPRP] C:\Program Files\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files\ASUS\ASUS WebStorage\2.2.32.76\ASUSWSDashBoard.exe (eCareme)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CapsHook] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [Eee Docking] C:\Program Files\ASUS\Eee Docking\Eee Docking.exe ()

O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)

O4 - HKLM..\Run: [GraphicsSwitch] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [HotkeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [LiveUpdate] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)

O4 - HKU\S-1-5-21-2115726665-806344416-4148187384-1000..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background File not found

O4 - HKU\.DEFAULT..\RunOnce: [SPReview] C:\windows\System32\SPReview\SPReview.exe (Microsoft Corporation)

O4 - HKU\S-1-5-18..\RunOnce: [SPReview] C:\windows\System32\SPReview\SPReview.exe (Microsoft Corporation)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Lopi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Lopi\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

O4 - Startup: C:\Users\Lopi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\S-1-5-21-2115726665-806344416-4148187384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll File not found

O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll File not found

O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F71BD069-DDE1-4DF2-A57C-ADDF49C6A4D3}: DhcpNameServer = 10.0.0.138

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL File not found

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL File not found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKU\S-1-5-21-2115726665-806344416-4148187384-1000 Winlogon: Shell - (C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe) - C:\Program Files\Oceanis\SystemSetting\WallPaperAgent.exe (Oceanis)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.25 17:30:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

[2013.05.25 17:27:44 | 000,000,000 | ---D | C] -- C:\Users\Lopi\Desktop\mbar-1.06.0.1003

[2013.05.25 09:26:58 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TsUsbRedirectionGroupPolicyControl.exe

[2013.05.25 09:26:57 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\rdpvideominiport.sys

[2013.05.25 09:26:55 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TsUsbRedirectionGroupPolicyExtension.dll

[2013.05.25 09:26:55 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\RdpGroupPolicyExtension.dll

[2013.05.25 09:26:49 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\TsUsbFlt.sys

[2013.05.25 09:26:43 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tsgqec.dll

[2013.05.25 09:26:43 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wksprtPS.dll

[2013.05.25 09:26:42 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\aaclient.dll

[2013.05.25 09:26:42 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MsRdpWebAccess.dll

[2013.05.25 09:26:42 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TsUsbGDCoInstaller.dll

[2013.05.25 09:26:41 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\TSWbPrxy.exe

[2013.05.25 09:26:40 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpudd.dll

[2013.05.25 09:26:40 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpendp_winip.dll

[2013.05.25 09:26:39 | 000,317,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wksprt.exe

[2013.05.25 09:26:38 | 002,739,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpcorets.dll

[2013.05.25 09:23:54 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qdvd.dll

[2013.05.24 19:27:06 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Lopi\Desktop\OTL.exe

[2013.05.24 18:01:08 | 000,238,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MpSigStub.exe

[2013.05.24 17:26:34 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Roaming\Malwarebytes

[2013.05.24 17:26:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2013.05.24 17:26:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2013.05.24 17:26:12 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2013.05.24 17:26:12 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2013.05.24 17:25:46 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Local\Programs

[2013.05.24 14:17:27 | 000,066,656 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avnetflt.sys

[2013.05.24 14:03:53 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Roaming\Avira

[2013.05.24 13:57:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

[2013.05.24 13:57:18 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys

[2013.05.24 13:57:16 | 000,135,136 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avipbb.sys

[2013.05.24 13:57:16 | 000,084,744 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avgntflt.sys

[2013.05.24 13:57:16 | 000,037,352 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avkmgr.sys

[2013.05.24 13:57:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2013.05.24 13:57:13 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2013.05.24 13:31:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

[2013.05.24 13:26:54 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update

[2013.05.24 13:20:58 | 000,000,000 | ---D | C] -- C:\Users\Lopi\AppData\Local\Macromedia

[2013.05.24 13:18:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe

[2013.05.24 13:13:11 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2013.05.24 13:12:25 | 000,866,720 | ---- | C] (Oracle Corporation) -- C:\windows\System32\npDeployJava1.dll

[2013.05.24 13:12:25 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\windows\System32\javaws.exe

[2013.05.24 13:11:26 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\windows\System32\javaw.exe

[2013.05.24 13:11:26 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\windows\System32\java.exe

[2013.05.24 13:11:26 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\windows\System32\WindowsAccessBridge.dll

[2013.05.24 13:08:15 | 000,692,104 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe

[2013.05.24 12:45:55 | 002,706,432 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb

[2013.05.24 12:45:53 | 002,877,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript9.dll

[2013.05.24 12:45:53 | 000,039,424 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll

[2013.05.24 12:45:52 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll

[2013.05.24 12:45:52 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iesetup.dll

[2013.05.24 12:45:51 | 000,493,056 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeeds.dll

[2013.05.24 12:45:51 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\RegisterIEPKEYs.exe

[2013.05.24 12:45:51 | 000,042,496 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ie4uinit.exe

[2013.05.24 12:45:51 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iernonce.dll

[2013.05.24 12:45:50 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iesysprep.dll

[2013.05.24 12:30:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla

[2013.05.24 12:30:03 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service

[2013.05.24 12:15:24 | 002,347,520 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys

[2013.05.24 12:14:41 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wwanprotdim.dll

[2013.05.21 11:59:24 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\authui.dll

[2013.05.21 11:59:24 | 000,101,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\consent.exe

[2013.05.21 11:57:33 | 000,218,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\dxgmms1.sys

[2013.05.14 14:13:44 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee

[2013.05.04 16:42:50 | 000,745,472 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MsSpellCheckingFacility.exe

[2013.05.04 16:42:50 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\elshyph.dll

[2013.05.04 16:42:50 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msrating.dll

[2013.05.04 16:42:50 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msls31.dll

[2013.05.04 16:42:50 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iexpress.exe

[2013.05.04 16:42:50 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wextract.exe

[2013.05.04 16:42:50 | 000,137,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe

[2013.05.04 16:42:50 | 000,117,248 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iepeers.dll

[2013.05.04 16:42:50 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\IEAdvpack.dll

[2013.05.04 16:42:50 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inseng.dll

[2013.05.04 16:42:50 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\SetIEInstalledDate.exe

[2013.05.04 16:42:50 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\pngfilt.dll

[2013.05.04 16:42:50 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedsbs.dll

[2013.05.04 16:42:50 | 000,038,400 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\imgutil.dll

[2013.05.04 16:42:50 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeedssync.exe

[2013.05.04 16:42:49 | 001,441,280 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl

[2013.05.04 16:42:49 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieapfltr.dat

[2013.05.04 16:42:49 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtmlmedia.dll

[2013.05.04 16:42:49 | 000,629,248 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieapfltr.dll

[2013.05.04 16:42:49 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\html.iec

[2013.05.04 16:42:49 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dxtmsft.dll

[2013.05.04 16:42:49 | 000,242,200 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\iedkcs32.dll

[2013.05.04 16:42:49 | 000,232,960 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\url.dll

[2013.05.04 16:42:49 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dxtrans.dll

[2013.05.04 16:42:49 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtmler.dll

[2013.05.04 16:42:49 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\licmgr10.dll

[2013.05.04 16:40:14 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msmpeg2vdec.dll

[2013.05.04 16:40:14 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3d11.dll

[2013.05.04 16:40:14 | 001,247,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\DWrite.dll

[2013.05.04 16:40:14 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XpsPrint.dll

[2013.05.04 16:40:14 | 001,080,832 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3d10.dll

[2013.05.04 16:40:14 | 000,604,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3d10level9.dll

[2013.05.04 16:40:14 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\WMPhoto.dll

[2013.05.04 16:40:14 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XpsGdiConverter.dll

[2013.05.04 16:40:14 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3d10_1core.dll

[2013.05.04 16:40:14 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3d10core.dll

[2013.05.04 16:40:14 | 000,207,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\WindowsCodecsExt.dll

[2013.05.04 16:40:14 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3d10_1.dll

[2013.05.04 16:40:14 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.05.04 16:40:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.05.04 16:40:14 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.05.04 16:40:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

[2013.05.04 16:40:14 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.05.04 16:40:13 | 003,419,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d2d1.dll

[2013.05.04 16:40:13 | 001,988,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3d10warp.dll

[2013.05.04 16:40:13 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dxgi.dll

[2013.05.04 16:40:13 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\UIAnimation.dll

[2013.05.01 03:59:12 | 000,094,208 | ---- | C] (Apple Inc.) -- C:\windows\System32\QuickTimeVR.qtx

[2013.05.01 03:59:12 | 000,069,632 | ---- | C] (Apple Inc.) -- C:\windows\System32\QuickTime.qts

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.25 18:11:23 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.25 18:11:22 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.25 18:09:17 | 000,001,847 | ---- | M] () -- C:\Users\Lopi\Desktop\MySyncFolder.lnk

[2013.05.25 18:06:37 | 000,001,090 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2013.05.25 18:02:57 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2013.05.25 18:02:35 | 603,283,456 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.25 17:58:47 | 000,632,031 | ---- | M] () -- C:\Users\Lopi\Desktop\adwcleaner.exe

[2013.05.25 17:58:01 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job

[2013.05.25 17:39:13 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2013.05.25 17:26:15 | 013,169,742 | ---- | M] () -- C:\Users\Lopi\Desktop\mbar-1.06.0.1003.zip

[2013.05.24 20:31:17 | 000,283,440 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

[2013.05.24 20:19:50 | 000,377,856 | ---- | M] () -- C:\Users\Lopi\Desktop\gmer_2.1.19163.exe

[2013.05.24 19:27:47 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lopi\Desktop\OTL.exe

[2013.05.24 19:22:36 | 000,000,000 | ---- | M] () -- C:\Users\Lopi\defogger_reenable

[2013.05.24 14:17:20 | 000,066,656 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\avnetflt.sys

[2013.05.24 14:00:27 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe

[2013.05.24 14:00:27 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerCPLApp.cpl

[2013.05.24 13:57:41 | 000,002,012 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2013.05.24 13:55:15 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avipbb.sys

[2013.05.24 13:55:15 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avgntflt.sys

[2013.05.24 13:55:15 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\windows\System32\drivers\avkmgr.sys

[2013.05.24 13:55:15 | 000,028,520 | ---- | M] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys

[2013.05.24 13:19:55 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.24 13:11:05 | 000,094,112 | ---- | M] (Oracle Corporation) -- C:\windows\System32\WindowsAccessBridge.dll

[2013.05.24 13:11:01 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\windows\System32\javaws.exe

[2013.05.24 13:11:01 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\windows\System32\javaw.exe

[2013.05.24 13:11:00 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\windows\System32\npDeployJava1.dll

[2013.05.24 13:11:00 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\windows\System32\deployJava1.dll

[2013.05.24 13:11:00 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\windows\System32\java.exe

[2013.05.24 12:42:08 | 000,002,129 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk

[2013.05.24 12:40:06 | 000,654,166 | ---- | M] () -- C:\windows\System32\perfh007.dat

[2013.05.24 12:40:06 | 000,299,718 | ---- | M] () -- C:\windows\System32\perfh009.dat

[2013.05.24 12:40:06 | 000,130,006 | ---- | M] () -- C:\windows\System32\perfc007.dat

[2013.05.24 12:40:06 | 000,037,582 | ---- | M] () -- C:\windows\System32\perfc009.dat

[2013.05.24 12:30:16 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2013.05.24 12:28:50 | 000,001,010 | ---- | M] () -- C:\Users\Lopi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

[2013.05.24 12:24:43 | 000,000,976 | ---- | M] () -- C:\Users\Lopi\Desktop\Dropbox.lnk

[2013.05.13 21:49:37 | 000,057,891 | ---- | M] () -- C:\Users\Lopi\Documents\woman churchs history.odt

[2013.05.04 16:42:50 | 000,745,472 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\MsSpellCheckingFacility.exe

[2013.05.04 16:42:50 | 000,185,344 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\elshyph.dll

[2013.05.04 16:42:50 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\msrating.dll

[2013.05.04 16:42:50 | 000,158,720 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\msls31.dll

[2013.05.04 16:42:50 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\iexpress.exe

[2013.05.04 16:42:50 | 000,138,752 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\wextract.exe

[2013.05.04 16:42:50 | 000,137,216 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe

[2013.05.04 16:42:50 | 000,117,248 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\iepeers.dll

[2013.05.04 16:42:50 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\IEAdvpack.dll

[2013.05.04 16:42:50 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\inseng.dll

[2013.05.04 16:42:50 | 000,073,728 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\SetIEInstalledDate.exe

[2013.05.04 16:42:50 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\pngfilt.dll

[2013.05.04 16:42:50 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\msfeedsbs.dll

[2013.05.04 16:42:50 | 000,038,400 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\imgutil.dll

[2013.05.04 16:42:50 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\msfeedssync.exe

[2013.05.04 16:42:49 | 001,441,280 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl

[2013.05.04 16:42:49 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\ieapfltr.dat

[2013.05.04 16:42:49 | 000,719,360 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\mshtmlmedia.dll

[2013.05.04 16:42:49 | 000,629,248 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\ieapfltr.dll

[2013.05.04 16:42:49 | 000,361,984 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\html.iec

[2013.05.04 16:42:49 | 000,357,888 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\dxtmsft.dll

[2013.05.04 16:42:49 | 000,242,200 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\iedkcs32.dll

[2013.05.04 16:42:49 | 000,232,960 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\url.dll

[2013.05.04 16:42:49 | 000,226,816 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\dxtrans.dll

[2013.05.04 16:42:49 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\mshtmler.dll

[2013.05.04 16:42:49 | 000,025,185 | ---- | M] () -- C:\windows\System32\ieuinit.inf

[2013.05.04 16:42:49 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\licmgr10.dll

[2013.05.04 16:40:14 | 003,419,136 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d2d1.dll

[2013.05.04 16:40:14 | 002,284,544 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\msmpeg2vdec.dll

[2013.05.04 16:40:14 | 001,504,768 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d3d11.dll

[2013.05.04 16:40:14 | 001,247,744 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\DWrite.dll

[2013.05.04 16:40:14 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\XpsPrint.dll

[2013.05.04 16:40:14 | 001,080,832 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d3d10.dll

[2013.05.04 16:40:14 | 000,604,160 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d3d10level9.dll

[2013.05.04 16:40:14 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\WMPhoto.dll

[2013.05.04 16:40:14 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\XpsGdiConverter.dll

[2013.05.04 16:40:14 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d3d10_1core.dll

[2013.05.04 16:40:14 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d3d10core.dll

[2013.05.04 16:40:14 | 000,207,872 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\WindowsCodecsExt.dll

[2013.05.04 16:40:14 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d3d10_1.dll

[2013.05.04 16:40:14 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

[2013.05.04 16:40:14 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

[2013.05.04 16:40:14 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll

[2013.05.04 16:40:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

[2013.05.04 16:40:14 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll

[2013.05.04 16:40:14 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

[2013.05.04 16:40:13 | 001,988,096 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\d3d10warp.dll

[2013.05.04 16:40:13 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\dxgi.dll

[2013.05.04 16:40:13 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\UIAnimation.dll

[2013.05.02 02:06:08 | 000,238,872 | ---- | M] (Microsoft Corporation) -- C:\windows\System32\MpSigStub.exe

[2013.05.01 03:59:12 | 000,094,208 | ---- | M] (Apple Inc.) -- C:\windows\System32\QuickTimeVR.qtx

[2013.05.01 03:59:12 | 000,069,632 | ---- | M] (Apple Inc.) -- C:\windows\System32\QuickTime.qts

[2013.04.26 19:24:03 | 000,531,700 | ---- | M] () -- C:\Users\Lopi\Documents\Irisches Segenslied.odt

 
 ========== Files Created - No Company Name ==========

 

[2013.05.25 17:58:27 | 000,632,031 | ---- | C] () -- C:\Users\Lopi\Desktop\adwcleaner.exe

[2013.05.25 17:25:44 | 013,169,742 | ---- | C] () -- C:\Users\Lopi\Desktop\mbar-1.06.0.1003.zip

[2013.05.24 20:19:39 | 000,377,856 | ---- | C] () -- C:\Users\Lopi\Desktop\gmer_2.1.19163.exe

[2013.05.24 19:22:36 | 000,000,000 | ---- | C] () -- C:\Users\Lopi\defogger_reenable

[2013.05.24 13:57:41 | 000,002,012 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk

[2013.05.24 13:19:55 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk

[2013.05.24 13:19:54 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

[2013.05.24 13:08:33 | 000,000,884 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job

[2013.05.24 12:30:16 | 000,001,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2013.05.13 21:49:34 | 000,057,891 | ---- | C] () -- C:\Users\Lopi\Documents\woman churchs history.odt

[2013.05.04 16:42:49 | 000,025,185 | ---- | C] () -- C:\windows\System32\ieuinit.inf

[2013.04.26 18:55:59 | 000,531,700 | ---- | C] () -- C:\Users\Lopi\Documents\Irisches Segenslied.odt

[2013.04.17 19:09:37 | 040,305,924 | ---- | C] () -- C:\Users\Lopi\Präsentation.odp

[2012.12.19 10:48:14 | 000,022,591 | ---- | C] () -- C:\Users\Lopi\Pädagogische Orientierung.sxw

[2011.02.05 22:49:33 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2011.01.11 16:16:01 | 000,027,623 | ---- | C] () -- C:\Users\Lopi\AppData\Roaming\UserTile.png

[2010.12.28 18:13:11 | 000,006,144 | ---- | C] () -- C:\Users\Lopi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.09.01 22:32:15 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 
 ========== Files - Unicode (All) ==========

[2010.12.27 18:45:45 | 000,000,059 | ---- | M] ()(C:\windows\System32\??) -- C:\windows\System32\ʡ

[2010.12.27 18:45:45 | 000,000,059 | ---- | C] ()(C:\windows\System32\??) -- C:\windows\System32\ʡ
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 25.05.2013 18:13:37 - Run 2

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lopi\Desktop

 Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16576)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

767,12 Mb Total Physical Memory | 184,48 Mb Available Physical Memory | 24,05% Memory free

1,75 Gb Paging File | 0,74 Gb Available in Paging File | 42,13% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 100,00 Gb Total Space | 50,06 Gb Free Space | 50,06% Space Free | Partition Type: NTFS

Drive D: | 117,87 Gb Total Space | 47,24 Gb Free Space | 40,08% Space Free | Partition Type: NTFS

 

Computer Name: LOPI-PC | User Name: Lopi | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

 

[HKEY_USERS\S-1-5-21-2115726665-806344416-4148187384-1000\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"

http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{4418ADA9-4C10-40E3-9FAC-D30EFDE3C6C4}" = lport=8182 | protocol=6 | dir=in | name=java(tm) platform se binary | 

"{6BED87B6-7640-45E7-9989-313EEA960EBB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

"{AB1CE0D2-A694-4E53-93A0-982E93350642}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{FC814DFC-899D-4F94-BBE4-896B28022593}" = lport=5353 | protocol=17 | dir=in | name=java(tm) platform se binary | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{2AEF72F3-2B3C-4232-B0CF-ADB463C62641}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{2B2BD4FA-DAD3-45A1-8B95-EAE04EA5584C}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 

"{2E977E36-A016-4C9B-B45E-06DF0ABA91B6}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 

"{62F73A88-7854-424C-BAEA-8ED9552CBBDE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{658641BF-F689-47D9-B965-2D27A66B9846}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 

"{70FFE384-997B-4D9E-8CB9-E61BCEC14888}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{85962DAC-BD3E-4533-8BE4-ECB963AA14C1}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 

"{A88651BD-EA56-4F5C-B297-3E57CF245A37}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"{E9ACA455-9903-4453-A751-F4B28DF9F541}" = protocol=17 | dir=in | app=c:\users\lopi\appdata\roaming\dropbox\bin\dropbox.exe | 

"{F00FBF10-9484-427B-803F-02C80E72D4A9}" = protocol=6 | dir=in | app=c:\users\lopi\appdata\roaming\dropbox\bin\dropbox.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{08D0A290-E98B-62B5-A423-CAF77EF910F4}" = CCC Help Finnish

"{10BDB7F2-3760-49CC-3F02-4E10DC9C9D84}" = Catalyst Control Center Graphics Previews Vista

"{15787831-3BEE-3F24-CF5D-86A297C2BE34}" = Catalyst Control Center InstallProxy

"{17780F99-A9DF-450B-81B3-6781B20A17A8}" = FontResizer

"{185AFA7A-F63E-450B-94AA-011CAC18090E}" = E-Cam

"{18D33A7B-5EB5-64A9-6759-2D7EC4D085D0}" = ATI Catalyst Install Manager

"{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}" = Bing Bar

"{1B343C8C-F170-4829-8481-E163317C5830}" = iTunes

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool

"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT

"{25D1FAA5-89E4-55A8-FABA-671E9B7C1BAF}" = Catalyst Control Center Localization All

"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21

"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program

"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com

"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour

"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie

"{2CA34767-F6D1-B207-2B61-0BC0F71888BA}" = CCC Help Swedish

"{300A98D6-8DA2-45FF-9314-A6861D76A535}" = syncables desktop SE

"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver

"{321F3B6B-3736-C9BF-5273-BE3779059661}" = CCC Help Spanish

"{38E5A3B1-ADF1-47E0-8024-76310A30EB36}" = LiveUpdate

"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger

"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4B5092B6-F231-4D18-83BC-2618B729CA45}" = CapsHook

"{4E9BB299-32C5-F701-F2F2-251903A6286A}" = CCC Help Danish

"{4FCBCF89-1823-4D97-A6F2-0E8DD66E273A}" = Broadcom Wireless Network Adapter

"{50D570C5-9227-8756-06CE-1A69740ECF82}" = CCC Help Turkish

"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent

"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC

"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support

"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call

"{65F69FE7-D0A0-9B54-1166-61697BC89701}" = ccc-core-static

"{6A193E0C-113E-ACE1-57E9-2CB4B7315AEB}" = CCC Help Greek

"{6AD81B3D-7411-5A4D-4312-072A0D33CAE9}" = ccc-utility

"{6F9375BA-521F-253A-F24D-F9332F2C4E9A}" = CCC Help Portuguese

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{71C0E38E-09F2-4386-9977-404D4F6640CD}" = Hotkey Service

"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{81601299-AD02-403C-9A47-93C509FE2EC2}" = Catalyst Control Center - Branding

"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}" = Chicken Invaders 2

"{859D40CF-8491-44AD-8FA8-7389CB418C64}" = 32 Bit HP CIO Components Installer

"{88F08F98-12BC-4613-81A2-8F9B88CFC73E}" = Super Hybrid Engine

"{89B48354-7F0E-EA42-ACDE-8BFA1AEC2114}" = CCC Help Japanese

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)

"{8AF7BEBB-0474-ED16-2E60-CE38B7E16D3E}" = CCC Help French

"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Ralink RT2860 Wireless LAN Card

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010

"{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety

"{99E77016-BCF2-48C8-9119-43ECF5815F65}" = AsusScreensaver

"{9BAB0084-8F54-CCC3-1CEA-AC5A303885BE}" = WMV9/VC-1 Video Playback

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A5257FB6-14AA-1759-C61C-3A30EFE0DA6B}" = CCC Help Korean

"{A8C1B99F-7F88-1B7C-8338-DB4F5A567A07}" = CCC Help Norwegian

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{A9D6240D-5429-5988-EF3A-42528F4E9BFA}" = CCC Help Chinese Standard

"{ABBD4BA9-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro Titanium

"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch

"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime

"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)

"{BEC93D7E-F18F-55D0-B4C4-C1928D39C05A}" = CCC Help Hungarian

"{C006FC2F-87C6-475D-68FF-5F815642A0F9}" = CCC Help Czech

"{C186E4BD-8232-30D6-E4B5-E1473CA52BA3}" = CCC Help Russian

"{C365387E-8522-A75E-3285-13F45EC71AA0}" = CCC Help Thai

"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail

"{C54467C6-7D42-5350-BDEB-7FE6761889D5}" = CCC Help Italian

"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support

"{D44AA979-47C2-4BC0-A860-09A54224EA44}_is1" = Game Park Console

"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2

"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer

"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update

"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10

"{EE7F2111-1D57-E2CF-9F29-E276FB96ACE0}" = CCC Help German

"{F06BA163-14BB-4977-080B-A7FC89192532}" = CCC Help Dutch

"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F3D2DEDC-4732-4188-8A3A-1A3FFBD4D6C8}" = ebi.BookReader3J

"{F49E63FC-4E83-E354-7199-B1DB08CC15A5}" = CCC Help English

"{F539B841-DF49-954D-ADE8-D9FB4EAD6E98}" = CCC Help Chinese Traditional

"{F58C1D44-4AC9-48E8-9049-7A6CDFCB415C}" = LocaleMe

"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials

"{FF401EA7-0185-E31F-96B3-2A00E14BDF94}" = CCC Help Polish

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"ASUS VIBE" = ASUS VIBE

"ASUS WebStorage" = ASUS WebStorage

"Avira AntiVir Desktop" = Avira Free Antivirus

"Eee Docking_is1" = Eee Docking 3.8.1

"Elantech" = ETDWare PS/2-x86 7.0.5.15_WHQL

"Google Chrome" = Google Chrome

"Icy Tower v1.4_is1" = Icy Tower v1.4

"InstallShield_{17780F99-A9DF-450B-81B3-6781B20A17A8}" = FontResizer

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"Oceanis Change Background Windows 7_is1" = Oceanis Change Background Windows 7

"VLC media player" = VLC media player 1.0.3

"WinLiveSuite_Wave3" = Windows Live Essentials

 
 ========== HKEY_USERS Uninstall List ==========

 

[HKEY_USERS\S-1-5-21-2115726665-806344416-4148187384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

 
 ========== Last 20 Event Log Errors ==========

 

[ Application Events ]

Error - 02.04.2013 11:52:48 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 02.04.2013 11:52:51 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 10974249

 

Error - 02.04.2013 11:52:51 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 10974249

 

Error - 21.04.2013 13:13:21 | Computer Name = Lopi-PC | Source = Microsoft-Windows-Backup | ID = 517

Description = Fehler bei der um 2013-04-21T17:00:34.301706800Z gestarteten Sicherung.

 Fehlercode: "2147942413" (%%2147942413). Suchen Sie in den Ereignisdetails nach

 einer Lösung, und führen Sie die Sicherung erneut aus, nachdem das Problem behoben

 wurde.

 

Error - 22.04.2013 10:24:13 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common

 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei

 "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.

Der

 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs

 im assemblyIdentity-Element ist ungültig.

 

Error - 22.04.2013 10:25:04 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend

 micro\AMSP\temp\patch\PatchUI.exe".  Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 26.04.2013 11:38:38 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Common

 Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder Richtliniendatei

 "C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" in Zeile 3.

Der

 Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs

 im assemblyIdentity-Element ist ungültig.

 

Error - 26.04.2013 11:39:42 | Computer Name = Lopi-PC | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\trend

 micro\AMSP\temp\patch\PatchUI.exe".  Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 28.04.2013 13:16:10 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: Continuously busy for more than a second

 

Error - 28.04.2013 13:16:11 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledEvent 3920414

 

Error - 28.04.2013 13:16:11 | Computer Name = Lopi-PC | Source = Bonjour Service | ID = 100

Description = Task Scheduling Error: m->NextScheduledSPRetry 3920414

 

[ System Events ]

Error - 06.08.2011 15:53:50 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 09.08.2011 14:45:01 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 31.08.2011 15:02:14 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 18.09.2011 15:17:30 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 21.09.2011 08:20:06 | Computer Name = Lopi-PC | Source = Service Control Manager | ID = 7009

Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst

 Windows Search erreicht.

 

Error - 21.09.2011 08:20:06 | Computer Name = Lopi-PC | Source = Service Control Manager | ID = 7000

Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht

 gestartet:   %%1053

 

Error - 21.09.2011 08:20:08 | Computer Name = Lopi-PC | Source = DCOM | ID = 10005

Description = 

 

Error - 29.09.2011 15:39:11 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

Error - 14.10.2011 09:50:04 | Computer Name = Lopi-PC | Source = Service Control Manager | ID = 7011

Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung

 von Dienst Wlansvc erreicht.

 

Error - 05.11.2011 12:51:40 | Computer Name = Lopi-PC | Source = DCOM | ID = 10010

Description = 

 

 

< End of report >

--- --- ---