SUISA 2.03 Trojaner auf Win7 Maschine - Bitte um Hilfe

**busbus** · 13.08.2012, 20:54

Guten Tag

Ich habe hier einen Win7 Rechner mit SUISA 2.03 Trojaner-Infektion.

Bis jetzt durchgeführt wurde folgendes:
1. Das Administrator Passwort wurde neu gesetzt (das ist ein Rechner von Bekannten. Sie wussten das Passwort nicht mehr).
Benutzt habe ich folgende Anleitung http://www.windows-7-forum.net/windo...tml#post234387
und eine Knopix-CD.

2. Einen zweiter Benutzer, dessen Account nicht infiziert zu sein scheint bzw. zumindest keine Symptome zeigt, habe ich dazu aufgefordert ein Backup seiner Daten auf USB-Sticks zu machen. Die Sticks sind für mich verfügbar.

Weiteres:
- Ein eventuell hinderlicher Umstand ist, dass ich nur mit einem Rechner (entweder mit meinem oder dem infizierten) gleichzeitig ins Internet kann, weil es in der Wohnung nur eine einzelnes Ethernet-Kabel zum Internet gibt.
- Ich bin Informatik-Student und sollte daher mit Anweisungen von Ihnen im Normalfall etwas anfangen können ;-)

Können Sie mir helfen und wenn ja, wie schnell ?

Freundliche Grüsse

MG · 14.08.2012, 12:35

Hallo busbus,

herzlich willkommen im Forum.

Lass das Programm OTL im abgesicherten Modus laufen und poste hier die Logfiles. Download und Anleitung hier.

**busbus** · 14.08.2012, 19:48

Hallo MG

Der Scan lief durch. Die Benutzernamen in den Logfiles hab ich - wie empfohlen - anonymisiert (zwei Accounts: [Benutzername1] und [Benutzername2]).

Eventuell wichtig ist folgende Mitteilung, die während dem Scan im Tray des Taskbars auftauchte:

Code:

OTL: OTL.exe - Datei beschädigt
Die Datei oder das Verzeichnis C:\Users\[Benutzername1]\AppData\Local\Temp ist beschädigt und nicht lesbar.
Führen Sie CHKDSK aus.

OLT.txt Logfile - Inhalt:

Code:

OTL logfile created on: 14.08.2012 20:14:31 - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\Administrator\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.03 Gb Available Physical Memory | 51.48% Memory free
4.00 Gb Paging File | 3.05 Gb Available in Paging File | 76.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97.56 Gb Total Space | 11.94 Gb Free Space | 12.24% Space Free | Partition Type: NTFS
Drive D: | 19.53 Gb Total Space | 19.15 Gb Free Space | 98.06% Space Free | Partition Type: NTFS
Drive E: | 31.86 Gb Total Space | 29.92 Gb Free Space | 93.92% Space Free | Partition Type: NTFS
 
Computer Name: WIN7-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Administrator\Desktop\OTL.exe (OldTimer Tools)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (Sony PC Companion) -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe (Avanquest Software)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (ICQ Service) -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (LVPrcS64) -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AVKWCtl) -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe (G Data Software AG)
SRV - (AVKProxy) -- C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe (G DATA Software AG)
SRV - (AVKService) -- C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (G Data Software AG)
SRV - (GDScan) -- C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe (G DATA Software AG)
SRV - (YahooAUService) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (GRD) -- C:\Windows\SysNative\drivers\GRD.sys (G Data Software)
DRV:64bit: - (GDMnIcpt) -- C:\Windows\SysNative\drivers\MiniIcpt.sys (G DATA Software AG)
DRV:64bit: - (HookCentre) -- C:\Windows\SysNative\drivers\HookCentre.sys (G DATA Software AG)
DRV:64bit: - (gdwfpcd) -- C:\Windows\SysNative\drivers\gdwfpcd64.sys (G DATA Software AG)
DRV:64bit: - (LVPr2Mon) -- C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (LVPr2M64) -- C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (s1029unic) -- C:\Windows\SysNative\drivers\s1029unic.sys (MCCI Corporation)
DRV:64bit: - (s1029mgmt) -- C:\Windows\SysNative\drivers\s1029mgmt.sys (MCCI Corporation)
DRV:64bit: - (s1029obex) -- C:\Windows\SysNative\drivers\s1029obex.sys (MCCI Corporation)
DRV:64bit: - (s1029mdm) -- C:\Windows\SysNative\drivers\s1029mdm.sys (MCCI Corporation)
DRV:64bit: - (s1029nd5) -- C:\Windows\SysNative\drivers\s1029nd5.sys (MCCI Corporation)
DRV:64bit: - (s1029mdfl) -- C:\Windows\SysNative\drivers\s1029mdfl.sys (MCCI Corporation)
DRV:64bit: - (s1029bus) -- C:\Windows\SysNative\drivers\s1029bus.sys (MCCI Corporation)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (lvpepf64) -- C:\Windows\SysNative\drivers\lv302a64.sys (Logitech Inc.)
DRV:64bit: - (LVUSBS64) -- C:\Windows\SysNative\drivers\LVUSBS64.sys (Logitech Inc.)
DRV:64bit: - (PID_PEPI) -- C:\Windows\SysNative\drivers\LV302V64.SYS (Logitech Inc.)
DRV:64bit: - (s0016mdm) -- C:\Windows\SysNative\drivers\s0016mdm.sys (MCCI Corporation)
DRV:64bit: - (s0016mgmt) -- C:\Windows\SysNative\drivers\s0016mgmt.sys (MCCI Corporation)
DRV:64bit: - (s0016obex) -- C:\Windows\SysNative\drivers\s0016obex.sys (MCCI Corporation)
DRV:64bit: - (s0016mdfl) -- C:\Windows\SysNative\drivers\s0016mdfl.sys (MCCI Corporation)
DRV:64bit: - (s0016bus) -- C:\Windows\SysNative\drivers\s0016bus.sys (MCCI Corporation)
DRV:64bit: - (seehcri) -- C:\Windows\SysNative\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (GRD) -- C:\Windows\SysWOW64\drivers\GRD.sys (G Data Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files (x86)\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.netlog.com
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://de.netlog.comhttp://www.google.ch/ [binary data]
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://de.netlog.com/ie8services/view=welcomePage
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://de.netlog.comhttp://www.google.ch/ [binary data]
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.netlog.com
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ch.msn.com/default.aspx
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-ch
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E6 55 82 E9 1F B2 CA 01  [binary data]
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\..\SearchScopes,DefaultScope = {62840DF7-E887-4DC7-8B4B-2314E6ED3F71}
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\..\SearchScopes\{62840DF7-E887-4DC7-8B4B-2314E6ED3F71}: "URL" = http://de.netlog.com/opensearch/view=search&q={searchTerms}
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\..\SearchScopes\{78CF1341-3323-4289-9692-6F72BF4DD772}: "URL" = http://de.search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b2ie7
IE - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\esnipsxpi@logia.esnips: C:\Program Files (x86)\Logia\eSnipsDownloader\ext [2010.10.19 20:26:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.05.24 19:12:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.10.28 19:11:06 | 000,000,000 | ---D | M]
 
[2010.10.19 20:27:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.06.09 20:12:44 | 000,000,000 | ---D | M] (G Data WebFilter) -- C:\Program Files (x86)\mozilla firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2010.01.16 03:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.16 03:15:29 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.10.19 20:26:43 | 000,002,029 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\esnips.xml
[2010.01.16 03:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.16 03:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.16 03:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\Webfilter\AVKWebIEx64.dll (G Data Software AG)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\Webfilter\AVKWebIE.dll (G Data Software AG)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files (x86)\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\Webfilter\AVKWebIEx64.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (G Data WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G Data\InternetSecurity\Webfilter\AVKWebIE.dll (G Data Software AG)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files (x86)\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files (x86)\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files (x86)\Vuze_Remote\prxtbVuz0.dll (Conduit Ltd.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Program Files (x86)\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe (G Data Software AG)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [YSearchProtection] C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe (Yahoo! Inc)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\[Benutzername2]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk = C:\ProgramData\D8EBC1D912D98F\D8EBC1D912D98F.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-4145052689-3737224974-2876956132-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{06926CE2-A641-4D30-9CAD-A6D5AF9A5765}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.14 20:12:40 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2012.08.13 22:50:45 | 001,402,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Utilman.exe
[2012.08.13 22:41:04 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\Apple Computer
[2012.08.13 22:41:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\yahoo!
[2012.08.13 22:41:02 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Apple Computer
[2012.08.07 17:46:04 | 000,000,000 | ---D | C] -- C:\ProgramData\D8EBC1D912D98F
[2010.03.21 19:36:02 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpe819A.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.14 20:13:11 | 001,513,990 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.14 20:13:11 | 000,659,788 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.14 20:13:11 | 000,621,064 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.14 20:13:11 | 000,132,060 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.14 20:13:11 | 000,108,284 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.14 20:11:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.14 20:11:19 | 1610,063,872 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.14 19:38:26 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Administrator\Desktop\OTL.exe
[2012.08.13 22:50:45 | 001,402,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\Utilman.exe
[2012.08.13 22:40:05 | 000,000,372 | ---- | M] () -- C:\Windows\tasks\SLOW-PCfighter64-[Benutzername1]-Startup.job
[2012.08.13 20:54:22 | 000,413,680 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.09 22:19:31 | 000,016,336 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.09 22:19:31 | 000,016,336 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.09 21:59:07 | 000,001,162 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4145052689-3737224974-2876956132-1001UA.job
[2012.08.06 18:59:00 | 000,001,140 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4145052689-3737224974-2876956132-1001Core.job
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.13 22:40:40 | 000,001,445 | ---- | C] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2010.02.20 13:55:56 | 000,007,666 | ---- | C] () -- C:\Users\Administrator\AppData\Local\resmon.resmoncfg
 
========== LOP Check ==========
 
[2010.02.20 13:32:50 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\Mp3tag
[2010.02.20 13:27:27 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\TeamViewer
[2010.12.29 21:12:33 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\Azureus
[2011.09.17 12:50:27 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\DVDVideoSoft
[2011.04.02 12:01:51 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.10.16 17:43:36 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\FileZilla
[2012.05.03 21:43:33 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\ICQ
[2010.10.19 20:27:00 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\Logia
[2010.02.20 15:17:04 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\Mp3tag
[2010.05.26 20:20:47 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\PX24
[2011.10.03 21:36:47 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\redsn0w
[2010.04.15 12:48:02 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\Soldat
[2010.03.03 21:43:45 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\TeamViewer
[2012.07.04 19:14:11 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername1]\AppData\Roaming\TuneUpMedia
[2010.03.02 21:30:09 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername2]\AppData\Roaming\FileZilla
[2010.02.25 11:29:33 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername2]\AppData\Roaming\Mp3tag
[2010.02.20 15:12:58 | 000,000,000 | ---D | M] -- C:\Users\[Benutzername2]\AppData\Roaming\TeamViewer
[2012.08.06 18:59:00 | 000,001,140 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4145052689-3737224974-2876956132-1001Core.job
[2012.08.09 21:59:07 | 000,001,162 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4145052689-3737224974-2876956132-1001UA.job
[2012.08.07 15:27:15 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.08.13 22:40:05 | 000,000,372 | ---- | M] () -- C:\Windows\Tasks\SLOW-PCfighter64-[Benutzername1]-Startup.job
 
========== Purity Check ==========
 
 

< End of report >

Extras.txt Logfile-Inhalt:

Code:

OTL Extras logfile created on: 14.08.2012 20:14:31 - Run 1
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Users\Administrator\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 1.03 Gb Available Physical Memory | 51.48% Memory free
4.00 Gb Paging File | 3.05 Gb Available in Paging File | 76.25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97.56 Gb Total Space | 11.94 Gb Free Space | 12.24% Space Free | Partition Type: NTFS
Drive D: | 19.53 Gb Total Space | 19.15 Gb Free Space | 98.06% Space Free | Partition Type: NTFS
Drive E: | 31.86 Gb Total Space | 29.92 Gb Free Space | 93.92% Space Free | Partition Type: NTFS
 
Computer Name: WIN7-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01ECACB1-5E74-40FD-98B7-999402E2A952}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{11A8ECF1-94E0-4BFB-853E-451A557EDC87}" = lport=445 | protocol=6 | dir=in | app=system | 
"{166B5404-3078-4397-A436-1A58B5F802B6}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{1965ABFF-DFE3-4ADB-BAF6-6CF82F806E8C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{284D87C7-2942-491E-AFF6-3C638800E152}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{2A493CAB-AA2A-4152-96CF-249C48F2FAEA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{2D7E540A-E972-433A-A2E8-E9194B00BD6C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{370E0073-F8FC-45CA-8176-36D3630699A7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3AEDD6F4-B892-4A8F-B5A3-F37310E7F358}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{3EED439F-CDB9-4E55-A11D-9AFDA2C66A8F}" = lport=139 | protocol=6 | dir=in | app=system | 
"{422E93FF-49BC-4FB9-8686-EAD546A2E87B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{4C45B1B9-20E8-41DB-A291-CDD589809C5B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{4FF043E0-C74B-4190-89D7-6EBF38EB3FE2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{566D3B2C-16AD-4CEB-AA3B-857DC6516ABB}" = lport=138 | protocol=17 | dir=in | app=system | 
"{593C3546-A1A4-409D-8069-DF4C21742012}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{62614561-249B-439D-A092-480AB5DA6250}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{65745780-63CB-4BC6-A9F5-4C7825C1E630}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{691854E5-DC63-4CA7-B603-2B85BD2A8A33}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{8430B0B6-A7E5-4906-BDB3-294A9340FC80}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{890DC475-0387-4FB1-B5DA-72C0F918F2DC}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8FEEE132-260E-4988-A9DA-8F992EA2CAC8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe | 
"{953F6883-1E80-4170-B186-EECD283CD0D8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{9D7902F1-888D-4FCE-90E2-B2DB9126DAF6}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{A471A683-960B-4C46-9F5A-AC73C8F35D11}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{A7803477-ADEE-405E-8166-79A2FB9FA1BC}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A8A9C554-0C6B-45F3-957A-8C7188046672}" = rport=139 | protocol=6 | dir=out | app=system | 
"{AC37E9F8-C3BC-43F7-A364-2CB9C90E4C56}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B603D87D-FAAD-4FC1-AF2A-12D3B9E48CF5}" = lport=137 | protocol=17 | dir=in | app=system | 
"{BF342C72-8114-4973-847D-283F58A89359}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{BF727BFE-A544-4AB5-B9B5-916F126BDC0A}" = rport=138 | protocol=17 | dir=out | app=system | 
"{C305ABDD-FE43-41E4-9879-87DEC9324E60}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{F002E810-8CE3-4A93-923B-27837C9EEFC3}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{F2219A8D-4C14-4A88-93E4-6186C3514D89}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F5FC669A-3B2E-4A96-99B3-FBB9F19A28FE}" = rport=445 | protocol=6 | dir=out | app=system | 
"{F91131B0-CF37-414D-81A5-1835F3CF3021}" = rport=137 | protocol=17 | dir=out | app=system | 
"{FAB4C24D-624A-4A26-9C47-8D2D93739B35}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{067FBA3E-1AC4-4D6E-B2AB-D1088E210ECA}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{0F0E8FE4-6DDA-4F7B-A49F-A27F01C3D429}" = protocol=17 | dir=in | app=c:\program files (x86)\vuze\azureus.exe | 
"{12D0AD84-BF08-4542-8602-AD07E18E3DC2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{1501F6DD-D038-47DB-B6D5-633BA91D4AC4}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{1788C000-A150-4785-9FC1-D9FEC531B449}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{1FA34D8C-BC5B-4BC8-ABAC-0275C7429F18}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{1FF5C770-5F0B-4B34-A3EC-B706C6F31B53}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{234BA7C9-C134-4D7E-8FF9-45817B749DCE}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{2480773F-7922-4380-AD20-D266644A232E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{2D9230B1-857C-47C4-A11D-D658677F4669}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{361FADD3-7C25-4E05-BC86-D45CE5A492E1}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{37133617-74C5-4897-8BFE-70EDC9F9941A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{40E6B145-161D-42FD-A7D7-7EC30FC08311}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{48F3BC3F-BC42-4E6E-ABFC-7A1A45262D37}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{49E39D17-803F-447E-8CD3-C6321428C41D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4CEAC640-88AC-43DE-B8BB-75D90F2C1E40}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | 
"{4FE78FE2-B2A8-4506-96D7-86A3979D05AD}" = dir=in | app=c:\users\[Benutzername1]\appdata\local\facebook\video\skype\facebookvideocalling.exe | 
"{537EBD2C-E8E5-4D54-899B-45CA5D286162}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe | 
"{54779CE6-FA2D-4F94-96D4-3DF1BE1008C3}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{56A11FBC-7176-4322-A5F6-8DAAAA0136EF}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{57E4F2A5-F2EC-46B9-A4C7-997A89442067}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe | 
"{596622FA-330F-4AF2-B58B-A72BD51A4B0C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{598D6553-66D9-45AA-836F-D54090CC1B93}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{6A3BEBA4-CACC-4BF1-B771-028E226755AF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{70258CF4-5D89-4DA8-B8E8-DBBEAB8C0F30}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{72F43A48-B2BC-4963-8D18-46F4B61F3457}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{8889BB47-DB2E-48C3-823D-995CE9BC86C5}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{8A3AB01C-5D63-43C9-89EC-A6409C5E5D00}" = protocol=6 | dir=in | app=c:\program files (x86)\vuze\azureus.exe | 
"{8D4E1BF9-8943-4989-B479-C008E3E539B7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{9A0BF98A-2136-4EB4-861E-6AFE6546AF1D}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{9E70B654-4544-43EF-A27E-6A78280AE896}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{A0CE394A-5AD6-4938-B231-6FDB034B68DB}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | 
"{A909E89B-737B-442C-A1C1-331827CAD84B}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{AB12E63E-AFE2-4921-8AFC-45B5C7826E36}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"{AF081BE4-80BD-4ABF-BE83-997F31C17E63}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{AF868330-CB5A-42A9-A4F0-F8B3A755315B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B62E8222-2E3B-4026-8C73-33A1C36C995D}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{BC0FCCD9-C440-4B4A-8774-A728321C8FAC}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{BD2A33B3-4C91-4916-8559-B511277343F3}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{C5AB248A-E404-4692-8FB1-2F127000E0B1}" = protocol=6 | dir=out | app=system | 
"{CC1BA71D-F20D-4C32-9470-208D9B5CF916}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"{D1D7C5FF-A8F5-4E0E-AD0D-E3F64D1A2124}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{D5854F76-D7B6-4158-BAE3-2438DDCB09BF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{D95B525C-448A-4F94-AAF8-54078CD5F997}" = protocol=6 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"{E887FEE0-E57F-49D4-B5C7-EA5A05D3FCB7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{F3572795-820B-44DC-9EA3-97BFF64D7BFC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F5DA87FB-5D44-44C4-B98A-1F5395BFD252}" = protocol=17 | dir=in | app=c:\program files (x86)\logitech\vid hd\vid.exe | 
"{F6C9D357-F9DB-471F-9D94-BEE7CA579606}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F8223618-7FEE-43C2-81DA-FE7BFA6B7AB2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{FB0248C0-37E7-4F56-814E-2BAE4A0ED4E4}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\aolload.exe | 
"TCP Query User{02DDC70F-1D8E-4714-956C-043B18C939FA}C:\users\[Benutzername2]\desktop\3342_wiz\wzfiles\quietxmlwiz.exe" = protocol=6 | dir=in | app=c:\users\[Benutzername2]\desktop\3342_wiz\wzfiles\quietxmlwiz.exe | 
"TCP Query User{0332C4A6-A4F6-4FBB-A14F-E4D612E87E8B}C:\program files (x86)\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"TCP Query User{65AAC7A7-0254-4707-905E-C4A1499ACF66}C:\program files (x86)\filezilla ftp client\filezilla.exe" = protocol=6 | dir=in | app=c:\program files (x86)\filezilla ftp client\filezilla.exe | 
"TCP Query User{986EC833-BBAD-49D4-85A9-4ABF9C2B64A5}C:\soldat\soldat.exe" = protocol=6 | dir=in | app=c:\soldat\soldat.exe | 
"TCP Query User{9A467BDD-73EE-4514-BA8C-293C5910F076}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{BF2FFE44-5837-40F0-A0C6-F86266959EB1}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"UDP Query User{0ACACC82-2186-4FCB-AA7D-AB240A0DAE5F}C:\users\[Benutzername2]\desktop\3342_wiz\wzfiles\quietxmlwiz.exe" = protocol=17 | dir=in | app=c:\users\[Benutzername2]\desktop\3342_wiz\wzfiles\quietxmlwiz.exe | 
"UDP Query User{0B02B95F-E80B-45DA-8BAE-FC04342E1A3D}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{38FA01E6-2068-4DB8-980E-801E9E0F17E1}C:\program files (x86)\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"UDP Query User{6C57A956-2684-4440-A08E-30C523EA305E}C:\program files (x86)\filezilla ftp client\filezilla.exe" = protocol=17 | dir=in | app=c:\program files (x86)\filezilla ftp client\filezilla.exe | 
"UDP Query User{8B911153-B2BC-4C0B-8981-06B6399CA00C}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"UDP Query User{E94AAE61-E725-42B0-BE8A-EE0A9ABDAD4B}C:\soldat\soldat.exe" = protocol=17 | dir=in | app=c:\soldat\soldat.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{3C5E60F1-0821-4B07-97EA-84EB5A927CF6}" = MobileMe Control Panel
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{867F5501-F8EF-4542-9D68-310A238A15FF}" = SLOW-PCfighter
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{987FE247-4E69-4A2E-A961-D14F901FDBF6}" = Logitech Webcam Software
"{9C98CA38-4C1A-4AC8-B55C-169497C8826B}" = Apple Mobile Device Support
"{9CD0F7D3-B67F-4BF8-8784-D73AD229FF1E}" = iTunes
"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client DE-DE Language Pack
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"SLOW-PCfighter" = SLOW-PCfighter
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help
"{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool
"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM
"{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights
"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart
"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help
"{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar
"{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help
"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter
"{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap
"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A62A775-A29A-4CE1-BBC2-4A9CD0B211EF}" = Nero Live Help
"{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision
"{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help
"{5C42EAB8-54F9-423A-948C-1CBEF25F8DB4}" = Nero PhotoSnap Help
"{5C9BB0B3-E830-4814-BBA4-D93535E1C7B9}" = Nero Live
"{6603fa7f-95b5-43c5-9521-7baeb08f37d7}" = Nero 9
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed
"{753973C4-B961-43BF-B2D4-3C8C92F7216E}" = Nero DriveSpeed
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78523651-D8B1-11DC-CCEE-741589645873}" = Nero DiscSpeed
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C654BD0-1949-43DE-84F2-EC2A1ABB0CB4}" = Nero ShowTime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express
"{948FFAAE-C57F-447B-9B07-3721E950BFDC}" = Nero ShowTime
"{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center
"{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A8399F58-234A-48C6-BA55-30C15738BF3C}" = Nero CoverDesigner
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool
"{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.1) - Deutsch
"{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor
"{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help
"{BCD82AB5-670D-4242-90FA-1F97103C16CD}" = Movie Templates - Starter Kit
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C99C89A3-119A-45E6-B26E-DD5643CAA0C5}" = Menu Templates - Starter Kit
"{CD1826A5-CFCC-4C6E-9F9D-E181876162EA}" = Nero Rescue Agent
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D729E05E-B2B9-4DC4-AF57-47310576EDE0}" = G Data InternetSecurity
"{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help
"{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.053
"{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"8461-7759-5462-8226" = Vuze
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"camtalk24.com-Client_is1" = camtalk24.com-Client 3.51
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"ENTERPRISE" = Microsoft Office Enterprise 2007
"eSnips_Downloader" = eSnips Downloader
"FileZilla Client" = FileZilla Client 3.3.2
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free DVD Video Converter_is1" = Free DVD Video Converter version 1.1
"Free Studio_is1" = Free Studio version 4.8
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.9.908
"ICQToolbar" = ICQ Toolbar
"JDownloader" = JDownloader
"Logitech Vid" = Logitech Vid HD
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"Mp3tag" = Mp3tag v2.45a
"NSS" = Norton Security Scan
"Picasa 3" = Picasa 3
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"Soldat_is1" = Soldat 1.5.0
"tint" = Tint
"TuneUpMedia" = TuneUp Companion 2.2.5
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.5
"Vuze_Remote Toolbar" = Vuze Remote Toolbar
"WinLiveSuite" = Windows Live Essentials
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Suche Schutzvorkehrung
"Yahoo! Software Update" = Yahoo! Software Update
"Zoo Tycoon 1.0" = Microsoft Zoo Tycoon
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 07.06.2011 13:16:27 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 08.06.2011 12:52:31 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 08.06.2011 16:24:47 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 09.06.2011 12:54:53 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 10.06.2011 11:20:53 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 10.06.2011 12:30:43 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 11.06.2011 13:15:33 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 11.06.2011 15:44:40 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 11.06.2011 16:14:28 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
Error - 12.06.2011 12:44:57 | Computer Name = Win7-PC | Source = Software Protection Platform Service | ID = 12293
Description = Fehler beim Veröffentlichen des Schlüsselverwaltungsdienstes (Key 
Management Service, KMS) in DNS in der ""-Domäne.  Info:  0x80070057
 
[ System Events ]
Error - 14.08.2012 14:11:55 | Computer Name = Win7-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.08.2012 14:11:55 | Computer Name = Win7-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.08.2012 14:11:55 | Computer Name = Win7-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.08.2012 14:11:55 | Computer Name = Win7-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location
 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 14.08.2012 14:18:39 | Computer Name = Win7-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "System" den Befehl "chkdsk" aus.
 
Error - 14.08.2012 14:19:13 | Computer Name = Win7-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "System" den Befehl "chkdsk" aus.
 
Error - 14.08.2012 14:19:20 | Computer Name = Win7-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "System" den Befehl "chkdsk" aus.
 
Error - 14.08.2012 14:19:24 | Computer Name = Win7-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie auf dem Volume "System" den Befehl "chkdsk" aus.
 
Error - 14.08.2012 14:21:40 | Computer Name = Win7-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 14.08.2012 14:21:40 | Computer Name = Win7-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.

	Neue
 Signaturversion:      Vorherige Signaturversion: 1.131.1722.0     Aktualisierungsquelle: 
%%859     Aktualisierungsphase: %%852     Quellpfad: Default URL     Signaturtyp: %%800     Aktualisierungstyp:
 %%803     Benutzer: NT-AUTORITÄT\SYSTEM     Aktuelle Modulversion:      Vorherige Modulversion:
 1.1.8601.0     Fehlercode: 0x8007043c     Fehlerbeschreibung: Der Dienst kann nicht im abgesicherten
 Modus gestartet werden. 
 
 
< End of report >

MG · 15.08.2012, 09:18

1. Fixen mit OTL

Hiermit fixen wir unnötige oder schädliche Einträge.

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

:OTL
O4 - Startup: C:\Users\[Benutzername2]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk = C:\ProgramData\D8EBC1D912D98F\D8EBC1D912D98F.exe ()

:Files
C:\ProgramData\D8EBC1D912D98F
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

:Commands
[PURITY]
[EMPTYTEMP]
[EMPTYFLASH]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

2.
Mache bitte im Anschluss einen vollständigen Scan mit Malwarebytes und poste hier das Logfile. Anleitung und Download hier.

3.
Deinstalliere bitte alle Toolbars wie z.B. von ebay, Ask, MSN, Conduit, Yahoo, SweetIM, Bandoo, iLivid usw. unter Systemsteuerung - Programme.

4.
Prüfe hier deine Plugins auf Aktualität und mache updates wenn dies angezeigt wird.

5.
Wichtig! Setze die Einstellung des Internet Explorers zurück. Hier kannst du lesen wie das geht

**busbus** · 15.08.2012, 22:56

@1. Fixen mit OTL
Das OTL Skript hab ich durchführen lassen. Ich musste es allerdings zweimal durchlaufen lassen, da ich beim ersten Durchgang dummerweise den Benutzernamen vergessen hab anzupassen. Aber wenn ich mir die Log-Files anschaue, scheint das kein Problem gewesen zu sein:

1. Log vom ersten Durchlauf:

Code:

All processes killed
========== OTL ==========
File move failed. C:\Users\[Benutzername2]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk scheduled to be moved on reboot.
C:\ProgramData\D8EBC1D912D98F\D8EBC1D912D98F.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 23939565 bytes
->Temporary Internet Files folder emptied: 515114 bytes
->Java cache emptied: 12118713 bytes
 
User: All Users
 
User: AppData
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: [Benutzername1]
->Temp folder emptied: 952249124 bytes
->Temporary Internet Files folder emptied: 555627384 bytes
->Java cache emptied: 11423138 bytes
->FireFox cache emptied: 143425689 bytes
->Apple Safari cache emptied: 18845696 bytes
->Flash cache emptied: 8289924 bytes
 
User: Public
 
User: [Benutzername2]
->Temp folder emptied: 162460175 bytes
->Temporary Internet Files folder emptied: 26967077 bytes
->Java cache emptied: 148038 bytes
->FireFox cache emptied: 131373494 bytes
->Flash cache emptied: 31997 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1566210923 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36046003 bytes
RecycleBin emptied: 4302 bytes
 
Total Files Cleaned = 3'481.00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: All Users
 
User: AppData
 
User: Default
 
User: Default User
 
User: [Benutzername1]
->Flash cache emptied: 0 bytes
 
User: Public
 
User: [Benutzername2]
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0.00 mb
 
 
OTL by OldTimer - Version 3.2.57.0 log created on 08152012_191737

Files\Folders moved on Reboot...
File\Folder C:\Users\[Benutzername2]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk not found!
C:\Users\Administrator\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\[Benutzername2]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk not found!
File C:\Users\Administrator\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

Zweiter Durchlauf (mit richtigem Benutzernamen)

Code:

All processes killed
========== OTL ==========
C:\Users\[Benutzername2]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk moved successfully.
File C:\ProgramData\D8EBC1D912D98F\D8EBC1D912D98F.exe not found.
========== FILES ==========
C:\ProgramData\D8EBC1D912D98F folder moved successfully.
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk moved successfully.
File\Folder :Commands not found.
File\Folder [PURITY] not found.
File\Folder [EMPTYTEMP] not found.
File\Folder [EMPTYFLASH] not found.
 
OTL by OldTimer - Version 3.2.57.0 log created on 08152012_194244

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Bis zu diesem Punkt wurden alle Arbeiten als Administrator in abgesichertem Modus durchgeführt.

@2. Scan mit MalewareBytes

Log vom Scan mit MalwareBytes:

Code:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.15.07

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Administrator :: WIN7-PC [Administrator]

15.08.2012 19:58:31
mbam-log-2012-08-15 (21-00-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 430956
Laufzeit: 1 Stunde(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Program Files (x86)\PSP Pandora Deluxe\PSP Pandora Deluxe.exe (Trojan.MSIL) -> Keine Aktion durchgeführt.
C:\Users\[Benutzername2]\AppData\Roaming\twain.dll (Trojan.MSIL) -> Keine Aktion durchgeführt.
C:\Users\[Benutzername2]\Favorites\MyQuickFinder.url (Malware.Trace) -> Keine Aktion durchgeführt.

(Ende)

@3. Deinstallieren der Toolbars etc.

Alle Toolbars und gleich diverse andere unnütze Software wurde deinstalliert. Das meiste lag ohnehin in völlig veralteten Versionen vor und wurde anscheinend auch nicht benutzt.

Ein Problem hatte ich: Eine Toolbar namens "Vuze Remote Toolbar" lies sich nicht deinstallieren, da das Deinstallationsskript nicht gefunden werden konnte. Allerdings scheint diese Toolbar in keinem Browser aufzutauchen. Eventuell ist ein voheriger Versuch diese Software zu deinstallieren so halb erfolgreich gewesen und die Software ist zwar weg aber immer noch unter den installierten Programmen registriert (?)

Bis zu diesem Punkt wurden alle Arbeiten als Administrator in abgesichertem Modus mit Netzwerk-Treibern durchgeführt.

@4. Plugins prüfen

Ich hab alle Plugins ausser Flash und Acrobat deinstalliert. Flash und Acrobat sind nun auf dem neuesten Stand (sowohl für IE als auch Firefox).

@5. IE zurücksetzen

Hab ich ausgeführt.

Weiteres

Nur der Komplettheit halber erwähnt:
- Firefox aktualisiert und als Standard-Browser gesetzt
- Alle Antivirensoftware (es waren ganze 5 installiert) deinstalliert ausser Microsoft Security Essentials, Antivir und natürlich MalwareBytes.
Die Signaturen von Antivir wurden automatisch aktualisiert.
? Gibt es von eurer Seite klare Empfehlungen zu Schutzsoftware ?
- Jede Software bei der es möglich war wurde auf Auto-Update gesetzt abgesehen von den Windows-Updates, die ich erst nach diesem Prozedere konfigurieren und durchführen werde.

Cheers
busbus

MG · 16.08.2012, 09:08

Nein es gibt keine Empfehlung, da eine Anti-Viren Software alleine kein Schutz ist. Wir sehen es mehr als Ergänzung zu anderen wichtigeren Maßnahmen.
Wie z.b. Programme , Plugins und Windows immer auf neuesten Stand zu halten.Das ist viel wichtiger. Läuft nun alles oder gibt es noch Probleme?

**busbus** · 16.08.2012, 09:14

Es läuft alles. EDIT: In den infizierten Account hab ich mich bis jetzt nicht eingeloggt ! Ich hab alles aus dem Administrator-Account heraus gemacht. D.h. ich kann für den betroffenen Account nicht aussagen, ob alles funktioniert. Soll ich mich da wirklich einloggen bevor wir fertig sind ?

MalewareBytes hat ja drei schadhafte Dateien gefunden. Müssen diese nicht noch entfernt werden ?

MG · 16.08.2012, 09:43

Ja bitte die Funde löschen lassen. Du kannst du ruhig in den Account einloggen.

**busbus** · 18.08.2012, 13:15

Funde gelöscht.

Erneuten Scan mit MalwareBytes -> Log:

Code:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.18.02

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
Administrator :: WIN7-PC [Administrator]

18.08.2012 11:19:21
mbam-log-2012-08-18 (11-19-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 376099
Laufzeit: 38 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Windowsupdates wurden gemacht. Antivir auf dem neuesten Stand.

Alle Accounts scheinen in Ordnung.

Ich nehme an, dass wir fertig sind ?

MG · 20.08.2012, 09:21

Ja wir sind fertig. Ich mache dann hier zu.

Bitte diese Artikel noch lesen:

Wie mache ich mein Windows sicher?
Wie kann ich mein System in Zukunft von Malware frei halten?
Wie kann ich prüfen, ob meine Software aktuell ist?
Browser und Plugins aktuell? Hier prüfen!
DNS manipuliert?

Thema: SUISA 2.03 Trojaner auf Win7 Maschine - Bitte um Hilfe

Themen-Optionen

Thema durchsuchen

Anzeige

SUISA 2.03 Trojaner auf Win7 Maschine - Bitte um Hilfe

Stichworte

Lesezeichen

Lesezeichen

Berechtigungen