[blackmoon00]

Hi,

vielleicht könnte Ihr mir weiterhelfen, habe folgendes Problem mit dem Firefox 10.0.2. Seit heute leitet mich die Google.de - Suche auf die Seite "protectedsearch.com" um? Verstehe die Welt nicht mehr, habe nun manuell eingegriffen und auf google.de die Suche wieder umgestellt. Nach einem Neustart erscheint aber wieder die Seite "protectedsearch.com". Könnte es sich hier um einen Trojaner oder Virus handeln?, auf dem Rechner wurde seit 3 Wochen nichts mehr installiert, könnte wenn lediglich mit den e-Mails eingefolgen sein. Wenn ja wie werde ich den wieder los.

Danke für eure Hilfe.

Gruß

blackmoon00

[thecrack]

hab dasselbe problem, bei mir will er immer auf eine seite namens "www.abnow.com"

[ckjthedogmaster]

Lasst Malwarebytes im aktuellen Stand drüber laufen.

Weiter postet im Spoiler ein Log von hijackthis.


mfg

[DerRambo]

"protectedsearch" ist einer der etwas hartnäckigeren "Umleitungs"-Trojaner aber durch ein einfaches Prozedere zu entfernen.

Wenn ich mich nicht irre, wirst du einen fragwürdigen Eintrag in "C:\Windows\System32\mctadmin.exe" haben.

"mctadmin.exe" ist bekannt in solchen Sachen. Aber wie mein Vorredner schon sagte AUFJEDENFALL Hijackthis Logfile erstellen und davor Malwarebytes durchlaufen lassen

Zusätzlich kannst du dir noch OTL ziehen und die Logfile hier posten falls das Problem weiterhin besteht

[blackmoon00]

Hi,

Malewarebyte als auch alle anderen gängigen Maleware Tools haben nichts gebracht. Werde nun mal die Logfiles auswerten.

Vielen Dank für Eure Rückmeldung.

Gruß

Blackmoon00

[ckjthedogmaster]

Dann wie DerRambo schon sagt, mach mit OTL ein Scan und poste hier die Logfiles:

Die Einstellung biite aus dieser Anleitung übernehmen:

[ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]

Mfg

[blackmoon00]

Hi,

so jetzt habe ich noch herausgefunden, dass der Firefox nicht abspringt wenn man google.de als Seite hat, sondern lediglich bei der orginal Startseite des Firefox.

Die zwei Logdateien findet ihr hier:

OTL-txt Datei

OTL logfile created on: 09.03.2012 13:52:15 - Run 1
OTL by OldTimer - Version 3.2.36.2 Folder = C:\Users\*******\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

15,99 Gb Total Physical Memory | 12,49 Gb Available Physical Memory | 78,08% Memory free
31,98 Gb Paging File | 27,92 Gb Available in Paging File | 87,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,76 Gb Total Space | 312,24 Gb Free Space | 67,04% Space Free | Partition Type: NTFS
Drive D: | 931,50 Gb Total Space | 480,18 Gb Free Space | 51,55% Space Free | Partition Type: NTFS
Drive U: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS
Drive V: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS
Drive W: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS
Drive X: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS
Drive Y: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS
Drive Z: | 1829,34 Gb Total Space | 1797,65 Gb Free Space | 98,27% Space Free | Partition Type: NTFS

Computer Name: ******* | User Name: ******* | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - File not found
PRC - C:\Users\*******\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe (SPAMfighter ApS)
PRC - C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
PRC - C:\Program Files (x86)\Fighters\Tray\FightersTray.exe (SPAMfighter ApS)
PRC - C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe (Paessler AG)
PRC - C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe (Paessler AG)
PRC - C:\Program Files (x86)\Fighters\FighterSuiteService.exe (SPAMfighter ApS)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe ()
PRC - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG)
PRC - C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
PRC - C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG)
PRC - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe (ACD Systems)
PRC - C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
PRC - C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT)
PRC - C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe (Gladinet, INC)
PRC - C:\Program Files (x86)\G DATA\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
PRC - C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKService.exe (G Data Software AG)
PRC - C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe ()
PRC - C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG)
PRC - C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe ()
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\ASUS\EPU-6 Engine\SixEngine.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe ()
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlServi ce.exe ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Fighters\SPAMfighter\sfse.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9 \System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\Syste m.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll ()
MOD - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\msc orlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni .dll ()
MOD - C:\Program Files (x86)\Fighters\SPAMfighter\sfsg.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\WinClientShellExtensi onContextMenu\1.0.0.27__9fb6a8250b54c137\WinClient ShellExtensionContextMenu.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\ClientExecuteUtils\1. 0.0.5__0364d91cd0218e60\ClientExecuteUtils.dll ()
MOD - C:\Windows\SysWOW64\AsIO.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-6 Engine\pngio.dll ()
MOD - C:\Program Files (x86)\ASUS\EPU-6 Engine\AsSpindownTimeout.dll ()
MOD - C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe ()
MOD - C:\Program Files (x86)\ASUS\EPU-6 Engine\AsusService.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WDRulesService) -- C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe (Western Digital )
SRV:64bit: - (WDFMEService) -- C:\Program Files\Western Digital\WD SmartWare\WDFME.exe (Western Digital )
SRV:64bit: - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe (WDC)
SRV:64bit: - (OODefragAgent) -- C:\Program Files\OO Software\Defrag\oodag.exe (O&O Software GmbH)
SRV:64bit: - (FLEXnet Licensing Service 64) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Macrovision Europe Ltd.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (hasplms) -- C:\Windows\SysNative\hasplms.exe (Aladdin Knowledge Systems Ltd.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SDWSCService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
SRV - (SDUpdateService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
SRV - (SDScannerService) -- C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
SRV - (SPAMfighter Update Service) -- C:\Program Files (x86)\Fighters\SPAMfighter\sfus.exe (SPAMfighter ApS)
SRV - (PRTGCoreService) -- C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe (Paessler AG)
SRV - (PRTGProbeService) -- C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe (Paessler AG)
SRV - (Suite Service) -- C:\Program Files (x86)\Fighters\FighterSuiteService.exe (SPAMfighter ApS)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (BotkindSyncService) -- C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe ()
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (AVKProxy) -- C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G Data Software AG)
SRV - (GDScan) -- C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G Data Software AG)
SRV - (AVKWCtl) -- C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKWCtlX64.exe (G Data Software AG)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (afcdpsrv) -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (PDFProFiltSrvPP) -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (GDFwSvc) -- C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFwSvcx64.exe (G Data Software AG)
SRV - (cjpcsc) -- C:\Windows\SysWOW64\cjpcsc.exe (REINER SCT)
SRV - (GladFileMonSvc) -- C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe (Gladinet, INC)
SRV - (AVKService) -- C:\Program Files (x86)\G DATA\InternetSecurity\AVK\AVKService.exe (G Data Software AG)
SRV - (UsbClientService) -- C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe ()
SRV - (AcrSch2Svc) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (DBService) -- C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (OS Selector) -- C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe ()
SRV - (NAUpdate) @C:\Program Files (x86) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msco rsvw.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel(R) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (AsSysCtrlService) -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlServi ce.exe ()
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (WPRO_41_2001) WinPcap Packet Driver (WPRO_41_2001) -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys ()
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (HookCentre) -- C:\Windows\SysNative\drivers\HookCentre.sys (G Data Software AG)
DRV:64bit: - (GDMnIcpt) -- C:\Windows\SysNative\drivers\MiniIcpt.sys (G Data Software AG)
DRV:64bit: - (GDBehave) -- C:\Windows\SysNative\drivers\GDBehave.sys (G Data Software AG)
DRV:64bit: - (gdwfpcd) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys (G Data Software AG)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (GDPkIcpt) -- C:\Windows\SysNative\drivers\PktIcpt.sys (G Data Software AG)
DRV:64bit: - (afcdp) -- C:\Windows\SysNative\drivers\afcdp.sys (Acronis)
DRV:64bit: - (tdrpman273) Acronis Try&Decide and Restore Points filter (build 273) -- C:\Windows\SysNative\drivers\tdrpm273.sys (Acronis)
DRV:64bit: - (timounter) -- C:\Windows\SysNative\drivers\timntr.sys (Acronis)
DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.s ys (Nokia)
DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sy s (Nokia)
DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia)
DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia)
DRV:64bit: - (GRD) -- C:\Windows\SysNative\drivers\GRD.sys (G Data Software)
DRV:64bit: - (RsFx0151) -- C:\Windows\SysNative\drivers\RsFx0151.sys (Microsoft Corporation)
DRV:64bit: - (GdNetMon) -- C:\Windows\SysNative\drivers\GdNetMon64.sys (G Data Software AG)
DRV:64bit: - (cjusb) -- C:\Windows\SysNative\drivers\cjusb.sys (REINER SCT)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (busenum) -- C:\Windows\SysNative\drivers\busenum.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (WDC_SAM) -- C:\Windows\SysNative\drivers\wdcsam64.sys (Western Digital Technologies)
DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (NPF) WinPcap Packet Driver (NPF) -- C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys ()
DRV:64bit: - (WmXlCore) -- C:\Windows\SysNative\drivers\WmXlCore.sys (Logitech Inc.)
DRV:64bit: - (WmVirHid) -- C:\Windows\SysNative\drivers\WmVirHid.sys (Logitech Inc.)
DRV:64bit: - (WmHidLo) -- C:\Windows\SysNative\drivers\WmHidLo.sys (Logitech Inc.)
DRV:64bit: - (WmFilter) -- C:\Windows\SysNative\drivers\WmFilter.sys (Logitech Inc.)
DRV:64bit: - (WmBEnum) -- C:\Windows\SysNative\drivers\WmBEnum.sys (Logitech Inc.)
DRV:64bit: - (aksdf) -- C:\Windows\SysNative\drivers\aksdf.sys (Aladdin Knowledge Systems Ltd.)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (Hardlock) -- C:\Windows\SysNative\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV:64bit: - (akshasp) -- C:\Windows\SysNative\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
DRV:64bit: - (aksusb) -- C:\Windows\SysNative\drivers\aksusb.sys (Aladdin Knowledge Systems Ltd.)
DRV:64bit: - (GigasetGenericUSB_x64) -- C:\Windows\SysNative\drivers\GigasetGenericUSB_x64 .sys (Siemens Home and Office Communication Devices GmbH & Co. KG)
DRV:64bit: - (mv64xx) -- C:\Windows\SysNative\drivers\mv64xx.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (aksfridge) -- C:\Windows\SysNative\drivers\aksfridge.sys (Aladdin Knowledge Systems Ltd.)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (GearAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (teamviewervpn) -- C:\Windows\SysNative\drivers\teamviewervpn.sys (TeamViewer GmbH)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV:64bit: - (akshhl) -- C:\Windows\SysNative\drivers\akshhl.sys (Aladdin Knowledge Systems Ltd.)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&cti d=CT1700389

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BD BB 36 56 C0 58 CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - No CLSID value found
IE - HKCU\..\URLSearchHook: {B9E567E4-BF93-4E31-838A-E7D7D01815BF} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll ()
IE - HKCU\..\SearchScopes,DefaultScope = {C628FABF-B4A4-418B-8E41-909D20B6F5C2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{783280EA-588C-4A2E-927E-7638EB57B7E5}: "URL" = http://search.igeared.com/dispatcher.aspx?i=67&tp=chrome&q={searchTerms}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={7F1C0A1D-2F44-4B45-B167-8FDA153C56D2}&mid=f509b6e61f8047d18715d1529aeb3fe4-bae92fc3d437010efff81638800a258becda9d37&lang=de&d s=tt014&pr=sa&d=2011-12-18 15:07:37&v=8.0.0.34&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&cti d=CT1700389
IE - HKCU\..\SearchScopes\{C628FABF-B4A4-418B-8E41-909D20B6F5C2}: "URL" = http://www.google.de/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Protected Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Phoca Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2149937&SearchSource=3&q={s earchTerms}"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "about:home"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]:1.12.2.44026
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8
FF - prefs.js..extensions.enabledItems: [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]:1.6.2
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170633FE}:20.1.0.4
FF - prefs.js..extensions.enabledItems: [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]:1.0.0.732
FF - prefs.js..extensions.enabledItems: {72CA2996-F580-47DF-98FF-0B853D09CEC8}:4.0.116
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.8.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.3.42
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]otcom:1.0
FF - prefs.js..extensions.enabledItems: [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]:3.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "http://search.igeared.com/dispatcher.aspx?i=67&tp=ab&q="
FF - prefs.js..network.proxy.http: "192.168.0.1"
FF - prefs.js..network.proxy.type: 1


FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_10 2.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@reiner-sct.com/OWOK,version=2.0.0.4: C:\Program Files (x86)\REINER SCT\OWOK\NPAPI-20\nprsct_owok_npapi-2004.dll (REINER Kartengeräte GmbH und Co. KG.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\nppdf.dll (Zeon Corporation)
FF - HKCU\Software\MozillaPlugins\@kaspersky.com/Password Manager: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager\npkpmAutofill.dll (Kaspersky Lab)
FF - HKCU\Software\MozillaPlugins\@protectdisc.com/NPPDLicenseHelper: C:\Users\*******\AppData\Roaming\ProtectDisc\Licen se Helper v2\NPPDLicenseHelper.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\[email protected]: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.01.15 21:35:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\[email protected]: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_7.0 [2011.11.27 18:03:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\{4F3D26C8-9907-48ff-BC74-B8C572D317BF}: C:\Program Files (x86)\AusweisApp\mozilla\eCardClientExt_FFxx_Win [2012.01.31 06:47:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\{4F0963A3-1658-4fde-9585-23A25CC288BF}: C:\Program Files (x86)\AusweisApp\mozilla\eCardClientPIn_FFxx_Win [2012.01.31 06:47:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.03 10:34:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.01.15 21:35:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Ex tensions\\[email protected]: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011.11.27 18:03:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensi ons\\{72CA2996-F580-47DF-98FF-0B853D09CEC8}: C:\Users\*******\AppData\Roaming\Kaspersky Lab\Kaspersky Password Manager\kpmAutofill [2012.01.08 14:19:23 | 000,000,000 | ---D | M]

[2009.10.29 19:11:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*******\AppData\Roaming\mozilla\Extension s
[2012.03.09 07:40:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions
[2009.10.31 19:18:58 | 000,000,000 | ---D | M] (IE Tab) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011.01.17 22:26:45 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2012.01.07 18:34:28 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\[email protected] om
[2009.10.31 18:43:25 | 000,000,000 | ---D | M] (Ovi maps browser plugin) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\[email protected]
[2012.02.11 18:35:12 | 000,000,000 | ---D | M] (Cooliris) -- C:\Users\*******\AppData\Roaming\mozilla\Firefox\P rofiles\g2hovcik.default\extensions\piclens@coolir is.com
[2009.10.29 21:45:54 | 000,002,833 | ---- | M] () -- C:\Users\*******\AppData\Roaming\Mozilla\Firefox\P rofiles\g2hovcik.default\searchplugins\rapidshare-files-search.xml
[2012.03.03 10:34:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.01.08 08:23:50 | 000,000,000 | ---D | M] (G Data BankGuard) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}
[2011.05.14 10:09:45 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2012.01.15 21:35:04 | 000,000,000 | ---D | M] (Adobe Acrobat - Create PDF) -- C:\PROGRAM FILES (X86)\ADOBE\ACROBAT 10.0\ACROBAT\BROWSER\WCFIREFOXEXTN
[2012.01.31 06:47:53 | 000,000,000 | ---D | M] (AusweisApp) -- C:\PROGRAM FILES (X86)\AUSWEISAPP\MOZILLA\ECARDCLIENTPIN_FFXX_WIN
() (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
() (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
() (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\FIREBUG@SOFTWA RE.JOEHEWITT.COM.XPI
() (No name found) -- C:\USERS\*******\APPDATA\ROAMING\MOZILLA\FIREFOX\P ROFILES\G2HOVCIK.DEFAULT\EXTENSIONS\GUTEGUTSCHEINE @GUTEGUTSCHEINE.COM.XPI
[2012.03.03 10:34:32 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.02.20 18:45:56 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.03.03 10:34:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.03.03 10:34:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.03.03 10:34:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.03.03 10:34:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.01 18:17:39 | 000,001,467 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\ssg_igeared.xml
[2012.03.03 10:34:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.03.03 10:34:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2011.11.13 11:40:21 | 000,000,906 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 acdid.acdsystems.com
O1 - Hosts: 192.168.0.13 roihost
O2:64bit: - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 10\DLLx64\SnagitBHO64.dll (TechSmith Corporation)
O2:64bit: - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIEx64.dll (G Data Software AG)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIE.dll (G Data Software AG)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SystemSecurityGuardToolbar BHO) - {B9E567E4-BF93-4E31-838A-E7D7D01815BF} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll ()
O2 - BHO: (G Data BankGuard) - {BA3295CF-17ED-4F49-9E95-D999A0ADBFDC} - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\BanksafeBHO.dll (G Data Software AG)
O2 - BHO: (AusweisApp 1.7.0.0) - {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} - C:\Program Files (x86)\AusweisApp\siqeCardClient.ols (OpenLimit SignCubes AG)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIEx64.dll (G Data Software AG)
O3:64bit: - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 10\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation)
O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\InternetSecurity\WebFilter\AvkWebIE.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (System Security Guard Toolbar) - {2793FB58-DCE3-4A83-97DE-7208CAD0341C} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 10\SnagitIEAddin.dll (TechSmith Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ACPW05DE] C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe (ACD Systems)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [CommonToolkitTray] C:\Program Files (x86)\Fighters\Tray\FightersTray.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [G Data AntiVirus Tray Application] C:\Program Files (x86)\G DATA\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [GDFirewallTray] C:\Program Files (x86)\G DATA\InternetSecurity\Firewall\GDFirewallTray.exe (G Data Software AG)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [sfagent] C:\Program Files (x86)\Fighters\SPAMfighter\sfagent.exe (SPAMfighter ApS)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [AusweisApp] C:\Program Files (x86)\AusweisApp\siqBootLoader.exe (OpenLimit SignCubes AG)
O4 - HKLM..\RunOnce: [B Register C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DivXDecH264.ax] "C:\Windows\system32\rundll32.exe" "C:\Program Files (x86)\DivX\DivX Plus DirectShow Filters\DivXDecH264.ax",DllRegisterServer File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: HideFastUserSwitching = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\ToolbarsRestrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: address pick-up: Übernehmen in combit address manager (crm.dbf) - C:\Users\*******\AppData\Local\combit\address pick-up\cmbtar1.htm File not found
O8:64bit: - Extra context menu item: An OneNote s&enden - res:///105 File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: address pick-up: Übernehmen in combit address manager (crm.dbf) - C:\Users\*******\AppData\Local\combit\address pick-up\cmbtar1.htm File not found
O8 - Extra context menu item: An OneNote s&enden - res:///105 File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - CC:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - CC:\Program Files (x86)\VMware\VMware Player\x64\vsocklib.dll File not found
O1364bit: - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: interfax.net ([secure] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_27)
O16 - DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (HWTest.HWTestControl)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (DLM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{7906D2AF-4403-4E8F-816F-4E1AC61A4C49}: NameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\hddlife - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\systemsecurityguardtoolbar - No CLSID value found
O18 - Protocol\Handler\hddlife {BD758015-47D9-477A-8873-4B688A2BC0E2} - C:\Program Files (x86)\Common Files\BinarySense\hlAPP.dll (BinarySense, Inc.)
O18 - Protocol\Handler\systemsecurityguardtoolbar {89EECF8F-484D-4786-909C-83E5285003ED} - C:\Program Files (x86)\SystemSecurityGuardToolbar\IEToolbar.dll ()
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.e xe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\windows\syswow64\userinit.exe) - c:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{4dcc5531-6cf9-11e0-9748-001bdc0fd617}\Shell - "" = AutoRun
O33 - MountPoints2\{4dcc5531-6cf9-11e0-9748-001bdc0fd617}\Shell\AutoRun\command - "" = M:\unlock.exe autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012.03.09 07:39:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2012.03.09 07:39:59 | 000,000,000 | ---D | C] -- C:\Users\*******\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\HiJackThis
[2012.03.07 11:17:55 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\CloudStation
[2012.03.06 21:45:38 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Snagit
[2012.03.05 09:07:27 | 000,000,000 | ---D | C] -- C:\usr
[2012.03.04 22:39:10 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.04 09:03:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.03.04 09:03:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2012.03.04 09:03:09 | 000,017,272 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe
[2012.03.04 09:03:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2
[2012.02.24 19:23:44 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Personalausweis
[2012.02.21 10:57:02 | 004,771,184 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxXtreme100.dll
[2012.02.21 10:56:58 | 000,104,304 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxUISettingsN100.dll
[2012.02.21 10:56:56 | 000,025,968 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTPSW100.dll
[2012.02.21 10:56:54 | 001,334,640 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTool100.dll
[2012.02.21 10:56:50 | 000,063,344 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxPXTree100.dll
[2012.02.21 10:56:44 | 000,127,344 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxMail100.dll
[2012.02.21 10:56:20 | 000,193,904 | ---- | C] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxBasics100.dll
[2012.02.19 11:48:59 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2012.02.19 11:48:59 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2012.02.19 11:48:59 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2012.02.19 11:48:59 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2012.02.19 11:48:59 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2012.02.19 11:48:59 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2012.02.19 11:48:58 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2012.02.19 11:48:58 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2012.02.19 11:48:57 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2012.02.19 11:48:57 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2012.02.19 11:48:56 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2012.02.19 11:48:56 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2012.02.19 11:48:56 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2012.02.19 11:48:56 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2012.02.19 11:48:55 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2012.02.19 11:48:55 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2012.02.19 11:48:53 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll
[2012.02.19 11:48:53 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll
[2012.02.19 11:48:53 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll
[2012.02.19 11:48:53 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll
[2012.02.19 11:48:53 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll
[2012.02.19 11:48:53 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll
[2012.02.19 11:48:52 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll
[2012.02.19 11:48:52 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll
[2012.02.18 18:28:19 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Stiftung Warentest
[2012.02.15 22:51:27 | 000,000,000 | ---D | C] -- C:\Users\*******\Documents\Zertifikaterstellung
[2012.02.15 19:57:08 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.02.15 19:57:08 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.02.15 19:57:06 | 002,308,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\js*****9.dll
[2012.02.15 19:57:06 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.02.15 19:57:06 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.02.15 19:57:06 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.02.15 19:57:05 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\js*****.dll
[2012.02.15 19:57:05 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\js*****.dll
[2012.02.15 19:57:05 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.02.15 19:57:04 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.02.15 19:57:03 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.02.15 19:55:56 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2012.02.15 19:55:55 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2012.02.15 19:55:55 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2012.02.15 19:55:33 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2012.02.11 18:44:56 | 000,000,000 | ---D | C] -- C:\Users\*******\AppData\Roaming\Malwarebytes
[2012.02.11 18:44:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.11 18:44:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.02.11 18:44:50 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.02.11 18:44:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.02.11 18:15:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fighters
[2010.05.26 20:04:22 | 001,531,392 | ---- | C] (Toshiba Samsung Storage Technology Corporation) -- C:\Users\*******\AppData\Roaming\tsdnwin.dll
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Users\*******\AppData\Roaming\*.tmp files -> C:\Users\*******\AppData\Roaming\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012.03.09 14:02:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.03.09 11:02:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.03.09 07:51:13 | 000,989,563 | ---- | M] () -- C:\Users\*******\AppData\Local\census.cache
[2012.03.09 07:50:52 | 000,157,636 | ---- | M] () -- C:\Users\*******\AppData\Local\ars.cache
[2012.03.09 07:39:59 | 000,002,975 | ---- | M] () -- C:\Users\*******\Desktop\HiJackThis.lnk
[2012.03.09 07:38:39 | 000,000,036 | ---- | M] () -- C:\Users\*******\AppData\Local\housecall.guid.cach e
[2012.03.09 07:34:46 | 000,017,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.09 07:34:46 | 000,017,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.09 07:32:27 | 000,574,391 | ---- | M] () -- C:\Windows\SysWow64\sig.bin
[2012.03.09 07:32:27 | 000,037,682 | ---- | M] () -- C:\Windows\SysWow64\nmp.map
[2012.03.09 07:27:37 | 000,035,344 | ---- | M] () -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys
[2012.03.09 07:24:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.09 07:24:24 | 4287,975,422 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.09 07:24:22 | 000,991,545 | ---- | M] () -- C:\Windows\SysNative\oodbs.lor
[2012.03.04 09:03:15 | 000,002,148 | ---- | M] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.03.03 20:45:26 | 000,002,763 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Quicken Jubiläumsversion Zahlungserinnerung.lnk
[2012.03.03 20:45:26 | 000,002,759 | ---- | M] () -- C:\Users\Public\Desktop\Quicken DELUXE Jubiläumsversion.lnk
[2012.02.27 20:30:21 | 001,957,312 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.02.27 20:30:21 | 000,823,920 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.02.27 20:30:21 | 000,768,370 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.02.27 20:30:21 | 000,198,062 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.02.27 20:30:21 | 000,164,846 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.02.21 10:57:02 | 004,771,184 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxXtreme100.dll
[2012.02.21 10:56:58 | 000,104,304 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxUISettingsN100.dll
[2012.02.21 10:56:56 | 000,025,968 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTPSW100.dll
[2012.02.21 10:56:54 | 001,334,640 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxTool100.dll
[2012.02.21 10:56:50 | 000,063,344 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxPXTree100.dll
[2012.02.21 10:56:44 | 000,127,344 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxMail100.dll
[2012.02.21 10:56:20 | 000,193,904 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Windows\SysWow64\LxBasics100.dll
[2012.02.20 18:45:55 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2012.02.20 18:45:55 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2012.02.20 18:45:55 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2012.02.20 18:45:55 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2012.02.20 16:38:05 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.02.19 11:04:05 | 000,000,221 | ---- | M] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3.url
[2012.02.19 11:04:05 | 000,000,221 | ---- | M] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url
[2012.02.19 10:13:10 | 000,001,093 | ---- | M] () -- C:\Users\*******\Desktop\Allway Sync.lnk
[2012.02.19 09:56:37 | 001,934,270 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.02.15 23:21:37 | 005,062,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.02.15 23:08:07 | 000,015,294 | ---- | M] () -- C:\Users\*******\Documents\TC TrustCenter - Antrag Internet ID Zertifikat.pdf
[2012.02.11 18:44:52 | 000,001,084 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Users\*******\AppData\Roaming\*.tmp files -> C:\Users\*******\AppData\Roaming\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012.03.09 07:51:13 | 000,989,563 | ---- | C] () -- C:\Users\*******\AppData\Local\census.cache
[2012.03.09 07:50:52 | 000,157,636 | ---- | C] () -- C:\Users\*******\AppData\Local\ars.cache
[2012.03.09 07:39:59 | 000,002,975 | ---- | C] () -- C:\Users\*******\Desktop\HiJackThis.lnk
[2012.03.09 07:38:39 | 000,000,036 | ---- | C] () -- C:\Users\*******\AppData\Local\housecall.guid.cach e
[2012.03.09 07:27:37 | 000,035,344 | ---- | C] () -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys
[2012.03.04 09:03:15 | 000,002,160 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2012.03.04 09:03:15 | 000,002,148 | ---- | C] () -- C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
[2012.02.19 11:04:05 | 000,000,221 | ---- | C] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3.url
[2012.02.19 10:53:57 | 000,000,221 | ---- | C] () -- C:\Users\*******\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url
[2012.02.15 23:08:07 | 000,015,294 | ---- | C] () -- C:\Users\*******\Documents\TC TrustCenter - Antrag Internet ID Zertifikat.pdf
[2012.02.11 18:44:52 | 000,001,084 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.01.08 14:47:50 | 000,000,018 | ---- | C] () -- C:\Users\*******\AppData\Roaming\sys386ll.dat
[2012.01.08 14:47:24 | 000,000,010 | ---- | C] () -- C:\Users\*******\AppData\Roaming\hhxprot5
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.11.15 19:17:21 | 000,000,396 | ---- | C] () -- C:\Windows\hbcikrnl.ini
[2011.11.15 19:17:07 | 000,167,936 | ---- | C] () -- C:\Windows\SysWow64\SerialXP.dll
[2011.11.15 19:17:07 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\win32com.dll
[2011.11.10 03:36:06 | 000,204,960 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2011.11.10 03:36:06 | 000,157,152 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.27 11:16:20 | 000,304,128 | ---- | C] () -- C:\Windows\SysWow64\LxDNT100.dll
[2011.09.27 11:14:14 | 000,133,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvmc100.dll
[2011.09.27 11:13:58 | 000,069,120 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvm100.dll
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.13 12:13:10 | 000,034,481 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2011.05.14 19:02:21 | 000,574,391 | ---- | C] () -- C:\Windows\SysWow64\sig.bin
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.11.07 15:22:14 | 000,010,593 | ---- | C] () -- C:\Windows\CSTBox.INI
[2010.11.07 15:09:25 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2010.11.07 12:10:41 | 000,000,088 | RHS- | C] () -- C:\ProgramData\797B5B5DFC.sys
[2010.11.07 12:10:40 | 000,005,642 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010.10.21 14:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll
[2010.10.21 14:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll
[2010.10.21 14:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll
[2010.10.15 19:54:40 | 000,000,115 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32. bc
[2010.09.04 15:26:17 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2010.05.25 18:22:54 | 000,000,031 | ---- | C] () -- C:\Windows\DeskCalc.INI
[2010.05.02 14:42:04 | 000,002,266 | ---- | C] () -- C:\Windows\aopr.ini
[2010.04.28 19:39:14 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\GkSui20.EXE
[2010.03.28 11:47:37 | 000,038,422 | ---- | C] () -- C:\Users\*******\AppData\Roaming\Microsoft Excel 97-2003.ADR
[2010.03.18 22:08:07 | 000,000,000 | ---- | C] () -- C:\Windows\wiso.ini

========== LOP Check ==========

[2012.03.03 19:37:00 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\.oit
[2011.06.23 14:38:58 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\04F6CE9A-BC39-4293-86D6-321922972FA6
[2010.08.28 07:51:08 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\4BF2960A-BC93-41E6-8F65-C86A5668BBEC
[2010.08.28 23:07:22 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\5C473C24-DD49-4B32-B115-534D28C4EDF0
[2010.09.22 20:56:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\5EE74A0C-5611-4078-9B7F-493466B5C1C7
[2009.10.30 20:34:59 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\ACD Systems
[2009.11.30 21:43:15 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Acronis
[2011.01.23 13:33:16 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\AD704CE7-76D0-4582-8C2B-92666CB58FB1
[2010.04.28 20:59:49 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\agorum core
[2012.01.22 13:19:49 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Artisteer
[2011.08.27 09:24:11 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\B3345BE1-B621-421A-865A-4A77D3080FAE
[2010.03.06 08:02:33 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\BinarySense
[2009.10.29 21:32:55 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Blitware
[2010.12.31 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Canon
[2011.09.18 09:24:02 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\chc.4875E02D9FB21 EE389F73B8D1702B320485DF8CE.1
[2011.09.17 14:40:36 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\com.adobe.downloa dassistant.AdobeDownloadAssistant
[2010.08.26 09:25:40 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Common Toolkit Suite
[2009.11.28 23:18:22 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\DassaultSystemes
[2009.10.29 20:37:14 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\DataDesign
[2010.01.19 12:45:41 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Downloaded Installations
[2010.05.30 19:51:37 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\EurekaLog
[2012.02.11 18:15:25 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Fighters
[2011.05.14 16:34:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\FileZilla
[2010.08.12 22:11:37 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\gnupg
[2011.09.18 09:26:35 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\gtk-2.0
[2010.09.09 13:40:30 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\IrfanView
[2010.11.28 10:18:02 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Jumping Bytes
[2010.11.28 11:23:28 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Kalypso Media
[2010.09.25 15:28:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Laplink
[2009.10.29 20:48:00 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Leadertech
[2012.01.08 17:58:39 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Lexware
[2010.11.07 13:21:09 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\MAGIX
[2011.08.07 17:13:53 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Nokia
[2010.10.21 19:09:54 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Nokia Ovi Suite
[2011.08.20 15:58:02 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Nuance
[2010.06.03 20:01:25 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Passware
[2011.05.27 18:05:52 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\PC Suite
[2010.10.15 19:54:39 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\PeerNetworking
[2010.11.06 22:48:32 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Pegasys Inc
[2012.01.22 14:17:07 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\ProtectDISC
[2010.10.02 18:42:06 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Quester
[2010.03.14 11:45:06 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\QuickScan
[2011.08.20 16:00:38 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\ScanSoft
[2011.12.31 10:37:34 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\SignaturUmgebung
[2010.09.30 21:46:52 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Spearit
[2009.10.31 22:25:40 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Sync App Settings
[2011.05.28 17:13:04 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\TeamViewer
[2010.08.04 05:52:26 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Thinstall
[2010.06.19 21:07:26 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Titanium
[2012.01.27 14:24:23 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Total Network Inventory 2
[2009.10.29 19:41:27 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\TrueCrypt
[2011.10.16 14:07:48 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\TuneUp Software
[2010.03.04 15:53:59 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Ubisoft
[2010.01.03 10:19:37 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Unity
[2010.04.28 21:05:28 | 000,000,000 | ---D | M] -- C:\Users\*******\AppData\Roaming\Zeon
[2011.07.26 15:02:04 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 393 bytes -> C:\ProgramData\TEMP:9A870F8B
@Alternate Data Stream - 172 bytes -> C:\ProgramData\TEMP:1AAB2E68
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:FD9CE1F3
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:A303874F
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:9B013599
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:0B9FB94D
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:01C66DD9
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:FED912DB
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:2BE9FEFC

< End of report >

Wäre super wenn ihr mir helfen könnt, habe keine Lust den Rechner platt zu machen :-)

Gruß

Blackmoon00

[ckjthedogmaster]

Ich schaue mir das eben an, aber setze das Log eben in einen Spoiler...



Mfg


Edit:

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
FF - prefs.js..browser.search.defaultenginename: "Protected Search"
O4 - HKLM..\Run: [] File not found
O4 - HKCU..\Run: [] File not found
O8:64bit: - Extra context menu item: An OneNote s&enden - res:///105 File not found
O8 - Extra context menu item: An OneNote s&enden - res:///105 File not found
:Commands
[emptytemp]
[resethosts]

Danach lad dir noch TDSSKiller runter und lass es laufen

[ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]

Mfg

[blackmoon00]

Hi ckjthedogmaster,

vielen Dank für deine schnelle Antwort, habe geradt OLT durchlaufen lassen mit den von dir aufgezeigten Text, nun lasse ich gerade noch TDSSKiller durchlaufen, hoffe damit habe ich mein lässtiges Problem beseitigt.

Konntest du eindeutig erkennen, was mich da befallen hat? Was mich verwundert, dass hier meine verschiedenen Viren- und Maleware Programme nicht angeschlagen haben.

So nun ist TDSSKiller auch noch durchgelaufen, hat nichts gefunden.

Der Test, sobald ich die Standartsuchmaske von Firefox als Startseite aktiviere und diese zur Suche nutze, werde ich auf folgenden Link umgeleitet:

h**p://www.protectedsearch.com/websearchresults.aspx?si=34287&chrome=true&q=test

Suchbegriff war hier: test

Hast du noch eine Idee? Sag mir aber bitte nicht den Rechner platt machen.

Danke schonmal für deine Hilfe.

Gruß

Blackmoon

[ckjthedogmaster]

Gut, dann klick mal im firefox auf Extras und auf ADDons, findest du da was von

protectedsearch, dann deinstalliere es. Im FirefoxSuchfenster ist ein kleines Symbol, klicke dort drauf und setze Google als deine Suchmaschine fest.

Testen... eventuell auch mal neustarten...

Achja, du hast die Log in Quote gesetzt, editiere den Beitrag, dann etwas unten auf erweitert.
Dann den Text vom Log markieren und in der Symbolleiste das S nehmen...

mfg

[blackmoon00]

Hi,

unter den Addons hatte ich als erstes gesucht und nichts gefunden. Auch im Bereich der installierten Programme bin ich ins leere gelaufen.

Ich weiß nicht wo dieser verdammt root dringen hängt. Letztlich kann ich das Problem so umgehen, dass ich die Startseite des Firefox manuell auf z.B. google.de setze, dann kommt das Problem nicht zum tragen.

Jedoch habe ich Bedenken, dass irgend jemand bei mir vielleicht doch Daten abgreift bzw. sich protokollieren lässt und später darauf zugreift.

Komisch ist, dass ich im Internet noch keinen Fall mit diesem Problem gefunden habe.

Jetzt habe ich mir auch schon eine neue Security Software gekauft, wobei ich bisher mit GData eigentlich super zufrienden war - bis auf die Performance :-)
Mal sehen ob Trend Micro vielleicht irgend etwas auf meinem Rechner findet.

Vielleicht hast du ja doch noch eine Idee.

[ckjthedogmaster]

joa, entfernen wäre doch ne gute Idee, oder nicht?

HAst du unter den Addons/Erweiterungen einen Eintrag mit do not track , DNT+ oder so ähnlich, dann entferne das mal.

Gleichnamiges grünes Symbol sollte dann auch irgendwo beim Suchfenster sein, wo du es an und ausschalten kannst.

Es ist auf jeden Fall ein Addon...

Mfg