Unwanted pop-up ads in Firefox and IE

StopVirus · June 25, 2013

Hi!

I've the same issue as others and don't know how to solve this. I'm also not a PC guru and would be very gladful if someone could guide me through the process.

I keep getting unwanted pop-ups and ads within other web pages like 'guess how many iPhones are floating around and win a iPhone 5' and many others.

I'm using Trendmicro Security. I've also tried Malware, Spybot and others and it seems that nothing has changed. While using internet the PC is slower than usual (before the ads and pop-ups)

Any help would be very much appreciated

Maniac · June 25, 2013

Hello StopVirus and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Please follow the instructions here:

http://forums.malwarebytes.org/index.php?showtopic=9573

Please post your log files in next reply.

StopVirus · June 25, 2013

Hello Maniac,

many thanks for your fast reply.

Here's the log of DDS.txt:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16611 BrowserJavaVersion: 10.25.2
Run by SvenM at 15:46:38 on 2013-06-25
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4055.1809 [GMT 2:00]
.
AV: Trend Micro Security Agent *Enabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
SP: Trend Micro Security Agent *Enabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe
C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\fxssvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Trend Micro\Security Agent\tmlisten.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServerFF.exe
C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRFeatureFF.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\cFos\cfosdnt.exe
C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe
C:\Users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\ISDN Management Center\isdnmc.exe
C:\Program Files (x86)\FRITZ!\IWatch.exe
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe
C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfPro5Hook.exe
C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe
C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1AW.exe
C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe
C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Awj.exe
C:\Program Files (x86)\FreePDF_XP\fpassist.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\jusched.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\FileFly\node.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Program Files (x86)\Real\realplayer\update\realsched.exe
C:\Program Files\SDProCRF\SDProCRF.EXE
C:\Windows\splwow64.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
C:\Windows\system32\PrintIsolationHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
c:\euroBIS\EBHP02.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uProxyServer = localhost:21320
BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg32.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
BHO: TSToolbarBHO: {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Security Agent\UIFramework\ToolbarIE.dll
BHO: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\bin\PlusIEContextMenu.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: LyricsTube: {B399EDE8-1525-458C-8DD9-31EADF632D06} -
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Trend Micro Toolbar: {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Security Agent\UIFramework\ToolbarIE.dll
mRun: [startCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [indexSearch] "C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\IndexSearch.exe"
mRun: [PaperPort PTD] "C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe"
mRun: [PDFHook] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfpro5hook.exe
mRun: [PDF5 Registry Controller] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\RegistryController.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [RUNUPDATER] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe
mRun: [Dell 1355 MFP RUN] "C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1ARun.exe"
mRun: [statusAutoRun] "C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe" RUNSTART
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [sDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
mRun: [TkBellExe] "C:\Program Files (x86)\Real\realplayer\update\realsched.exe" -osboot
mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\SvenM\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\SvenM\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ISDNMA~1.LNK - C:\Windows\Installer\{CB443F79-9AC4-47D5-84D5-7705C71484D2}\_862545E3B28E2DB98CD4DF.exe
StartupFolder: C:\Users\SvenM\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ISDNWA~1.LNK - C:\Program Files (x86)\FRITZ!\IWatch.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoAutoTrayNotify = dword:1
uPolicies-Explorer: NoSimpleStartMenu = dword:1
uPolicies-System: ProfileQuotaMessage = Der Profilspeicherplatz ist ausgelastet. Sie müssen einige Profilelemente in das Netzwerk oder auf den lokalen Computer verschieben.
uPolicies-System: MaxProfileSize = dword:90000
uPolicies-System: WarnUser = dword:1
uPolicies-System: WarnUserTimeout = dword:60
uPolicies-Windows\System: ExcludeProfileDirs = Anwendungsdaten\Adobe;Anwendungsdaten\Sun;Anwendungsdaten\Skype;AppData\Roaming\Adobe;AppData\Roaming\Sun;AppData\Roaming\Dropbox
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
mPolicies-Windows\System: UserPolicyMode = dword:1
mPolicies-Windows\System: AddAdminGroupToRUP = dword:1
mPolicies-Windows\System: CompatibleRUPSecurity = dword:1
IE: Nach Microsoft E&xel exportieren - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Open with PDF Viewer Plus - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
   If you wish to scan all of them, select the 'Force scan all domains' option.
.

TCP: NameServer = 10.1.1.10
TCP: Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC} : NameServer = 10.1.1.1
TCP: Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC} : DHCPNameServer = 10.1.1.10
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg32.dll
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Security Agent\UIFramework\ToolbarIE.dll
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Security Agent\UIFramework\ProToolbarIMRatingActiveX.dll
Notify: SDWinLogon - SDWinLogon.dll
SSODL: WebCheck - <orphaned>
x64-BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [cFosDNT] C:\Program Files\cFos\cFosDNT.exe
x64-Run: [LogMeIn GUI] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
x64-Run: [seagull Drivers] ssdal_nc.exe startup
x64-Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
.
INFO: x64-HKLM has more than 50 listed domains.
   If you wish to scan all of them, select the 'Force scan all domains' option.
.

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg.dll
x64-Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - <orphaned>
x64-Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - <orphaned>
x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll
x64-SSODL: WebCheck - <orphaned>
Hosts: 127.0.0.1   www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 61818
FF - prefs.js: network.proxy.type - 4
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll
FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2013-05-08 09:32; {c98699e6-88dc-4890-b996-5440fae41de7}; C:\Users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}
FF - ExtSQL: 2013-05-17 17:00; adblockpopups@jessehakanen.net; C:\Users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\adblockpopups@jessehakanen.net.xpi
FF - ExtSQL: 2013-06-04 07:57; LrcsTb@hansenapps.com; C:\Program Files (x86)\LyricsTube\FF
FF - ExtSQL: 2013-06-19 08:35; {FCE04E1F-9378-4f39-96F6-5689A9159E45}; C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-2-11 55280]
R2 Amsp;Trend Micro Solution Platform;C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe [2012-7-31 268504]
R2 cFosNT;cFosNT;C:\Windows\System32\drivers\cFosNT.sys [2010-5-20 1841368]
R2 LMIGuardianSvc;LMIGuardianSvc;C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [2011-7-30 376144]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files (x86)\LogMeIn\x64\rainfo.sys [2010-1-27 16056]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\System32\drivers\LMIRfsDriver.sys [2011-7-30 72216]
R2 SSPORT;SSPORT;C:\Windows\System32\drivers\SSPORT.SYS [2010-4-30 11576]
R2 tmevtmgr;tmevtmgr;C:\Windows\System32\drivers\tmevtmgr.sys [2012-7-31 67664]
R3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;C:\Windows\System32\drivers\avmcowan.sys [2009-7-13 79872]
R3 EST_BusEnum;Network USB Device Bus;C:\Windows\System32\drivers\GenBus.sys [2008-8-11 30720]
R3 FPCIBASE;AVM FRITZ!Card PCI;C:\Windows\System32\drivers\fpcibase.sys [2009-7-13 899328]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-2-12 56344]
R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-2-12 320040]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 EST_Server;Network USB Device;C:\Windows\System32\drivers\GenHC.sys [2008-8-11 174080]
S3 isdncapi;ISDN CAPI Protocol;C:\Windows\System32\drivers\isdncapi.sys [2010-5-20 646864]
S3 isdnmpa;ISDN WAN Miniport Driver;C:\Windows\System32\drivers\isdnmpa.sys [2010-5-20 177744]
S3 isdnpci;ISDN PCI Driver;C:\Windows\System32\drivers\isdnpci.sys [2007-5-15 166480]
S3 ivusb;Initio Driver for USB Default Controller;C:\Windows\System32\drivers\ivusb.sys [2010-7-29 29720]
S3 msftesql-Exchange;Microsoft Search (Exchange);J:\bin\msftesql.exe -Exchange -s:Exchange -f:Exchange --> J:\bin\msftesql.exe -Exchange -s:Exchange -f:Exchange [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-10-7 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S4 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-2-12 92160]
S4 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-2-12 203264]
S4 BPowMon;Broadcom Power monitoring service;C:\Program Files\Broadcom\BPowMon\BPowMon.exe [2009-8-17 117568]
S4 DLNADB;Dell 1355cn Status Database;C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe [2011-1-28 90432]
S4 PDFProFiltSrvPP;PDFProFiltSrvPP;C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe [2010-6-15 144672]
.
=============== File Associations ===============
.
ShellExec: switch.exe: open="C:\Program Files (x86)\NCH Software\Switch\switch" "%L"
.
=============== Created Last 30 ================
.
2013-06-22 05:51:22   76232   ----a-w-   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FB11772C-285F-49C7-B061-71FB3ED9982A}\offreg.dll
2013-06-22 05:43:59   96168   ----a-w-   C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-21 05:53:46   9552976   ----a-w-   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FB11772C-285F-49C7-B061-71FB3ED9982A}\mpengine.dll
2013-06-19 06:36:50   --------   d-----w-   C:\Users\SvenM\AppData\Roaming\RealNetworks
2013-06-19 06:35:59   --------   d-----w-   C:\ProgramData\RealNetworks
2013-06-19 06:35:59   --------   d-----w-   C:\Program Files (x86)\RealNetworks
2013-06-19 06:35:06   --------   d-----w-   C:\Program Files (x86)\Common Files\xing shared
2013-06-17 15:14:46   274432   ----a-w-   C:\Windows\SysWow64\ssleay32.dll
2013-06-17 15:14:45   81920   ----a-w-   C:\Windows\eSellerateControl350.dll
2013-06-17 15:14:45   356352   ----a-w-   C:\Windows\eSellerateEngine.dll
2013-06-17 15:14:45   1122304   ----a-w-   C:\Windows\SysWow64\libeay32.dll
2013-06-17 15:14:45   --------   d-----w-   C:\Program Files (x86)\Info Atoms Removal Tool
2013-06-14 16:01:10   --------   d-----w-   C:\SERVER
2013-06-14 15:34:39   --------   d-----w-   C:\ProgramData\Spybot - Search & Destroy
2013-06-14 15:34:29   17272   ----a-w-   C:\Windows\System32\sdnclean64.exe
2013-06-14 15:34:23   --------   d-----w-   C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-06-14 13:03:09   --------   d-sh--w-   C:\$RECYCLE.BIN
2013-06-12 06:18:54   1910632   ----a-w-   C:\Windows\System32\drivers\tcpip.sys
2013-06-12 06:17:57   1887232   ----a-w-   C:\Windows\System32\d3d11.dll
2013-06-12 06:17:57   1505280   ----a-w-   C:\Windows\SysWow64\d3d11.dll
2013-06-09 16:37:00   --------   d-----w-   C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-09 16:37:00   --------   d-----w-   C:\Program Files\iTunes
2013-06-09 16:37:00   --------   d-----w-   C:\Program Files\iPod
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2013-06-09 16:31:42   159744   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2013-06-09 16:31:41   159744   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
.
==================== Find3M ====================
.
2013-06-19 06:34:05   499712   ----a-w-   C:\Windows\SysWow64\msvcp71.dll
2013-06-12 19:48:23   867240   ----a-w-   C:\Windows\SysWow64\npdeployJava1.dll
2013-06-12 19:48:17   789416   ----a-w-   C:\Windows\SysWow64\deployJava1.dll
2013-06-12 07:58:47   71048   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 07:58:47   692104   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-08 12:28:46   2706432   ----a-w-   C:\Windows\System32\mshtml.tlb
2013-06-08 11:13:19   2706432   ----a-w-   C:\Windows\SysWow64\mshtml.tlb
2013-06-08 06:35:35   107368   ----a-w-   C:\Windows\System32\LMIRfsClientNP.dll
2013-06-08 06:35:34   35656   ----a-w-   C:\Windows\System32\LMIport.dll
2013-06-08 06:35:34   100680   ----a-w-   C:\Windows\System32\LMIinit.dll
2013-05-25 06:39:35   107368   ----a-w-   C:\Windows\System32\LMIRfsClientNP.dll.000.bak
2013-05-17 01:25:57   1767936   ----a-w-   C:\Windows\SysWow64\wininet.dll
2013-05-17 01:25:27   2877440   ----a-w-   C:\Windows\SysWow64\jscript9.dll
2013-05-17 01:25:26   61440   ----a-w-   C:\Windows\SysWow64\iesetup.dll
2013-05-17 01:25:26   109056   ----a-w-   C:\Windows\SysWow64\iesysprep.dll
2013-05-17 00:59:03   2241024   ----a-w-   C:\Windows\System32\wininet.dll
2013-05-17 00:58:10   3958784   ----a-w-   C:\Windows\System32\jscript9.dll
2013-05-17 00:58:08   67072   ----a-w-   C:\Windows\System32\iesetup.dll
2013-05-17 00:58:08   136704   ----a-w-   C:\Windows\System32\iesysprep.dll
2013-05-14 12:23:25   89600   ----a-w-   C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-14 08:40:13   71680   ----a-w-   C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-05-13 05:51:01   184320   ----a-w-   C:\Windows\System32\cryptsvc.dll
2013-05-13 05:51:00   1464320   ----a-w-   C:\Windows\System32\crypt32.dll
2013-05-13 05:51:00   139776   ----a-w-   C:\Windows\System32\cryptnet.dll
2013-05-13 05:50:40   52224   ----a-w-   C:\Windows\System32\certenc.dll
2013-05-13 04:45:55   140288   ----a-w-   C:\Windows\SysWow64\cryptsvc.dll
2013-05-13 04:45:55   1160192   ----a-w-   C:\Windows\SysWow64\crypt32.dll
2013-05-13 04:45:55   103936   ----a-w-   C:\Windows\SysWow64\cryptnet.dll
2013-05-13 03:43:55   1192448   ----a-w-   C:\Windows\System32\certutil.exe
2013-05-13 03:08:10   903168   ----a-w-   C:\Windows\SysWow64\certutil.exe
2013-05-13 03:08:06   43008   ----a-w-   C:\Windows\SysWow64\certenc.dll
2013-05-10 05:49:27   30720   ----a-w-   C:\Windows\System32\cryptdlg.dll
2013-05-10 03:20:54   24576   ----a-w-   C:\Windows\SysWow64\cryptdlg.dll
2013-05-08 07:29:38   723230   ----a-w-   C:\Windows\unins000.exe
2013-05-02 00:06:08   278800   ------w-   C:\Windows\System32\MpSigStub.exe
2013-05-01 01:59:12   94208   ----a-w-   C:\Windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59:12   69632   ----a-w-   C:\Windows\SysWow64\QuickTime.qts
2013-04-26 05:51:36   751104   ----a-w-   C:\Windows\System32\win32spl.dll
2013-04-26 04:55:21   492544   ----a-w-   C:\Windows\SysWow64\win32spl.dll
2013-04-17 07:02:06   1230336   ----a-w-   C:\Windows\SysWow64\WindowsCodecs.dll
2013-04-17 06:24:46   1424384   ----a-w-   C:\Windows\System32\WindowsCodecs.dll
2013-04-13 05:49:23   135168   ----a-w-   C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49:19   350208   ----a-w-   C:\Windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49:19   308736   ----a-w-   C:\Windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49:19   111104   ----a-w-   C:\Windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45:16   474624   ----a-w-   C:\Windows\apppatch\AcSpecfc.dll
2013-04-13 04:45:15   2176512   ----a-w-   C:\Windows\apppatch\AcGenral.dll
2013-04-12 14:45:08   1656680   ----a-w-   C:\Windows\System32\drivers\ntfs.sys
2013-04-10 06:01:54   265064   ----a-w-   C:\Windows\System32\drivers\dxgmms1.sys
2013-04-10 06:01:53   983400   ----a-w-   C:\Windows\System32\drivers\dxgkrnl.sys
2013-04-10 03:30:50   3153920   ----a-w-   C:\Windows\System32\win32k.sys
2013-04-04 12:50:32   25928   ----a-w-   C:\Windows\System32\drivers\mbam.sys
2004-04-21 09:38:06   446464   ----a-w-   C:\Program Files (x86)\HPUSBFW.EXE
2003-11-13 11:00:00   450560   ----a-w-   C:\Program Files (x86)\HPUSBF.EXE
.
============= FINISH: 15:48:55,33 ===============

Here's the Attach.txt Log

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 03.04.2010 15:19:54
System Uptime: 24.06.2013 08:41:05 (31 hours ago)
.
Motherboard: Dell Inc. | | 054KM3
Processor: Intel® Core i7 CPU 860 @ 2.80GHz | CPU 1 | 1176/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 224 GiB total, 69,683 GiB free.
D: is FIXED (NTFS) - 233 GiB total, 145,275 GiB free.
E: is CDROM ()
F: is Removable
G: is Removable
H: is NetworkDisk (NTFS) - 667 GiB total, 468,318 GiB free.
I: is NetworkDisk (NTFS) - 667 GiB total, 468,318 GiB free.
K: is CDROM ()
L: is NetworkDisk (NTFS) - 1861 GiB total, 518,948 GiB free.
P: is NetworkDisk (NTFS) - 667 GiB total, 468,318 GiB free.
R: is NetworkDisk (NTFS) - 3628 GiB total, 1992,542 GiB free.
T: is Removable
U: is Removable
Z: is NetworkDisk (NTFS) - 667 GiB total, 468,318 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP506: 13.06.2013 03:00:41 - Windows Update
RP507: 15.06.2013 12:23:38 - Windows Update
RP508: 21.06.2013 07:52:20 - Windows Update
RP509: 22.06.2013 07:42:01 - Installed Java 7 Update 25
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
64 Bit HP CIO Components Installer
7-Zip 4.65
7-Zip 9.20 (x64 edition)
Adobe Digital Editions 2.0
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe PDF iFilter 9 for 64-bit platforms
Adobe Reader X (10.1.7)
Aiseesoft DVD Converter Suite
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Control Center
AVM FRITZ!
Bonjour
Broadcom Management Programs
calibre 64bit
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help English
CCC Help French
CCC Help German
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Portuguese
CCC Help Spanish
CCC Help Turkish
CEDIUM Libri
cFos (x64) XP/Vista DSL/ISDN Driver 8.01.3123
Comic Ebook Reader
Comical 0.8
CrystalDiskInfo 3.10.0
CrystalReportXI_NET2005_r2
CrystalReportXI_r2_SP4
D3DX10
Dell 1355cn/1355cnw Color MFP
Dell Backup and Recovery Manager
Dell Edoc Viewer
Dell Printer Driver Updater
DHTML Editing Component
doPDF 7.3 printer
DriveImage XML (Private Edition)
Dropbox
DVD Decrypter (Remove Only)
DVD Shrink 3.2
e/
e/ Crystal Report
e/ Pre-Installazione
e/fiscali_3 Client
EasyRecovery Professional
euro-BIS 5.2.6 Arbeitsstation
FileZilla Client 3.5.2
FreePDF (Remove only)
GoToAssist Corporate
GPL Ghostscript
HP USB Disk Storage Format Tool
iCloud
Iomega StorCenter
IrfanView (remove only)
ISDN Management Center
iTunes
Java 7 Update 25
Java Auto Updater
Java 6 Update 17 (64-bit)
Junk Mail filter update
LogMeIn
LyricsTube
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile DEU Language Pack
Microsoft Application Error Reporting
Microsoft Full Text Indexing Engine for Exchange
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Basic 2007
Microsoft Office Excel MUI (German) 2007
Microsoft Office File Validation Add-In
Microsoft Office Live Add-in 1.5
Microsoft Office Office 64-bit Components 2007
Microsoft Office Outlook MUI (German) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Italian) 2007
Microsoft Office Proofing (German) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared 64-bit MUI (German) 2007
Microsoft Office Shared MUI (German) 2007
Microsoft Office Word MUI (German) 2007
Microsoft PowerPoint Viewer
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Backward compatibility
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server 2008 Native Client
Microsoft SQL Server 2008 Setup Support Files
Microsoft SQL Server Management Studio Express
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual Basic for Applications SDK Version 6.4
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft_VC100_CRT_SP1_x64
Microsoft_VC100_CRT_SP1_x86
Mozilla Firefox 21.0 (x86 en-GB)
Mozilla Maintenance Service
Mozilla Thunderbird 17.0.6 (x86 en-GB)
MSVC80_x64_v2
MSVC80_x86_v2
MSVC90_x64
MSVC90_x86
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2721691)
MSXML 4.0 SP3 Parser (KB2758694)
MSXML 4.0 SP3 Parser (KB973685)
Nuance PaperPort 12
Nuance PDF Viewer Plus
ODF Add-In für Microsoft Office
OfficeRecovery Enterprise
Oxford University Press 2012
PaperPort Image Printer 64-bit
PE Builder 3.1.10a
PowerDVD DX
PS Software
QuickShare
QuickTime
RCS Libri Education
Readiris Pro 10
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
RedMon - Redirection Port Monitor
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE 10.3
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Scansoft PDF Professional
SDP Downloader
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Service Pack 1 for SQL Server 2008 (KB968369) (64-bit)
Skins
Skype™ 6.3
Splashtop FileFly
Splashtop Software Updater
Spybot - Search & Destroy
Switch Sound File Converter
TeamViewer 8
Tools für Microsoft SQL Server 2005 Express Edition
Trend Micro Worry-Free Business Security Agent
TuneUp Companion 2.4.8.5
UltraFileSearch
UltraISO Premium V9.36
UltraVNC 1.0.8.2
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Word 2007 Help (KB963665)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition
USB Server
Visual Basic for Applications ® Core
Visual Basic for Applications ® Core - English
Visual Basic for Applications SDK
Vuze
WavePad Sound Editor
WD FAT32 Formatter
Windows Installer Clean Up
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live MIME IFilter
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
Windows Small Business Server 2008 ClientAgent
Windows Small Business Server 2008 Desktop Links Gadget
Windows Small Business Server 2008 WMI Provider
Windows Small Business Server 2011 Standard ClientAgent
Windows Small Business Server 2011 Standard WMI Provider
WinZip 15.0
Zebra Font Downloader
.
==== End Of File ===========================

Maniac · June 25, 2013

Step 1

Please uninstall the following applications:

LyricsTube

Vuze

Step 2

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Step 3

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

Step 4

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

Junkware Removal Tool log
AdwCleaner log
Malwarebytes' Anti-Malware log

StopVirus · June 25, 2013

Junkware Removal Tool log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Professional x64
Ran by SvenM on 25.06.2013 at 19:34:10,40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\splashtop"
Failed to delete: [Folder] "C:\Program Files (x86)\splashtop"

~~~ FireFox

Successfully deleted the following from C:\Users\SvenM\AppData\Roaming\mozilla\firefox\profiles\9y5mmgv7.default\prefs.js

user_pref("extensions.helperbar.SmartbarDisabled", false);
user_pref("extensions.helperbar.SmartbarStateMinimaized", false);

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.06.2013 at 19:38:09,87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdwCleaner log

# AdwCleaner v2.303 - Datei am 25/06/2013 um 19:18:13 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : SvenM - LIBRERIA1
# Bootmodus : Normal
# Ausgeführt unter : \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\AdwCleaner.exe
# Option [Löschen]

**** [Dienste] ****

***** [Dateien / Ordner] *****

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gelöscht : HKLM\Software\Description

***** [internet Browser] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (en-GB)

Datei : C:\Users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\prefs.js

Gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
Gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\SvenM\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[s3].txt - [1354 octets] - [25/06/2013 19:18:13]

########## EOF - C:\AdwCleaner[s3].txt - [1414 octets] ##########

malware log

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.06.25.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
SvenM :: LIBRERIA1 [administrator]

25.06.2013 19:40:47
mbam-log-2013-06-25 (19-40-47).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 337437
Time elapsed: 4 minute(s), 33 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Maniac · June 25, 2013

How are things now?

StopVirus · June 26, 2013

Still the same

Maniac · June 26, 2013

Note: Please do not run this tool without special supervision and instructions of someone authorized to do so. Otherwise, you could end up with serious problems. For more details, read this article: ComboFix usage, Questions, Help? - Look here

Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingc...to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please post the C:\ComboFix.txt in your next reply for further review.

Note: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

StopVirus · June 26, 2013

Combo Fix Log:

ComboFix 13-06-25.01 - SvenM 26.06.2013 13:43:37.11.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4055.2321 [GMT 2:00]
ausgeführt von:: \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\ComboFix.exe
AV: Trend Micro Security Agent *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Trend Micro Security Agent *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\SvenM\AppData\Roaming\FTPProtokoll.txt
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-05-26 bis 2013-06-26 ))))))))))))))))))))))))))))))
.
.
2013-06-26 11:54 . 2013-06-26 11:54   --------   d-----w-   c:\users\test\AppData\Local\temp
2013-06-26 11:54 . 2013-06-26 11:54   --------   d-----w-   c:\users\SBSAdmin\AppData\Local\temp
2013-06-26 11:54 . 2013-06-26 11:54   --------   d-----w-   c:\users\Public\AppData\Local\temp
2013-06-26 11:54 . 2013-06-26 11:54   --------   d-----w-   c:\users\Default\AppData\Local\temp
2013-06-26 11:54 . 2013-06-26 11:54   --------   d-----w-   c:\users\DCS_LIBRERIA1\AppData\Local\temp
2013-06-26 11:54 . 2013-06-26 11:54   --------   d-----w-   c:\users\DCS_LIBRERIA1.LIBRERIA1\AppData\Local\temp
2013-06-26 11:54 . 2013-06-26 11:54   --------   d-----w-   c:\users\BAK\AppData\Local\temp
2013-06-26 05:59 . 2013-06-12 03:08   9552976   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB9CE3D4-55DC-4AA0-81D1-E67430E00680}\mpengine.dll
2013-06-26 05:56 . 2013-06-26 05:56   --------   d-----w-   c:\programdata\Splashtop
2013-06-25 17:02 . 2013-06-25 17:02   --------   d-----w-   c:\windows\ERUNT
2013-06-25 17:02 . 2013-06-25 17:34   --------   d-----w-   C:\JRT
2013-06-22 05:44 . 2013-06-22 05:44   --------   d-----w-   c:\program files (x86)\Common Files\Java
2013-06-22 05:43 . 2013-06-12 19:47   96168   ----a-w-   c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-19 06:36 . 2013-01-01 19:50   --------   d-----w-   c:\users\SvenM\AppData\Roaming\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\programdata\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\Common Files\xing shared
2013-06-17 15:14 . 2009-07-23 15:32   274432   ----a-w-   c:\windows\SysWow64\ssleay32.dll
2013-06-17 15:14 . 2013-06-18 10:39   --------   d-----w-   c:\program files (x86)\Info Atoms Removal Tool
2013-06-17 15:14 . 2012-12-10 08:04   81920   ----a-w-   c:\windows\eSellerateControl350.dll
2013-06-17 15:14 . 2012-12-10 08:04   356352   ----a-w-   c:\windows\eSellerateEngine.dll
2013-06-17 15:14 . 2009-07-23 15:32   1122304   ----a-w-   c:\windows\SysWow64\libeay32.dll
2013-06-14 16:01 . 2013-06-14 16:01   --------   d-----w-   C:\SERVER
2013-06-14 15:34 . 2013-06-17 21:17   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2013-06-14 15:34 . 2009-01-25 11:14   17272   ----a-w-   c:\windows\system32\sdnclean64.exe
2013-06-14 15:34 . 2013-06-24 17:11   --------   d-----w-   c:\program files (x86)\Spybot - Search & Destroy 2
2013-06-12 06:18 . 2013-05-08 06:39   1910632   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2013-06-12 06:17 . 2013-04-25 23:30   1505280   ----a-w-   c:\windows\SysWow64\d3d11.dll
2013-06-12 06:17 . 2013-03-31 22:52   1887232   ----a-w-   c:\windows\system32\d3d11.dll
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iTunes
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iPod
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   --------   d-----w-   c:\program files (x86)\QuickTime
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-19 06:34 . 2013-01-01 19:48   499712   ----a-w-   c:\windows\SysWow64\msvcp71.dll
2013-06-13 01:03 . 2010-05-04 07:25   75825640   ----a-w-   c:\windows\system32\MRT.exe
2013-06-12 19:48 . 2012-06-04 11:09   867240   ----a-w-   c:\windows\SysWow64\npdeployJava1.dll
2013-06-12 19:48 . 2010-05-21 12:32   789416   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2013-06-12 07:58 . 2012-06-30 06:02   692104   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 07:58 . 2012-06-30 06:02   71048   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-08 06:35 . 2011-07-30 10:13   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll
2013-06-08 06:35 . 2011-07-30 10:13   35656   ----a-w-   c:\windows\system32\LMIport.dll
2013-06-08 06:35 . 2011-07-30 10:13   100680   ----a-w-   c:\windows\system32\LMIinit.dll
2013-05-25 06:39 . 2010-07-29 06:46   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-05-11 05:20 . 2010-06-24 10:33   22240   ----a-w-   c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-08 07:29 . 2013-05-08 07:30   723230   ----a-w-   c:\windows\unins000.exe
2013-05-02 00:06 . 2010-04-05 23:43   278800   ------w-   c:\windows\system32\MpSigStub.exe
2013-05-01 01:59 . 2013-05-01 01:59   94208   ----a-w-   c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59 . 2013-05-01 01:59   69632   ----a-w-   c:\windows\SysWow64\QuickTime.qts
2013-04-22 13:57 . 2013-04-22 13:57   163504   ----a-w-   c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin
2013-04-13 05:49 . 2013-05-16 05:43   135168   ----a-w-   c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 05:43   350208   ----a-w-   c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 05:43   308736   ----a-w-   c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 05:43   111104   ----a-w-   c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   474624   ----a-w-   c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   2176512   ----a-w-   c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 04:40   1656680   ----a-w-   c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-16 05:43   265064   ----a-w-   c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-16 05:43   983400   ----a-w-   c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-16 05:43   3153920   ----a-w-   c:\windows\system32\win32k.sys
2013-04-04 12:50 . 2012-07-19 06:35   25928   ----a-w-   c:\windows\system32\drivers\mbam.sys
2004-04-21 09:38 . 2011-02-03 11:03   446464   ----a-w-   c:\program files (x86)\HPUSBFW.EXE
2003-11-13 11:00 . 2011-02-03 11:03   450560   ----a-w-   c:\program files (x86)\HPUSBF.EXE
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B399EDE8-1525-458C-8DD9-31EADF632D06}]
c:\program files (x86)\LyricsTube\lrcstube.dll [bU]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-24 140520]
"IndexSearch"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\IndexSearch.exe" [2010-06-14 46368]
"PaperPort PTD"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe" [2010-06-14 29984]
"PDFHook"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfpro5hook.exe" [2010-03-05 636192]
"PDF5 Registry Controller"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\RegistryController.exe" [2010-03-05 62752]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"RUNUPDATER"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe" [2010-09-29 465728]
"Dell 1355 MFP RUN"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1ARun.exe" [2010-09-29 2481472]
"StatusAutoRun"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe" [2011-01-28 3789632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224]
"TkBellExe"="c:\program files (x86)\Real\realplayer\update\realsched.exe" [2013-06-19 295512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
ISDN Management Center.lnk - c:\windows\Installer\{CB443F79-9AC4-47D5-84D5-7705C71484D2}\_862545E3B28E2DB98CD4DF.exe [2010-6-19 10134]
ISDNWatch.lnk - c:\program files (x86)\FRITZ!\IWatch.exe [2011-5-11 341304]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Iomega StorCenter.lnk - c:\program files (x86)\Iomega StorCenter\sohoclient.exe -s [2013-3-21 1865040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"ProfileQuotaMessage"= Der Profilspeicherplatz ist ausgelastet. Sie müssen einige Profilelemente in das Netzwerk oder auf den lokalen Computer verschieben.
"MaxProfileSize"= 90000 (0x15f90)
"WarnUser"= 1 (0x1)
"WarnUserTimeout"= 60 (0x3c)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0\0sdnclean64.exe
.
R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 zvwfadvd;Bluetooth Serial Communications Helper;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 EST_Server;Network USB Device;c:\windows\system32\DRIVERS\GenHC.sys;c:\windows\SYSNATIVE\DRIVERS\GenHC.sys [x]
R3 isdncapi;ISDN CAPI Protocol;c:\windows\system32\DRIVERS\isdncapi.sys;c:\windows\SYSNATIVE\DRIVERS\isdncapi.sys [x]
R3 isdnmpa;ISDN WAN Miniport Driver;c:\windows\system32\DRIVERS\isdnmpa.sys;c:\windows\SYSNATIVE\DRIVERS\isdnmpa.sys [x]
R3 isdnpci;ISDN PCI Driver;c:\windows\system32\DRIVERS\isdnpci.sys;c:\windows\SYSNATIVE\DRIVERS\isdnpci.sys [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 msftesql-Exchange;Microsoft Search (Exchange);j:\bin\msftesql.exe;j:\bin\msftesql.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 BPowMon;Broadcom Power monitoring service;c:\program files\Broadcom\BPowMon\BPowMon.exe;c:\program files\Broadcom\BPowMon\BPowMon.exe [x]
R4 DLNADB;Dell 1355cn Status Database;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe [x]
R4 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 cFosNT;cFosNT;c:\windows\System32\Drivers\cFosNT.sys;c:\windows\SYSNATIVE\Drivers\cFosNT.sys [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 SplashtopFileFlyService;Splashtop® FileFly Service;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 SSUService;Splashtop Software Updater Service;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys;c:\windows\SYSNATIVE\DRIVERS\tmevtmgr.sys [x]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys;c:\windows\SYSNATIVE\DRIVERS\AVMCOWAN.sys [x]
S3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys;c:\windows\SYSNATIVE\DRIVERS\GenBus.sys [x]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys;c:\windows\SYSNATIVE\DRIVERS\fpcibase.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
zvwfadvd
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-03 07:58]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-19 8067616]
"cFosDNT"="c:\program files\cFos\cFosDNT.exe" [2010-05-28 1236184]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2010-01-27 57928]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2010-10-26 194080]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = localhost:21320
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Open with PDF Viewer Plus - c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
TCP: DhcpNameServer = 10.1.1.10
TCP: Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: NameServer = 10.1.1.1

FF - ProfilePath - c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 61818
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2013-05-08 09:32; {c98699e6-88dc-4890-b996-5440fae41de7}; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}
FF - ExtSQL: 2013-05-17 17:00; adblockpopups@jessehakanen.net; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\adblockpopups@jessehakanen.net.xpi
FF - ExtSQL: 2013-06-19 08:35; {FCE04E1F-9378-4f39-96F6-5689A9159E45}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-euro-BIS 5.2.6 Arbeitsstation - c:\windows\IsUn0407.exe
AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe
AddRemove-Splashtop Software Updater - c:\program files (x86)\Splashtop\Splashtop Software Updater\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\msftesql-Exchange]
"ImagePath"="j:\bin\msftesql.exe -Exchange -s:Exchange -f:Exchange"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\03\04\08\0f\"\1fu"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-26 14:09:16
ComboFix-quarantined-files.txt 2013-06-26 12:09
ComboFix2.txt 2013-06-14 11:42
ComboFix3.txt 2013-06-06 19:01
ComboFix4.txt 2013-05-18 10:47
ComboFix5.txt 2013-06-26 11:40
.
Vor Suchlauf: 25 Verzeichnis(se), 74.422.714.368 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 74.086.789.120 Bytes frei
.
- - End Of File - - 699F2A1DFA277ABEB7778B23EAF94E29
D41D8CD98F00B204E9800998ECF8427E

Maniac · June 26, 2013

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

NetSvc::
zvwfadvd
Folder::
c:\program files (x86)\LyricsTube
Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B399EDE8-1525-458C-8DD9-31EADF632D06}]
FireFox::
FF - ProfilePath - c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\
FF - ExtSQL: 2013-05-08 09:32; {c98699e6-88dc-4890-b996-5440fae41de7}; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

StopVirus · June 27, 2013

ComboFix 13-06-27.01 - SvenM 27.06.2013 12:48:10.12.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4055.2064 [GMT 2:00]
ausgeführt von:: \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\ComboFix.exe
Benutzte Befehlsschalter :: \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\CFScript.txt
AV: Trend Micro Security Agent *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Trend Micro Security Agent *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\SvenM\AppData\Roaming\FTPProtokoll.txt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-05-27 bis 2013-06-27 ))))))))))))))))))))))))))))))
.
.
2013-06-27 11:04 . 2013-06-27 11:04   --------   d-----w-   c:\users\test\AppData\Local\temp
2013-06-27 11:04 . 2013-06-27 11:04   --------   d-----w-   c:\users\SBSAdmin\AppData\Local\temp
2013-06-27 11:04 . 2013-06-27 11:04   --------   d-----w-   c:\users\Public\AppData\Local\temp
2013-06-27 11:04 . 2013-06-27 11:04   --------   d-----w-   c:\users\Default\AppData\Local\temp
2013-06-27 11:04 . 2013-06-27 11:04   --------   d-----w-   c:\users\DCS_LIBRERIA1\AppData\Local\temp
2013-06-27 11:04 . 2013-06-27 11:04   --------   d-----w-   c:\users\DCS_LIBRERIA1.LIBRERIA1\AppData\Local\temp
2013-06-27 11:04 . 2013-06-27 11:04   --------   d-----w-   c:\users\BAK\AppData\Local\temp
2013-06-26 10:38 . 2013-06-27 08:02   --------   d-----w-   c:\program files (x86)\Mozilla Thunderbird
2013-06-26 05:59 . 2013-06-12 03:08   9552976   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB9CE3D4-55DC-4AA0-81D1-E67430E00680}\mpengine.dll
2013-06-26 05:56 . 2013-06-26 05:56   --------   d-----w-   c:\programdata\Splashtop
2013-06-25 17:02 . 2013-06-25 17:02   --------   d-----w-   c:\windows\ERUNT
2013-06-25 17:02 . 2013-06-25 17:34   --------   d-----w-   C:\JRT
2013-06-22 05:44 . 2013-06-22 05:44   --------   d-----w-   c:\program files (x86)\Common Files\Java
2013-06-22 05:43 . 2013-06-12 19:47   96168   ----a-w-   c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-19 06:36 . 2013-01-01 19:50   --------   d-----w-   c:\users\SvenM\AppData\Roaming\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\programdata\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\Common Files\xing shared
2013-06-17 15:14 . 2009-07-23 15:32   274432   ----a-w-   c:\windows\SysWow64\ssleay32.dll
2013-06-17 15:14 . 2013-06-18 10:39   --------   d-----w-   c:\program files (x86)\Info Atoms Removal Tool
2013-06-17 15:14 . 2012-12-10 08:04   81920   ----a-w-   c:\windows\eSellerateControl350.dll
2013-06-17 15:14 . 2012-12-10 08:04   356352   ----a-w-   c:\windows\eSellerateEngine.dll
2013-06-17 15:14 . 2009-07-23 15:32   1122304   ----a-w-   c:\windows\SysWow64\libeay32.dll
2013-06-14 16:01 . 2013-06-14 16:01   --------   d-----w-   C:\SERVER
2013-06-14 15:34 . 2013-06-17 21:17   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2013-06-14 15:34 . 2009-01-25 11:14   17272   ----a-w-   c:\windows\system32\sdnclean64.exe
2013-06-14 15:34 . 2013-06-24 17:11   --------   d-----w-   c:\program files (x86)\Spybot - Search & Destroy 2
2013-06-12 06:18 . 2013-05-08 06:39   1910632   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2013-06-12 06:17 . 2013-04-25 23:30   1505280   ----a-w-   c:\windows\SysWow64\d3d11.dll
2013-06-12 06:17 . 2013-03-31 22:52   1887232   ----a-w-   c:\windows\system32\d3d11.dll
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iTunes
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iPod
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   --------   d-----w-   c:\program files (x86)\QuickTime
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-19 06:34 . 2013-01-01 19:48   499712   ----a-w-   c:\windows\SysWow64\msvcp71.dll
2013-06-13 01:03 . 2010-05-04 07:25   75825640   ----a-w-   c:\windows\system32\MRT.exe
2013-06-12 19:48 . 2012-06-04 11:09   867240   ----a-w-   c:\windows\SysWow64\npdeployJava1.dll
2013-06-12 19:48 . 2010-05-21 12:32   789416   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2013-06-12 07:58 . 2012-06-30 06:02   692104   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 07:58 . 2012-06-30 06:02   71048   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-08 06:35 . 2011-07-30 10:13   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll
2013-06-08 06:35 . 2011-07-30 10:13   35656   ----a-w-   c:\windows\system32\LMIport.dll
2013-06-08 06:35 . 2011-07-30 10:13   100680   ----a-w-   c:\windows\system32\LMIinit.dll
2013-05-25 06:39 . 2010-07-29 06:46   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-05-11 05:20 . 2010-06-24 10:33   22240   ----a-w-   c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-08 07:29 . 2013-05-08 07:30   723230   ----a-w-   c:\windows\unins000.exe
2013-05-02 00:06 . 2010-04-05 23:43   278800   ------w-   c:\windows\system32\MpSigStub.exe
2013-05-01 01:59 . 2013-05-01 01:59   94208   ----a-w-   c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59 . 2013-05-01 01:59   69632   ----a-w-   c:\windows\SysWow64\QuickTime.qts
2013-04-22 13:57 . 2013-04-22 13:57   163504   ----a-w-   c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin
2013-04-13 05:49 . 2013-05-16 05:43   135168   ----a-w-   c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 05:43   350208   ----a-w-   c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 05:43   308736   ----a-w-   c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 05:43   111104   ----a-w-   c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   474624   ----a-w-   c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   2176512   ----a-w-   c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 04:40   1656680   ----a-w-   c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-16 05:43   265064   ----a-w-   c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-16 05:43   983400   ----a-w-   c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-16 05:43   3153920   ----a-w-   c:\windows\system32\win32k.sys
2013-04-04 12:50 . 2012-07-19 06:35   25928   ----a-w-   c:\windows\system32\drivers\mbam.sys
2004-04-21 09:38 . 2011-02-03 11:03   446464   ----a-w-   c:\program files (x86)\HPUSBFW.EXE
2003-11-13 11:00 . 2011-02-03 11:03   450560   ----a-w-   c:\program files (x86)\HPUSBF.EXE
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B399EDE8-1525-458C-8DD9-31EADF632D06}]
c:\program files (x86)\LyricsTube\lrcstube.dll [bU]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-24 140520]
"IndexSearch"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\IndexSearch.exe" [2010-06-14 46368]
"PaperPort PTD"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe" [2010-06-14 29984]
"PDFHook"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfpro5hook.exe" [2010-03-05 636192]
"PDF5 Registry Controller"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\RegistryController.exe" [2010-03-05 62752]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"RUNUPDATER"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe" [2010-09-29 465728]
"Dell 1355 MFP RUN"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1ARun.exe" [2010-09-29 2481472]
"StatusAutoRun"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe" [2011-01-28 3789632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224]
"TkBellExe"="c:\program files (x86)\Real\realplayer\update\realsched.exe" [2013-06-19 295512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
ISDN Management Center.lnk - c:\windows\Installer\{CB443F79-9AC4-47D5-84D5-7705C71484D2}\_862545E3B28E2DB98CD4DF.exe [2010-6-19 10134]
ISDNWatch.lnk - c:\program files (x86)\FRITZ!\IWatch.exe [2011-5-11 341304]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Iomega StorCenter.lnk - c:\program files (x86)\Iomega StorCenter\sohoclient.exe -s [2013-3-21 1865040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"ProfileQuotaMessage"= Der Profilspeicherplatz ist ausgelastet. Sie müssen einige Profilelemente in das Netzwerk oder auf den lokalen Computer verschieben.
"MaxProfileSize"= 90000 (0x15f90)
"WarnUser"= 1 (0x1)
"WarnUserTimeout"= 60 (0x3c)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 zvwfadvd;Bluetooth Serial Communications Helper;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 EST_Server;Network USB Device;c:\windows\system32\DRIVERS\GenHC.sys;c:\windows\SYSNATIVE\DRIVERS\GenHC.sys [x]
R3 isdncapi;ISDN CAPI Protocol;c:\windows\system32\DRIVERS\isdncapi.sys;c:\windows\SYSNATIVE\DRIVERS\isdncapi.sys [x]
R3 isdnmpa;ISDN WAN Miniport Driver;c:\windows\system32\DRIVERS\isdnmpa.sys;c:\windows\SYSNATIVE\DRIVERS\isdnmpa.sys [x]
R3 isdnpci;ISDN PCI Driver;c:\windows\system32\DRIVERS\isdnpci.sys;c:\windows\SYSNATIVE\DRIVERS\isdnpci.sys [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 msftesql-Exchange;Microsoft Search (Exchange);j:\bin\msftesql.exe;j:\bin\msftesql.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 BPowMon;Broadcom Power monitoring service;c:\program files\Broadcom\BPowMon\BPowMon.exe;c:\program files\Broadcom\BPowMon\BPowMon.exe [x]
R4 DLNADB;Dell 1355cn Status Database;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe [x]
R4 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
S2 cFosNT;cFosNT;c:\windows\System32\Drivers\cFosNT.sys;c:\windows\SYSNATIVE\Drivers\cFosNT.sys [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 SplashtopFileFlyService;Splashtop® FileFly Service;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 SSUService;Splashtop Software Updater Service;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys;c:\windows\SYSNATIVE\DRIVERS\tmevtmgr.sys [x]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys;c:\windows\SYSNATIVE\DRIVERS\AVMCOWAN.sys [x]
S3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys;c:\windows\SYSNATIVE\DRIVERS\GenBus.sys [x]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys;c:\windows\SYSNATIVE\DRIVERS\fpcibase.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-03 07:58]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-19 8067616]
"cFosDNT"="c:\program files\cFos\cFosDNT.exe" [2010-05-28 1236184]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2010-01-27 57928]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2010-10-26 194080]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = localhost:21320
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Open with PDF Viewer Plus - c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
TCP: DhcpNameServer = 10.1.1.10
TCP: Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: NameServer = 10.1.1.1

FF - ProfilePath - c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 61818
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2013-05-08 09:32; {c98699e6-88dc-4890-b996-5440fae41de7}; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}
FF - ExtSQL: 2013-05-17 17:00; adblockpopups@jessehakanen.net; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\adblockpopups@jessehakanen.net.xpi
FF - ExtSQL: 2013-06-19 08:35; {FCE04E1F-9378-4f39-96F6-5689A9159E45}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-euro-BIS 5.2.6 Arbeitsstation - c:\windows\IsUn0407.exe
AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe
AddRemove-Splashtop Software Updater - c:\program files (x86)\Splashtop\Splashtop Software Updater\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\msftesql-Exchange]
"ImagePath"="j:\bin\msftesql.exe -Exchange -s:Exchange -f:Exchange"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\03\04\08\0f\"\1fu"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-27 13:10:10
ComboFix-quarantined-files.txt 2013-06-27 11:10
ComboFix2.txt 2013-06-26 12:09
ComboFix3.txt 2013-06-14 11:42
ComboFix4.txt 2013-06-06 19:01
ComboFix5.txt 2013-06-27 10:46
.
Vor Suchlauf: 25 Verzeichnis(se), 72.382.205.952 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 72.246.194.176 Bytes frei
.
- - End Of File - - D546818CCB7F8D2FB76F676916038BE7
D41D8CD98F00B204E9800998ECF8427E

Maniac · June 27, 2013

The script was not activated. Please follow the instructions carefully to run my script.

StopVirus · June 27, 2013

ComboFix 13-06-27.01 - SvenM 27.06.2013 19:07:02.13.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4055.2323 [GMT 2:00]
ausgeführt von:: \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\ComboFix.exe
Benutzte Befehlsschalter :: \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\CFScript.txt
AV: Trend Micro Security Agent *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Trend Micro Security Agent *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\SvenM\AppData\Roaming\FTPProtokoll.txt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-05-27 bis 2013-06-27 ))))))))))))))))))))))))))))))
.
.
2013-06-27 17:18 . 2013-06-27 17:18   --------   d-----w-   c:\users\test\AppData\Local\temp
2013-06-27 17:18 . 2013-06-27 17:18   --------   d-----w-   c:\users\SBSAdmin\AppData\Local\temp
2013-06-27 17:18 . 2013-06-27 17:18   --------   d-----w-   c:\users\Public\AppData\Local\temp
2013-06-27 17:18 . 2013-06-27 17:18   --------   d-----w-   c:\users\Default\AppData\Local\temp
2013-06-27 17:18 . 2013-06-27 17:18   --------   d-----w-   c:\users\DCS_LIBRERIA1\AppData\Local\temp
2013-06-27 17:18 . 2013-06-27 17:18   --------   d-----w-   c:\users\DCS_LIBRERIA1.LIBRERIA1\AppData\Local\temp
2013-06-27 17:18 . 2013-06-27 17:18   --------   d-----w-   c:\users\BAK\AppData\Local\temp
2013-06-26 10:38 . 2013-06-27 08:02   --------   d-----w-   c:\program files (x86)\Mozilla Thunderbird
2013-06-26 05:59 . 2013-06-12 03:08   9552976   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB9CE3D4-55DC-4AA0-81D1-E67430E00680}\mpengine.dll
2013-06-26 05:56 . 2013-06-26 05:56   --------   d-----w-   c:\programdata\Splashtop
2013-06-25 17:02 . 2013-06-25 17:02   --------   d-----w-   c:\windows\ERUNT
2013-06-25 17:02 . 2013-06-25 17:34   --------   d-----w-   C:\JRT
2013-06-22 05:44 . 2013-06-22 05:44   --------   d-----w-   c:\program files (x86)\Common Files\Java
2013-06-22 05:43 . 2013-06-12 19:47   96168   ----a-w-   c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-19 06:36 . 2013-01-01 19:50   --------   d-----w-   c:\users\SvenM\AppData\Roaming\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\programdata\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\Common Files\xing shared
2013-06-17 15:14 . 2009-07-23 15:32   274432   ----a-w-   c:\windows\SysWow64\ssleay32.dll
2013-06-17 15:14 . 2013-06-18 10:39   --------   d-----w-   c:\program files (x86)\Info Atoms Removal Tool
2013-06-17 15:14 . 2012-12-10 08:04   81920   ----a-w-   c:\windows\eSellerateControl350.dll
2013-06-17 15:14 . 2012-12-10 08:04   356352   ----a-w-   c:\windows\eSellerateEngine.dll
2013-06-17 15:14 . 2009-07-23 15:32   1122304   ----a-w-   c:\windows\SysWow64\libeay32.dll
2013-06-14 16:01 . 2013-06-14 16:01   --------   d-----w-   C:\SERVER
2013-06-14 15:34 . 2013-06-17 21:17   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2013-06-14 15:34 . 2009-01-25 11:14   17272   ----a-w-   c:\windows\system32\sdnclean64.exe
2013-06-14 15:34 . 2013-06-24 17:11   --------   d-----w-   c:\program files (x86)\Spybot - Search & Destroy 2
2013-06-12 06:18 . 2013-05-08 06:39   1910632   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2013-06-12 06:17 . 2013-04-25 23:30   1505280   ----a-w-   c:\windows\SysWow64\d3d11.dll
2013-06-12 06:17 . 2013-03-31 22:52   1887232   ----a-w-   c:\windows\system32\d3d11.dll
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iTunes
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iPod
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   --------   d-----w-   c:\program files (x86)\QuickTime
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-19 06:34 . 2013-01-01 19:48   499712   ----a-w-   c:\windows\SysWow64\msvcp71.dll
2013-06-13 01:03 . 2010-05-04 07:25   75825640   ----a-w-   c:\windows\system32\MRT.exe
2013-06-12 19:48 . 2012-06-04 11:09   867240   ----a-w-   c:\windows\SysWow64\npdeployJava1.dll
2013-06-12 19:48 . 2010-05-21 12:32   789416   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2013-06-12 07:58 . 2012-06-30 06:02   692104   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 07:58 . 2012-06-30 06:02   71048   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-08 06:35 . 2011-07-30 10:13   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll
2013-06-08 06:35 . 2011-07-30 10:13   35656   ----a-w-   c:\windows\system32\LMIport.dll
2013-06-08 06:35 . 2011-07-30 10:13   100680   ----a-w-   c:\windows\system32\LMIinit.dll
2013-05-25 06:39 . 2010-07-29 06:46   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-05-11 05:20 . 2010-06-24 10:33   22240   ----a-w-   c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-08 07:29 . 2013-05-08 07:30   723230   ----a-w-   c:\windows\unins000.exe
2013-05-02 00:06 . 2010-04-05 23:43   278800   ------w-   c:\windows\system32\MpSigStub.exe
2013-05-01 01:59 . 2013-05-01 01:59   94208   ----a-w-   c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59 . 2013-05-01 01:59   69632   ----a-w-   c:\windows\SysWow64\QuickTime.qts
2013-04-22 13:57 . 2013-04-22 13:57   163504   ----a-w-   c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin
2013-04-13 05:49 . 2013-05-16 05:43   135168   ----a-w-   c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 05:43   350208   ----a-w-   c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 05:43   308736   ----a-w-   c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 05:43   111104   ----a-w-   c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   474624   ----a-w-   c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   2176512   ----a-w-   c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 04:40   1656680   ----a-w-   c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-16 05:43   265064   ----a-w-   c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-16 05:43   983400   ----a-w-   c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-16 05:43   3153920   ----a-w-   c:\windows\system32\win32k.sys
2013-04-04 12:50 . 2012-07-19 06:35   25928   ----a-w-   c:\windows\system32\drivers\mbam.sys
2004-04-21 09:38 . 2011-02-03 11:03   446464   ----a-w-   c:\program files (x86)\HPUSBFW.EXE
2003-11-13 11:00 . 2011-02-03 11:03   450560   ----a-w-   c:\program files (x86)\HPUSBF.EXE
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B399EDE8-1525-458C-8DD9-31EADF632D06}]
c:\program files (x86)\LyricsTube\lrcstube.dll [bU]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-24 140520]
"IndexSearch"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\IndexSearch.exe" [2010-06-14 46368]
"PaperPort PTD"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe" [2010-06-14 29984]
"PDFHook"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfpro5hook.exe" [2010-03-05 636192]
"PDF5 Registry Controller"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\RegistryController.exe" [2010-03-05 62752]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"RUNUPDATER"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe" [2010-09-29 465728]
"Dell 1355 MFP RUN"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1ARun.exe" [2010-09-29 2481472]
"StatusAutoRun"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe" [2011-01-28 3789632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224]
"TkBellExe"="c:\program files (x86)\Real\realplayer\update\realsched.exe" [2013-06-19 295512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
ISDN Management Center.lnk - c:\windows\Installer\{CB443F79-9AC4-47D5-84D5-7705C71484D2}\_862545E3B28E2DB98CD4DF.exe [2010-6-19 10134]
ISDNWatch.lnk - c:\program files (x86)\FRITZ!\IWatch.exe [2011-5-11 341304]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Iomega StorCenter.lnk - c:\program files (x86)\Iomega StorCenter\sohoclient.exe -s [2013-3-21 1865040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"ProfileQuotaMessage"= Der Profilspeicherplatz ist ausgelastet. Sie müssen einige Profilelemente in das Netzwerk oder auf den lokalen Computer verschieben.
"MaxProfileSize"= 90000 (0x15f90)
"WarnUser"= 1 (0x1)
"WarnUserTimeout"= 60 (0x3c)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0\0sdnclean64.exe
.
R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 zvwfadvd;Bluetooth Serial Communications Helper;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 EST_Server;Network USB Device;c:\windows\system32\DRIVERS\GenHC.sys;c:\windows\SYSNATIVE\DRIVERS\GenHC.sys [x]
R3 isdncapi;ISDN CAPI Protocol;c:\windows\system32\DRIVERS\isdncapi.sys;c:\windows\SYSNATIVE\DRIVERS\isdncapi.sys [x]
R3 isdnmpa;ISDN WAN Miniport Driver;c:\windows\system32\DRIVERS\isdnmpa.sys;c:\windows\SYSNATIVE\DRIVERS\isdnmpa.sys [x]
R3 isdnpci;ISDN PCI Driver;c:\windows\system32\DRIVERS\isdnpci.sys;c:\windows\SYSNATIVE\DRIVERS\isdnpci.sys [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 msftesql-Exchange;Microsoft Search (Exchange);j:\bin\msftesql.exe;j:\bin\msftesql.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 BPowMon;Broadcom Power monitoring service;c:\program files\Broadcom\BPowMon\BPowMon.exe;c:\program files\Broadcom\BPowMon\BPowMon.exe [x]
R4 DLNADB;Dell 1355cn Status Database;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe [x]
R4 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 cFosNT;cFosNT;c:\windows\System32\Drivers\cFosNT.sys;c:\windows\SYSNATIVE\Drivers\cFosNT.sys [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 SplashtopFileFlyService;Splashtop® FileFly Service;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 SSUService;Splashtop Software Updater Service;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys;c:\windows\SYSNATIVE\DRIVERS\tmevtmgr.sys [x]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys;c:\windows\SYSNATIVE\DRIVERS\AVMCOWAN.sys [x]
S3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys;c:\windows\SYSNATIVE\DRIVERS\GenBus.sys [x]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys;c:\windows\SYSNATIVE\DRIVERS\fpcibase.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-03 07:58]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-19 8067616]
"cFosDNT"="c:\program files\cFos\cFosDNT.exe" [2010-05-28 1236184]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2010-01-27 57928]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2010-10-26 194080]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = localhost:21320
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Open with PDF Viewer Plus - c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
TCP: DhcpNameServer = 10.1.1.10
TCP: Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: NameServer = 10.1.1.1

FF - ProfilePath - c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 61818
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2013-05-08 09:32; {c98699e6-88dc-4890-b996-5440fae41de7}; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}
FF - ExtSQL: 2013-05-17 17:00; adblockpopups@jessehakanen.net; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\adblockpopups@jessehakanen.net.xpi
FF - ExtSQL: 2013-06-19 08:35; {FCE04E1F-9378-4f39-96F6-5689A9159E45}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-euro-BIS 5.2.6 Arbeitsstation - c:\windows\IsUn0407.exe
AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe
AddRemove-Splashtop Software Updater - c:\program files (x86)\Splashtop\Splashtop Software Updater\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\msftesql-Exchange]
"ImagePath"="j:\bin\msftesql.exe -Exchange -s:Exchange -f:Exchange"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\03\04\08\0f\"\1fu"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-27 19:31:47
ComboFix-quarantined-files.txt 2013-06-27 17:31
ComboFix2.txt 2013-06-27 11:10
ComboFix3.txt 2013-06-26 12:09
ComboFix4.txt 2013-06-14 11:42
ComboFix5.txt 2013-06-27 17:05
.
Vor Suchlauf: 25 Verzeichnis(se), 72.348.180.480 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 72.212.733.952 Bytes frei
.
- - End Of File - - 4428BF3C702793421FEFCA0F817471CD
D41D8CD98F00B204E9800998ECF8427E

Maniac · June 27, 2013

Your script is still not activated. Do you have a problem with my instructions? Do you need more details?

StopVirus · June 28, 2013

Sorry, I've done it as explained... I don't know what I'm doing wrong.

Here's the log again:

ComboFix 13-06-28.01 - SvenM 28.06.2013   8:04.14.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4055.2426 [GMT 2:00]
ausgeführt von:: \\SERVER\User$\SvenM\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: \\SERVER\User$\SvenM\Desktop\CFScript.txt
AV: Trend Micro Security Agent *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Trend Micro Security Agent *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-05-28 bis 2013-06-28 ))))))))))))))))))))))))))))))
.
.
2013-06-28 06:14 . 2013-06-28 06:14   --------   d-----w-   c:\users\test\AppData\Local\temp
2013-06-28 06:14 . 2013-06-28 06:14   --------   d-----w-   c:\users\SBSAdmin\AppData\Local\temp
2013-06-28 06:14 . 2013-06-28 06:14   --------   d-----w-   c:\users\Public\AppData\Local\temp
2013-06-28 06:14 . 2013-06-28 06:14   --------   d-----w-   c:\users\Default\AppData\Local\temp
2013-06-28 06:14 . 2013-06-28 06:14   --------   d-----w-   c:\users\DCS_LIBRERIA1\AppData\Local\temp
2013-06-28 06:14 . 2013-06-28 06:14   --------   d-----w-   c:\users\DCS_LIBRERIA1.LIBRERIA1\AppData\Local\temp
2013-06-28 06:14 . 2013-06-28 06:14   --------   d-----w-   c:\users\BAK\AppData\Local\temp
2013-06-28 05:52 . 2013-06-12 03:08   9552976   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{0904ECDB-4E75-496E-B94E-7F8F333C0FF0}\mpengine.dll
2013-06-26 10:38 . 2013-06-27 08:02   --------   d-----w-   c:\program files (x86)\Mozilla Thunderbird
2013-06-26 05:56 . 2013-06-26 05:56   --------   d-----w-   c:\programdata\Splashtop
2013-06-25 17:02 . 2013-06-25 17:02   --------   d-----w-   c:\windows\ERUNT
2013-06-25 17:02 . 2013-06-25 17:34   --------   d-----w-   C:\JRT
2013-06-22 05:44 . 2013-06-22 05:44   --------   d-----w-   c:\program files (x86)\Common Files\Java
2013-06-22 05:43 . 2013-06-12 19:47   96168   ----a-w-   c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-19 06:36 . 2013-01-01 19:50   --------   d-----w-   c:\users\SvenM\AppData\Roaming\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\programdata\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\RealNetworks
2013-06-19 06:35 . 2013-06-19 06:35   --------   d-----w-   c:\program files (x86)\Common Files\xing shared
2013-06-17 15:14 . 2009-07-23 15:32   274432   ----a-w-   c:\windows\SysWow64\ssleay32.dll
2013-06-17 15:14 . 2013-06-18 10:39   --------   d-----w-   c:\program files (x86)\Info Atoms Removal Tool
2013-06-17 15:14 . 2012-12-10 08:04   81920   ----a-w-   c:\windows\eSellerateControl350.dll
2013-06-17 15:14 . 2012-12-10 08:04   356352   ----a-w-   c:\windows\eSellerateEngine.dll
2013-06-17 15:14 . 2009-07-23 15:32   1122304   ----a-w-   c:\windows\SysWow64\libeay32.dll
2013-06-14 16:01 . 2013-06-14 16:01   --------   d-----w-   C:\SERVER
2013-06-14 15:34 . 2013-06-17 21:17   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2013-06-14 15:34 . 2009-01-25 11:14   17272   ----a-w-   c:\windows\system32\sdnclean64.exe
2013-06-14 15:34 . 2013-06-24 17:11   --------   d-----w-   c:\program files (x86)\Spybot - Search & Destroy 2
2013-06-12 06:18 . 2013-05-08 06:39   1910632   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2013-06-12 06:17 . 2013-04-25 23:30   1505280   ----a-w-   c:\windows\SysWow64\d3d11.dll
2013-06-12 06:17 . 2013-03-31 22:52   1887232   ----a-w-   c:\windows\system32\d3d11.dll
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iTunes
2013-06-09 16:37 . 2013-06-09 16:37   --------   d-----w-   c:\program files\iPod
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   159744   ----a-w-   c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2013-06-09 16:31 . 2013-06-09 16:31   --------   d-----w-   c:\program files (x86)\QuickTime
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-19 06:34 . 2013-01-01 19:48   499712   ----a-w-   c:\windows\SysWow64\msvcp71.dll
2013-06-13 01:03 . 2010-05-04 07:25   75825640   ----a-w-   c:\windows\system32\MRT.exe
2013-06-12 19:48 . 2012-06-04 11:09   867240   ----a-w-   c:\windows\SysWow64\npdeployJava1.dll
2013-06-12 19:48 . 2010-05-21 12:32   789416   ----a-w-   c:\windows\SysWow64\deployJava1.dll
2013-06-12 07:58 . 2012-06-30 06:02   692104   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 07:58 . 2012-06-30 06:02   71048   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-08 06:35 . 2011-07-30 10:13   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll
2013-06-08 06:35 . 2011-07-30 10:13   35656   ----a-w-   c:\windows\system32\LMIport.dll
2013-06-08 06:35 . 2011-07-30 10:13   100680   ----a-w-   c:\windows\system32\LMIinit.dll
2013-05-25 06:39 . 2010-07-29 06:46   107368   ----a-w-   c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-05-11 05:20 . 2010-06-24 10:33   22240   ----a-w-   c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-08 07:29 . 2013-05-08 07:30   723230   ----a-w-   c:\windows\unins000.exe
2013-05-02 00:06 . 2010-04-05 23:43   278800   ------w-   c:\windows\system32\MpSigStub.exe
2013-05-01 01:59 . 2013-05-01 01:59   94208   ----a-w-   c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59 . 2013-05-01 01:59   69632   ----a-w-   c:\windows\SysWow64\QuickTime.qts
2013-04-22 13:57 . 2013-04-22 13:57   163504   ----a-w-   c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin
2013-04-13 05:49 . 2013-05-16 05:43   135168   ----a-w-   c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 05:43   350208   ----a-w-   c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 05:43   308736   ----a-w-   c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 05:43   111104   ----a-w-   c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   474624   ----a-w-   c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 05:43   2176512   ----a-w-   c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 04:40   1656680   ----a-w-   c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-16 05:43   265064   ----a-w-   c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-16 05:43   983400   ----a-w-   c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-16 05:43   3153920   ----a-w-   c:\windows\system32\win32k.sys
2013-04-04 12:50 . 2012-07-19 06:35   25928   ----a-w-   c:\windows\system32\drivers\mbam.sys
2004-04-21 09:38 . 2011-02-03 11:03   446464   ----a-w-   c:\program files (x86)\HPUSBFW.EXE
2003-11-13 11:00 . 2011-02-03 11:03   450560   ----a-w-   c:\program files (x86)\HPUSBF.EXE
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B399EDE8-1525-458C-8DD9-31EADF632D06}]
c:\program files (x86)\LyricsTube\lrcstube.dll [bU]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-24 140520]
"IndexSearch"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\IndexSearch.exe" [2010-06-14 46368]
"PaperPort PTD"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe" [2010-06-14 29984]
"PDFHook"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfpro5hook.exe" [2010-03-05 636192]
"PDF5 Registry Controller"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\RegistryController.exe" [2010-03-05 62752]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"RUNUPDATER"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe" [2010-09-29 465728]
"Dell 1355 MFP RUN"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1ARun.exe" [2010-09-29 2481472]
"StatusAutoRun"="c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe" [2011-01-28 3789632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224]
"TkBellExe"="c:\program files (x86)\Real\realplayer\update\realsched.exe" [2013-06-19 295512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
ISDN Management Center.lnk - c:\windows\Installer\{CB443F79-9AC4-47D5-84D5-7705C71484D2}\_862545E3B28E2DB98CD4DF.exe [2010-6-19 10134]
ISDNWatch.lnk - c:\program files (x86)\FRITZ!\IWatch.exe [2011-5-11 341304]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Iomega StorCenter.lnk - c:\program files (x86)\Iomega StorCenter\sohoclient.exe -s [2013-3-21 1865040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"ProfileQuotaMessage"= Der Profilspeicherplatz ist ausgelastet. Sie müssen einige Profilelemente in das Netzwerk oder auf den lokalen Computer verschieben.
"MaxProfileSize"= 90000 (0x15f90)
"WarnUser"= 1 (0x1)
"WarnUserTimeout"= 60 (0x3c)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSimpleStartMenu"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0\0sdnclean64.exe
.
R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 zvwfadvd;Bluetooth Serial Communications Helper;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 EST_Server;Network USB Device;c:\windows\system32\DRIVERS\GenHC.sys;c:\windows\SYSNATIVE\DRIVERS\GenHC.sys [x]
R3 isdncapi;ISDN CAPI Protocol;c:\windows\system32\DRIVERS\isdncapi.sys;c:\windows\SYSNATIVE\DRIVERS\isdncapi.sys [x]
R3 isdnmpa;ISDN WAN Miniport Driver;c:\windows\system32\DRIVERS\isdnmpa.sys;c:\windows\SYSNATIVE\DRIVERS\isdnmpa.sys [x]
R3 isdnpci;ISDN PCI Driver;c:\windows\system32\DRIVERS\isdnpci.sys;c:\windows\SYSNATIVE\DRIVERS\isdnpci.sys [x]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x]
R3 msftesql-Exchange;Microsoft Search (Exchange);j:\bin\msftesql.exe;j:\bin\msftesql.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 BPowMon;Broadcom Power monitoring service;c:\program files\Broadcom\BPowMon\BPowMon.exe;c:\program files\Broadcom\BPowMon\BPowMon.exe [x]
R4 DLNADB;Dell 1355cn Status Database;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe [x]
R4 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 cFosNT;cFosNT;c:\windows\System32\Drivers\cFosNT.sys;c:\windows\SYSNATIVE\Drivers\cFosNT.sys [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 SplashtopFileFlyService;Splashtop® FileFly Service;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe;c:\program files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 SSUService;Splashtop Software Updater Service;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys;c:\windows\SYSNATIVE\DRIVERS\tmevtmgr.sys [x]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys;c:\windows\SYSNATIVE\DRIVERS\AVMCOWAN.sys [x]
S3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys;c:\windows\SYSNATIVE\DRIVERS\GenBus.sys [x]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys;c:\windows\SYSNATIVE\DRIVERS\fpcibase.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-03 07:58]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   164016   ----a-w-   c:\users\SvenM\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-19 8067616]
"cFosDNT"="c:\program files\cFos\cFosDNT.exe" [2010-05-28 1236184]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2010-01-27 57928]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2010-10-26 194080]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = localhost:21320
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Open with PDF Viewer Plus - c:\program files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
TCP: DhcpNameServer = 10.1.1.10
TCP: Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: NameServer = 10.1.1.1

FF - ProfilePath - c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 61818
FF - prefs.js: network.proxy.type - 4
FF - ExtSQL: 2013-05-08 09:32; {c98699e6-88dc-4890-b996-5440fae41de7}; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}
FF - ExtSQL: 2013-05-17 17:00; adblockpopups@jessehakanen.net; c:\users\SvenM\AppData\Roaming\Mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\adblockpopups@jessehakanen.net.xpi
FF - ExtSQL: 2013-06-19 08:35; {FCE04E1F-9378-4f39-96F6-5689A9159E45}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Notify-SDWinLogon - SDWinLogon.dll
AddRemove-euro-BIS 5.2.6 Arbeitsstation - c:\windows\IsUn0407.exe
AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe
AddRemove-Splashtop Software Updater - c:\program files (x86)\Splashtop\Splashtop Software Updater\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\msftesql-Exchange]
"ImagePath"="j:\bin\msftesql.exe -Exchange -s:Exchange -f:Exchange"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\03\04\08\0f\"\1fu"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-28 08:27:49
ComboFix-quarantined-files.txt 2013-06-28 06:27
ComboFix2.txt 2013-06-27 17:31
ComboFix3.txt 2013-06-27 11:10
ComboFix4.txt 2013-06-26 12:09
ComboFix5.txt 2013-06-28 06:02
.
Vor Suchlauf: 25 Verzeichnis(se), 74.231.525.376 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 73.982.533.632 Bytes frei
.
- - End Of File - - 85B78CF19C316722F1EF85013005003C
D41D8CD98F00B204E9800998ECF8427E

StopVirus · June 28, 2013

I've placed ComboFix.exe and the created script (notepad) on the desktop. Draged the script onto ComboFix.exe. Once finished I get the log that I've sent you and the txt file has disappered. I don't know what I'm doing wrong

Maniac · June 28, 2013

Let's try another way.

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Please tick the Scan All users. Next, click the Quick Scan button. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.

StopVirus · June 28, 2013

OTL logfile created on: 28.06.2013 12:36:30 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,96 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 51,85% Memory free
7,92 Gb Paging File | 5,57 Gb Available in Paging File | 70,35% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 223,50 Gb Total Space | 68,77 Gb Free Space | 30,77% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 145,27 Gb Free Space | 62,40% Space Free | Partition Type: NTFS
Drive H: | 666,73 Gb Total Space | 468,56 Gb Free Space | 70,28% Space Free | Partition Type: NTFS
Drive I: | 666,73 Gb Total Space | 468,56 Gb Free Space | 70,28% Space Free | Partition Type: NTFS
Drive L: | 1860,97 Gb Total Space | 518,92 Gb Free Space | 27,88% Space Free | Partition Type: NTFS
Drive P: | 666,73 Gb Total Space | 468,56 Gb Free Space | 70,28% Space Free | Partition Type: NTFS
Drive R: | 3628,13 Gb Total Space | 1977,29 Gb Free Space | 54,50% Space Free | Partition Type: NTFS

Computer Name: LIBRERIA1 | User Name: SvenM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files (x86)\Real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\OTL.exe (OldTimer Tools)
PRC - C:\Users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServerFF.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRFeatureFF.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe (Dell Inc.)
PRC - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfPro5Hook.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\FRITZ!\IWatch.exe (AVM Berlin)
PRC - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl ()
MOD - C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl ()
MOD - C:\Users\SvenM\AppData\Roaming\Dropbox\bin\libcef.dll ()
MOD - C:\Users\SvenM\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (Crypkey License) -- C:\Windows\SysNative\Crypserv.exe (CrypKey (Canada) Ltd.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (LMIMaint) -- C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe (LogMeIn, Inc.)
SRV - (LMIGuardianSvc) -- C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SSUService) -- C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (SplashtopFileFlyService) -- C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe (Splashtop Inc.)
SRV - (LogMeIn) -- C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (LogMeIn, Inc.)
SRV - (GoToAssist) -- C:\Program Files (x86)\Citrix\GoToAssist\615\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (DLNADB) -- C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe ()
SRV - (TmListen) -- C:\Programme\Trend Micro\Security Agent\TmListen.exe (Trend Micro Inc.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (PDFProFiltSrvPP) -- C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (BPowMon) -- C:\Programme\Broadcom\BPowMon\BPowMon.exe (Broadcom Corp.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AERTFilters) -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV - (SQLWriter) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (LMIRfsClientNP) -- C:\Windows\SysNative\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)
DRV:64bit: - (tmactmon) -- C:\Windows\SysNative\drivers\tmactmon.sys (Trend Micro Inc.)
DRV:64bit: - (tmevtmgr) -- C:\Windows\SysNative\drivers\tmevtmgr.sys (Trend Micro Inc.)
DRV:64bit: - (tmcomm) -- C:\Windows\SysNative\drivers\tmcomm.sys (Trend Micro Inc.)
DRV:64bit: - (ivusb) -- C:\Windows\SysNative\drivers\ivusb.sys (Initio Corporation)
DRV:64bit: - (cFosNT) -- C:\Windows\SysNative\drivers\cFosNT.sys (cFos Software GmbH)
DRV:64bit: - (LMIRfsDriver) -- C:\Windows\SysNative\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV:64bit: - (lmimirr) -- C:\Windows\SysNative\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (k57nd60a) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (ROOTMODEM) -- C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV:64bit: - (FPCIBASE) -- C:\Windows\SysNative\drivers\fpcibase.sys (AVM Berlin)
DRV:64bit: - (AVMCOWAN) -- C:\Windows\SysNative\drivers\avmcowan.sys (AVM GmbH)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SSPORT) -- C:\Windows\SysNative\drivers\SSPORT.SYS (Samsung Electronics)
DRV:64bit: - (DgiVecp) -- C:\Windows\SysNative\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV:64bit: - (EST_Server) -- C:\Windows\SysNative\drivers\GenHC.sys ( )
DRV:64bit: - (EST_BusEnum) -- C:\Windows\SysNative\drivers\GenBus.sys ( )
DRV:64bit: - (NetworkX) -- C:\Windows\SysNative\Ckldrv.sys ()
DRV:64bit: - (isdnpci) -- C:\Windows\SysNative\drivers\isdnpci.sys (Digicom S.p.a.)
DRV:64bit: - (isdnmpa) -- C:\Windows\SysNative\drivers\isdnmpa.sys (Digicom S.p.a.)
DRV:64bit: - (isdncapi) -- C:\Windows\SysNative\drivers\isdncapi.sys (Digicom S.p.a.)
DRV - (LMIInfo) -- C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys (LogMeIn, Inc.)
DRV - (ISODrive) -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys (EZB Systems, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = H:\documents\Downloads
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 95 EB 8D DA 91 FF CD 01 [binary data]
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:21320

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..extensions.enabledAddons: %7Bc98699e6-88dc-4890-b996-5440fae41de7%7D:1.1
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.7
FF - prefs.js..extensions.enabledAddons: %7BFCE04E1F-9378-4f39-96F6-5689A9159E45%7D:1.3.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..extensions.enabledItems: {c98699e6-88dc-4890-b996-5440fae41de7}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1
FF - prefs.js..extensions.enabledItems: LogMeInClient@logmein.com:1.0.0.608
FF - prefs.js..extensions.enabledItems: {22C7F6C6-8D67-4534-92B5-529A0EC09405}:6.6.0.1045
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 61818
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.2.32: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.2.32: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1106\6.6.1045\firefoxextension\ [2012.07.31 10:19:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Security Agent\UIFramework\Toolbar\firefoxextension [2012.07.31 10:12:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FCE04E1F-9378-4f39-96F6-5689A9159E45}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013.06.19 08:35:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.09 18:31:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.19 08:34:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.06.26 12:38:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

[2011.10.06 21:25:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\SvenM\AppData\Roaming\mozilla\Extensions
[2013.06.25 19:05:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\SvenM\AppData\Roaming\mozilla\Firefox\Profiles\9y5mmgv7.default\extensions
[2013.05.08 09:32:53 | 000,000,000 | ---D | M] ("QuickShare Widget") -- C:\Users\SvenM\AppData\Roaming\mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}
[2013.05.17 17:00:37 | 000,134,804 | ---- | M] () (No name found) -- C:\Users\SvenM\AppData\Roaming\mozilla\firefox\profiles\9y5mmgv7.default\extensions\adblockpopups@jessehakanen.net.xpi
[2013.06.07 07:54:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.05.23 10:50:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.05.23 10:50:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.05.23 10:50:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.23 10:50:33 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.06.19 08:35:59 | 000,000,000 | ---D | M] (RealDownloader) -- C:\PROGRAMDATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2013.06.19 08:34:25 | 000,124,504 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.fastbookspa.it/fastlink/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\svenm\AppData\Local\Google\Chrome\Application\12.0.742.122\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Chrome NaCl (Disabled) = C:\Users\svenm\AppData\Local\Google\Chrome\Application\12.0.742.122\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\svenm\AppData\Local\Google\Chrome\Application\12.0.742.122\pdf.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\svenm\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\SvenM\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\SvenM\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3_0\CRX_INSTALL\

O1 HOSTS File: ([2013.06.27 19:18:07 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg.dll (Trend Micro Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg32.dll (Trend Micro Inc.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ToolbarIE.dll (Trend Micro Inc.)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (LyricsTube) - {B399EDE8-1525-458C-8DD9-31EADF632D06} - C:\Program Files (x86)\LyricsTube\lrcstube.dll File not found
O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Trend Micro Toolbar) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ToolbarIE.dll (Trend Micro Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [cFosDNT] C:\Programme\cFos\cfosdnt.exe (cFos Software GmbH)
O4:64bit: - HKLM..\Run: [LogMeIn GUI] C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [seagull Drivers] C:\Windows\ssdal_nc.exe ()
O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Dell 1355 MFP RUN] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1ARun.exe (Dell)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [indexSearch] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfpro5hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RUNUPDATER] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe (Dell Inc.)
O4 - HKLM..\Run: [sDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [startCCC] c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [statusAutoRun] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe (Dell Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ISDN Management Center.lnk = C:\Windows\Installer\{CB443F79-9AC4-47D5-84D5-7705C71484D2}\_862545E3B28E2DB98CD4DF.exe ()
O4 - Startup: C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ISDNWatch.lnk = C:\Program Files (x86)\FRITZ!\IWatch.exe (AVM Berlin)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoAutoTrayNotify = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ProfileQuotaMessage = Der Profilspeicherplatz ist ausgelastet. Sie müssen einige Profilelemente in das Netzwerk oder auf den lokalen Computer verschieben.
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: MaxProfileSize = 90000
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WarnUser = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WarnUserTimeout = 60

O8:64bit: - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll (Zeon Corporation)

O8 - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\..Trusted Domains: europabooks.it ([remote] https in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {9BBB3919-F518-4D06-8209-299FC243FC44} https://server.europa.local:4343/SMB/console/html/root/AtxEnc.cab (Encrypt Class)
O16 - DPF: {9DCD8EB7-E925-45C9-9321-8CA843FBEDCC} https://server.europa.local:4343/SMB/console/html/root/AtxConsole.cab (Security Server Management Console)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.1.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = europa.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: DhcpNameServer = 10.1.1.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: NameServer = 10.1.1.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Handler\tmtb - No CLSID value found
O18:64bit: - Protocol\Handler\tmtbim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Windows\SysWOW64\Msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg32.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ToolbarIE.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll) - C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013.06.28 08:34:18 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.26 12:38:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2013.06.26 07:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Splashtop
[2013.06.25 19:02:06 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.25 19:02:02 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.22 07:44:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.06.21 12:14:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CEDIUM Libri
[2013.06.19 08:36:50 | 000,000,000 | ---D | C] -- C:\Users\SvenM\AppData\Roaming\RealNetworks
[2013.06.19 08:35:59 | 000,000,000 | ---D | C] -- C:\ProgramData\RealNetworks
[2013.06.19 08:35:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RealNetworks
[2013.06.19 08:35:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\xing shared
[2013.06.17 17:14:46 | 000,274,432 | ---- | C] (The OpenSSL Project, http://www.openssl.org/) -- C:\Windows\SysWow64\ssleay32.dll
[2013.06.17 17:14:45 | 001,122,304 | ---- | C] (The OpenSSL Project, http://www.openssl.org/) -- C:\Windows\SysWow64\libeay32.dll
[2013.06.17 17:14:45 | 000,356,352 | ---- | C] (eSellerate Inc.) -- C:\Windows\eSellerateEngine.dll
[2013.06.17 17:14:45 | 000,081,920 | ---- | C] (eSellerate Inc.) -- C:\Windows\eSellerateControl350.dll
[2013.06.17 17:14:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Info Atoms Removal Tool
[2013.06.14 18:01:10 | 000,000,000 | ---D | C] -- C:\SERVER
[2013.06.14 17:34:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013.06.14 17:34:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2013.06.14 17:34:29 | 000,017,272 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe
[2013.06.14 17:34:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2
[2013.06.09 18:37:00 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.06.09 18:37:00 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.06.09 18:37:00 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.06.09 18:31:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013.06.07 08:07:51 | 000,000,000 | ---D | C] -- \\SERVER\User$\SvenM\Desktop\Logs
[2013.06.06 19:33:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RCS Libri Education
[2011.02.03 13:03:54 | 000,450,560 | ---- | C] (Hewlett-Packard Company) -- C:\Program Files (x86)\HPUSBF.EXE
[2011.02.03 13:03:54 | 000,446,464 | ---- | C] (Hewlett-Packard Company) -- C:\Program Files (x86)\HPUSBFW.EXE

========== Files - Modified Within 30 Days ==========

[2013.06.28 12:32:27 | 000,003,918 | ---- | M] () -- C:\Windows\esGUI.INI
[2013.06.28 12:30:36 | 000,018,252 | ---- | M] () -- C:\Windows\eurobook.ini
[2013.06.28 12:30:35 | 000,012,032 | ---- | M] () -- C:\Windows\Esuo04.ini
[2013.06.28 12:10:04 | 000,000,815 | ---- | M] () -- C:\Windows\esListe.INI
[2013.06.28 11:57:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.28 08:42:15 | 000,014,256 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.28 08:42:15 | 000,014,256 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.28 08:31:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.28 08:31:15 | 3189,067,776 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.27 19:18:07 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.25 19:23:05 | 541,449,135 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.06.25 16:37:55 | 002,484,154 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.25 16:37:55 | 001,235,128 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.25 16:37:55 | 000,703,082 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.25 16:37:55 | 000,622,008 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.25 16:37:54 | 000,006,482 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.22 08:10:25 | 000,001,998 | -H-- | M] () -- \\SERVER\User$\SvenM\My Documents\Default.rdp
[2013.06.19 08:34:15 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll
[2013.06.17 23:29:04 | 000,448,635 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20130624-191320.backup
[2013.06.14 13:28:27 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20130617-232904.backup
[2013.06.08 08:35:35 | 000,107,368 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\SysNative\LMIRfsClientNP.dll
[2013.06.08 08:35:34 | 000,100,680 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\SysNative\LMIinit.dll
[2013.06.08 08:35:34 | 000,035,656 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\SysNative\LMIport.dll
[2013.06.08 08:14:57 | 000,001,054 | ---- | M] () -- C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.31 19:48:33 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.31 19:48:31 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf

========== Files Created - No Company Name ==========

[2013.06.14 17:34:34 | 000,001,397 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2013.05.31 19:48:33 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.31 19:48:31 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.05.08 09:30:01 | 000,723,230 | ---- | C] () -- C:\Windows\unins000.exe
[2013.05.08 09:30:01 | 000,048,035 | ---- | C] () -- C:\Windows\unins000.dat
[2013.03.09 10:31:13 | 000,045,772 | ---- | C] () -- C:\Users\SvenM\AppData\Roaming\Switch.dmp
[2012.12.19 22:21:39 | 000,365,824 | ---- | C] () -- C:\Windows\SysWow64\fmmvqqle.dat
[2012.12.19 22:21:39 | 000,153,856 | ---- | C] () -- C:\Windows\SysWow64\ivxmkign.dat
[2012.12.19 22:21:39 | 000,136,960 | ---- | C] () -- C:\Windows\SysWow64\llxaindl.dat
[2012.12.19 22:21:39 | 000,036,608 | ---- | C] () -- C:\Windows\SysWow64\accqxlll.dat
[2012.12.19 22:21:39 | 000,034,048 | ---- | C] () -- C:\Windows\SysWow64\fljjzegs.dat
[2012.12.11 22:43:21 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.11.17 08:26:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.11.17 08:26:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.11.17 08:26:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.11.17 08:26:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.09.28 04:05:12 | 000,408,576 | ---- | C] () -- C:\Windows\SysWow64\hpcc3140.DLL
[2012.09.20 11:00:37 | 000,000,014 | ---- | C] () -- C:\Windows\hpmssnpjt.ini
[2012.03.26 10:57:25 | 000,000,264 | ---- | C] () -- C:\ProgramData\~ElNK5iz0ZfKie3
[2012.03.26 10:57:25 | 000,000,176 | ---- | C] () -- C:\ProgramData\~ElNK5iz0ZfKie3r
[2012.03.26 10:53:31 | 000,000,440 | ---- | C] () -- C:\ProgramData\ElNK5iz0ZfKie3
[2012.03.26 10:51:11 | 000,012,800 | ---- | C] () -- C:\Windows\DCEBoot64.exe
[2011.12.17 18:44:25 | 000,130,048 | ---- | C] () -- C:\Windows\SysWow64\dlnafJBF.DLL
[2011.10.09 23:17:37 | 000,000,085 | ---- | C] () -- C:\Users\SvenM\AppData\Roaming\wfbshelp.ini
[2011.10.06 21:10:31 | 000,010,566 | RHS- | C] () -- C:\Users\SvenM\ntuser.pol
[2011.09.28 11:34:44 | 000,316,928 | ---- | C] () -- C:\Windows\SysWow64\hpcc3117.DLL
[2011.09.12 10:52:54 | 000,000,028 | ---- | C] () -- C:\Windows\pdf995.ini
[2011.09.12 10:51:53 | 000,047,616 | ---- | C] () -- C:\Windows\SysWow64\pdf995mon64.dll
[2011.09.12 10:51:53 | 000,000,060 | ---- | C] () -- C:\Windows\wpd99.drv
[2011.07.21 08:52:25 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.06.30 17:53:54 | 000,063,488 | ---- | C] () -- C:\Windows\ssdal_nc.exe
[2010.04.03 15:32:17 | 000,048,500 | RHS- | C] () -- C:\ProgramData\ntuser.pol

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 04:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011.10.06 21:12:52 | 000,000,000 | ---D | M] -- C:\Users\SBSAdmin\AppData\Roaming\FRITZ!
[2011.10.06 21:12:46 | 000,000,000 | ---D | M] -- C:\Users\SBSAdmin\AppData\Roaming\Windows Small Business Server
[2012.08.09 16:58:02 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\.oit
[2011.10.09 23:17:40 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\AstroGrep
[2013.05.11 12:08:33 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Azureus
[2013.01.18 18:35:45 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\calibre
[2013.06.28 08:34:56 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Dropbox
[2011.10.07 15:31:18 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\esProtokolle
[2011.10.09 23:17:40 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\EssentialGrammarInUse
[2011.11.15 17:48:04 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\FileZilla
[2012.09.03 09:50:00 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\FreePDF
[2012.12.12 10:21:03 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\FRITZ!
[2012.03.08 19:15:56 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\IrfanView
[2011.10.11 06:28:05 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Myybil
[2012.09.12 19:11:43 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Nokia
[2011.10.09 23:17:56 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Nuance
[2011.10.10 12:15:43 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Nuke
[2012.09.12 18:27:02 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\PC Suite
[2011.10.09 23:17:56 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\pdf995
[2012.09.03 10:09:46 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Softland
[2011.10.09 23:18:05 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Stegisoft
[2011.10.09 23:18:06 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Swiftdata
[2013.05.16 09:32:17 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\TeamViewer
[2013.01.14 08:48:22 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Thunderbird
[2013.06.27 19:50:16 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\TuneUpMedia
[2011.10.06 21:10:31 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Windows Small Business Server
[2011.10.09 23:18:06 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\WinPump
[2011.10.09 23:18:06 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Zeon
[2011.10.06 20:59:02 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\FRITZ!

========== Purity Check ==========

< End of report >

StopVirus · June 28, 2013

I've done as you requested. Quick scan on all users but no Extras.txt has been created (I've also checked where OTL is and I can only find the OTL.txt

Maniac · June 28, 2013

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O2 - BHO: (LyricsTube) - {B399EDE8-1525-458C-8DD9-31EADF632D06} - C:\Program Files (x86)\LyricsTube\lrcstube.dll File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
[2012.12.19 22:21:39 | 000,365,824 | ---- | C] () -- C:\Windows\SysWow64\fmmvqqle.dat
[2012.12.19 22:21:39 | 000,153,856 | ---- | C] () -- C:\Windows\SysWow64\ivxmkign.dat
[2012.12.19 22:21:39 | 000,136,960 | ---- | C] () -- C:\Windows\SysWow64\llxaindl.dat
[2012.12.19 22:21:39 | 000,036,608 | ---- | C] () -- C:\Windows\SysWow64\accqxlll.dat
[2012.12.19 22:21:39 | 000,034,048 | ---- | C] () -- C:\Windows\SysWow64\fljjzegs.dat
[2012.03.26 10:57:25 | 000,000,264 | ---- | C] () -- C:\ProgramData\~ElNK5iz0ZfKie3
[2012.03.26 10:57:25 | 000,000,176 | ---- | C] () -- C:\ProgramData\~ElNK5iz0ZfKie3r
[2012.03.26 10:53:31 | 000,000,440 | ---- | C] () -- C:\ProgramData\ElNK5iz0ZfKie3
:files
C:\Program Files (x86)\LyricsTube
C:\ProgramData\LyricsTube
ipconfig /flushdns /c
:Commands
[emptytemp]
[clearallrestorepoints]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Please post the OTL fix log in your next reply.

Note: A copy of an OTL fix log is saved in a text file at C:\_OTL\MovedFiles

StopVirus · June 28, 2013

I did everything... before rebooting I got a message saying "Errors on creating log file" (it was written in German)... once booted I got the same message again and no log file has been created (I've checked at C:\_OTL\MovedFiles)

Maniac · June 28, 2013

Please generate a new fresh OTL log file and post it here.

StopVirus · June 28, 2013

Unfortunately I get the exact same result:

Path has not been found!

Maniac · June 28, 2013

No, I mean to create a new log file like my first post about OTL.

http://forums.malwarebytes.org/index.php?showtopic=128307&p=696480

StopVirus · June 29, 2013

The Extra.txt log is missing:

OTL logfile created on: 29.06.2013 07:17:33 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,96 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 50,43% Memory free
7,92 Gb Paging File | 5,94 Gb Available in Paging File | 75,06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 223,50 Gb Total Space | 70,40 Gb Free Space | 31,50% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 145,27 Gb Free Space | 62,40% Space Free | Partition Type: NTFS
Drive H: | 666,73 Gb Total Space | 468,48 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
Drive I: | 666,73 Gb Total Space | 468,48 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
Drive L: | 1860,97 Gb Total Space | 518,87 Gb Free Space | 27,88% Space Free | Partition Type: NTFS
Drive P: | 666,73 Gb Total Space | 468,48 Gb Free Space | 70,27% Space Free | Partition Type: NTFS
Drive R: | 3628,13 Gb Total Space | 1976,57 Gb Free Space | 54,48% Space Free | Partition Type: NTFS

Computer Name: LIBRERIA1 | User Name: SvenM | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files (x86)\Real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - \\SERVER\User$\SvenM\Desktop\Tools\PC Cleaner Progs\OTL.exe (OldTimer Tools)
PRC - C:\Users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServerFF.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRFeatureFF.exe (Splashtop Inc.)
PRC - C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe (Dell Inc.)
PRC - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfPro5Hook.exe (Nuance Communications, Inc.)
PRC - C:\Program Files (x86)\FRITZ!\IWatch.exe (AVM Berlin)
PRC - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)

========== Modules (No Company Name) ==========

MOD - C:\Users\SvenM\AppData\Roaming\Dropbox\bin\libcef.dll ()
MOD - C:\Users\SvenM\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()

========== Services (SafeList) ==========

SRV:64bit: - (Amsp) -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (Crypkey License) -- C:\Windows\SysNative\Crypserv.exe (CrypKey (Canada) Ltd.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (LMIMaint) -- C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe (LogMeIn, Inc.)
SRV - (LMIGuardianSvc) -- C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (SSUService) -- C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe (Splashtop Inc.)
SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (RealNetworks Downloader Resolver Service) -- C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe ()
SRV - (SplashtopFileFlyService) -- C:\Program Files (x86)\Splashtop\Splashtop Remote\FileFly\SRServiceFF.exe (Splashtop Inc.)
SRV - (LogMeIn) -- C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (LogMeIn, Inc.)
SRV - (GoToAssist) -- C:\Program Files (x86)\Citrix\GoToAssist\615\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (DLNADB) -- C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Adb.exe ()
SRV - (TmListen) -- C:\Programme\Trend Micro\Security Agent\TmListen.exe (Trend Micro Inc.)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (PDFProFiltSrvPP) -- C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\PDFProFiltSrvPP.exe (Nuance Communications, Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (BPowMon) -- C:\Programme\Broadcom\BPowMon\BPowMon.exe (Broadcom Corp.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (AERTFilters) -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV - (SQLWriter) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (LMIRfsClientNP) -- C:\Windows\SysNative\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation)
DRV:64bit: - (tmtdi) -- C:\Windows\SysNative\drivers\tmtdi.sys (Trend Micro Inc.)
DRV:64bit: - (tmactmon) -- C:\Windows\SysNative\drivers\tmactmon.sys (Trend Micro Inc.)
DRV:64bit: - (tmevtmgr) -- C:\Windows\SysNative\drivers\tmevtmgr.sys (Trend Micro Inc.)
DRV:64bit: - (tmcomm) -- C:\Windows\SysNative\drivers\tmcomm.sys (Trend Micro Inc.)
DRV:64bit: - (ivusb) -- C:\Windows\SysNative\drivers\ivusb.sys (Initio Corporation)
DRV:64bit: - (cFosNT) -- C:\Windows\SysNative\drivers\cFosNT.sys (cFos Software GmbH)
DRV:64bit: - (LMIRfsDriver) -- C:\Windows\SysNative\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV:64bit: - (lmimirr) -- C:\Windows\SysNative\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (k57nd60a) -- C:\Windows\SysNative\drivers\k57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (ROOTMODEM) -- C:\Windows\SysNative\drivers\rootmdm.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV:64bit: - (FPCIBASE) -- C:\Windows\SysNative\drivers\fpcibase.sys (AVM Berlin)
DRV:64bit: - (AVMCOWAN) -- C:\Windows\SysNative\drivers\avmcowan.sys (AVM GmbH)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SSPORT) -- C:\Windows\SysNative\drivers\SSPORT.SYS (Samsung Electronics)
DRV:64bit: - (DgiVecp) -- C:\Windows\SysNative\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV:64bit: - (EST_Server) -- C:\Windows\SysNative\drivers\GenHC.sys ( )
DRV:64bit: - (EST_BusEnum) -- C:\Windows\SysNative\drivers\GenBus.sys ( )
DRV:64bit: - (NetworkX) -- C:\Windows\SysNative\Ckldrv.sys ()
DRV:64bit: - (isdnpci) -- C:\Windows\SysNative\drivers\isdnpci.sys (Digicom S.p.a.)
DRV:64bit: - (isdnmpa) -- C:\Windows\SysNative\drivers\isdnmpa.sys (Digicom S.p.a.)
DRV:64bit: - (isdncapi) -- C:\Windows\SysNative\drivers\isdncapi.sys (Digicom S.p.a.)
DRV - (LMIInfo) -- C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys (LogMeIn, Inc.)
DRV - (ISODrive) -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys (EZB Systems, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = H:\documents\Downloads
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 95 EB 8D DA 91 FF CD 01 [binary data]
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:21320

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..extensions.enabledAddons: %7Bc98699e6-88dc-4890-b996-5440fae41de7%7D:1.1
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.7
FF - prefs.js..extensions.enabledAddons: %7BFCE04E1F-9378-4f39-96F6-5689A9159E45%7D:1.3.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0
FF - prefs.js..extensions.enabledItems: {c98699e6-88dc-4890-b996-5440fae41de7}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1
FF - prefs.js..extensions.enabledItems: LogMeInClient@logmein.com:1.0.0.608
FF - prefs.js..extensions.enabledItems: {22C7F6C6-8D67-4534-92B5-529A0EC09405}:6.6.0.1045
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 61818
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=16.0.2.32: c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlchromebrowserrecordext;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlhtml5videoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprndlpepperflashvideoshim;version=1.3.2: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=16.0.2.32: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\@realnetworks.com/npdlplugin;version=1: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.6.1106\6.6.1045\firefoxextension\ [2012.07.31 10:19:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22181a4d-af90-4ca3-a569-faed9118d6bc}: C:\Program Files\Trend Micro\Security Agent\UIFramework\Toolbar\firefoxextension [2012.07.31 10:12:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FCE04E1F-9378-4f39-96F6-5689A9159E45}: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ [2013.06.19 08:35:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.06.09 18:31:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.06.19 08:34:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.7\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.06.26 12:38:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins

[2011.10.06 21:25:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\SvenM\AppData\Roaming\mozilla\Extensions
[2013.06.25 19:05:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\SvenM\AppData\Roaming\mozilla\Firefox\Profiles\9y5mmgv7.default\extensions
[2013.05.08 09:32:53 | 000,000,000 | ---D | M] ("QuickShare Widget") -- C:\Users\SvenM\AppData\Roaming\mozilla\Firefox\Profiles\9y5mmgv7.default\extensions\{c98699e6-88dc-4890-b996-5440fae41de7}
[2013.05.17 17:00:37 | 000,134,804 | ---- | M] () (No name found) -- C:\Users\SvenM\AppData\Roaming\mozilla\firefox\profiles\9y5mmgv7.default\extensions\adblockpopups@jessehakanen.net.xpi
[2013.06.07 07:54:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.05.23 10:50:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.05.23 10:50:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.05.23 10:50:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013.05.23 10:50:33 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.06.19 08:35:59 | 000,000,000 | ---D | M] (RealDownloader) -- C:\PROGRAMDATA\REALNETWORKS\REALDOWNLOADER\BROWSERPLUGINS\FIREFOX\EXT
[2013.06.19 08:34:25 | 000,124,504 | ---- | M] (RealPlayer) -- C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - homepage: http://www.fastbookspa.it/fastlink/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\svenm\AppData\Local\Google\Chrome\Application\12.0.742.122\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java Platform SE 6 U24 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll
CHR - plugin: RealPlayer HTML5VideoShim Plug-In (32-bit) (Enabled) = C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Chrome NaCl (Disabled) = C:\Users\svenm\AppData\Local\Google\Chrome\Application\12.0.742.122\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\svenm\AppData\Local\Google\Chrome\Application\12.0.742.122\pdf.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\svenm\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\SvenM\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3_0\
CHR - Extension: RealPlayer HTML5Video Downloader Extension = C:\Users\SvenM\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.3_0\CRX_INSTALL\

O1 HOSTS File: ([2013.06.27 19:18:07 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg.dll (Trend Micro Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg32.dll (Trend Micro Inc.)
O2 - BHO: (RealNetworks Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
O2 - BHO: (TSToolbarBHO) - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ToolbarIE.dll (Trend Micro Inc.)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Trend Micro Toolbar) - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ToolbarIE.dll (Trend Micro Inc.)
O4:64bit: - HKLM..\Run: [cFosDNT] C:\Programme\cFos\cfosdnt.exe (cFos Software GmbH)
O4:64bit: - HKLM..\Run: [LogMeIn GUI] C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (LogMeIn, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [seagull Drivers] C:\Windows\ssdal_nc.exe ()
O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Dell 1355 MFP RUN] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1ARun.exe (Dell)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files (x86)\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [indexSearch] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\pdfpro5hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RUNUPDATER] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Updater\dlu1Aupr.exe (Dell Inc.)
O4 - HKLM..\Run: [sDTray] C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.)
O4 - HKLM..\Run: [startCCC] c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [statusAutoRun] C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\Status Monitor\dlp1Apl.exe (Dell Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - Startup: C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\SvenM\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ISDN Management Center.lnk = C:\Windows\Installer\{CB443F79-9AC4-47D5-84D5-7705C71484D2}\_862545E3B28E2DB98CD4DF.exe ()
O4 - Startup: C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ISDNWatch.lnk = C:\Program Files (x86)\FRITZ!\IWatch.exe (AVM Berlin)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Policies\Microsoft\Internet Explorer\Main present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoAutoTrayNotify = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ProfileQuotaMessage = Der Profilspeicherplatz ist ausgelastet. Sie müssen einige Profilelemente in das Netzwerk oder auf den lokalen Computer verschieben.
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: MaxProfileSize = 90000
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WarnUser = 1
O7 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WarnUserTimeout = 60

O8:64bit: - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll (Zeon Corporation)

O8 - Extra context menu item: Open with PDF Viewer Plus - C:\Program Files (x86)\Dell Printers\Dell 1355 Multifunction Color Printer\PDFViewer\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1874033450-1098667305-2173978336-1165\..Trusted Domains: europabooks.it ([remote] https in Local intranet)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {9BBB3919-F518-4D06-8209-299FC243FC44} https://server.europa.local:4343/SMB/console/html/root/AtxEnc.cab (Encrypt Class)
O16 - DPF: {9DCD8EB7-E925-45C9-9321-8CA843FBEDCC} https://server.europa.local:4343/SMB/console/html/root/AtxConsole.cab (Security Server Management Console)
O16 - DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 1.7.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.1.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = europa.local
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: DhcpNameServer = 10.1.1.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1DA23423-D5EC-496B-86F6-9C2E2F9916FC}: NameServer = 10.1.1.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Handler\tmtb - No CLSID value found
O18:64bit: - Protocol\Handler\tmtbim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Windows\SysWOW64\Msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Programme\Trend Micro\AMSP\module\20004\1.6.1106\6.6.1045\TmIEPlg32.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmtb {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ToolbarIE.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmtbim {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Programme\Trend Micro\Security Agent\UIFrameWork\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll) - C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013.06.28 08:34:18 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.06.26 12:38:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2013.06.26 07:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Splashtop
[2013.06.25 19:02:06 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.06.25 19:02:02 | 000,000,000 | ---D | C] -- C:\JRT
[2013.06.22 07:44:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.06.21 12:14:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CEDIUM Libri
[2013.06.19 08:36:50 | 000,000,000 | ---D | C] -- C:\Users\SvenM\AppData\Roaming\RealNetworks
[2013.06.19 08:35:59 | 000,000,000 | ---D | C] -- C:\ProgramData\RealNetworks
[2013.06.19 08:35:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RealNetworks
[2013.06.19 08:35:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\xing shared
[2013.06.17 17:14:46 | 000,274,432 | ---- | C] (The OpenSSL Project, http://www.openssl.org/) -- C:\Windows\SysWow64\ssleay32.dll
[2013.06.17 17:14:45 | 001,122,304 | ---- | C] (The OpenSSL Project, http://www.openssl.org/) -- C:\Windows\SysWow64\libeay32.dll
[2013.06.17 17:14:45 | 000,356,352 | ---- | C] (eSellerate Inc.) -- C:\Windows\eSellerateEngine.dll
[2013.06.17 17:14:45 | 000,081,920 | ---- | C] (eSellerate Inc.) -- C:\Windows\eSellerateControl350.dll
[2013.06.17 17:14:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Info Atoms Removal Tool
[2013.06.14 18:01:10 | 000,000,000 | ---D | C] -- C:\SERVER
[2013.06.14 17:34:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013.06.14 17:34:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
[2013.06.14 17:34:29 | 000,017,272 | ---- | C] (Safer Networking Limited) -- C:\Windows\SysNative\sdnclean64.exe
[2013.06.14 17:34:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy 2
[2013.06.09 18:37:00 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.06.09 18:37:00 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.06.09 18:37:00 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.06.09 18:31:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2013.06.07 08:07:51 | 000,000,000 | ---D | C] -- \\SERVER\User$\SvenM\Desktop\Logs
[2013.06.06 19:33:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RCS Libri Education
[2011.02.03 13:03:54 | 000,450,560 | ---- | C] (Hewlett-Packard Company) -- C:\Program Files (x86)\HPUSBF.EXE
[2011.02.03 13:03:54 | 000,446,464 | ---- | C] (Hewlett-Packard Company) -- C:\Program Files (x86)\HPUSBFW.EXE

========== Files - Modified Within 30 Days ==========

[2013.06.29 07:21:10 | 000,014,256 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.29 07:21:10 | 000,014,256 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.29 07:13:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.29 07:13:09 | 3189,067,776 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.28 19:02:56 | 000,003,912 | ---- | M] () -- C:\Windows\esGUI.INI
[2013.06.28 19:02:17 | 000,018,252 | ---- | M] () -- C:\Windows\eurobook.ini
[2013.06.28 19:01:52 | 000,000,815 | ---- | M] () -- C:\Windows\esListe.INI
[2013.06.28 18:59:55 | 000,012,032 | ---- | M] () -- C:\Windows\Esuo04.ini
[2013.06.28 18:57:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.28 15:22:22 | 755,390,895 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.06.27 19:18:07 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.25 16:37:55 | 002,484,154 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.25 16:37:55 | 001,235,128 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.25 16:37:55 | 000,703,082 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.25 16:37:55 | 000,622,008 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.25 16:37:54 | 000,006,482 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.22 08:10:25 | 000,001,998 | -H-- | M] () -- \\SERVER\User$\SvenM\My Documents\Default.rdp
[2013.06.19 08:34:15 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll
[2013.06.17 23:29:04 | 000,448,635 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20130624-191320.backup
[2013.06.14 13:28:27 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20130617-232904.backup
[2013.06.08 08:35:35 | 000,107,368 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\SysNative\LMIRfsClientNP.dll
[2013.06.08 08:35:34 | 000,100,680 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\SysNative\LMIinit.dll
[2013.06.08 08:35:34 | 000,035,656 | ---- | M] (LogMeIn, Inc.) -- C:\Windows\SysNative\LMIport.dll
[2013.06.08 08:14:57 | 000,001,054 | ---- | M] () -- C:\Users\SvenM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.05.31 19:48:33 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.31 19:48:31 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf

========== Files Created - No Company Name ==========

[2013.06.14 17:34:34 | 000,001,397 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
[2013.05.31 19:48:33 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.31 19:48:31 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.05.08 09:30:01 | 000,723,230 | ---- | C] () -- C:\Windows\unins000.exe
[2013.05.08 09:30:01 | 000,048,035 | ---- | C] () -- C:\Windows\unins000.dat
[2013.03.09 10:31:13 | 000,045,772 | ---- | C] () -- C:\Users\SvenM\AppData\Roaming\Switch.dmp
[2012.12.19 22:21:39 | 000,365,824 | ---- | C] () -- C:\Windows\SysWow64\fmmvqqle.dat
[2012.12.19 22:21:39 | 000,153,856 | ---- | C] () -- C:\Windows\SysWow64\ivxmkign.dat
[2012.12.19 22:21:39 | 000,136,960 | ---- | C] () -- C:\Windows\SysWow64\llxaindl.dat
[2012.12.19 22:21:39 | 000,036,608 | ---- | C] () -- C:\Windows\SysWow64\accqxlll.dat
[2012.12.19 22:21:39 | 000,034,048 | ---- | C] () -- C:\Windows\SysWow64\fljjzegs.dat
[2012.12.11 22:43:21 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.11.17 08:26:09 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.11.17 08:26:09 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.11.17 08:26:09 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.11.17 08:26:09 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.09.28 04:05:12 | 000,408,576 | ---- | C] () -- C:\Windows\SysWow64\hpcc3140.DLL
[2012.09.20 11:00:37 | 000,000,014 | ---- | C] () -- C:\Windows\hpmssnpjt.ini
[2012.03.26 10:57:25 | 000,000,264 | ---- | C] () -- C:\ProgramData\~ElNK5iz0ZfKie3
[2012.03.26 10:57:25 | 000,000,176 | ---- | C] () -- C:\ProgramData\~ElNK5iz0ZfKie3r
[2012.03.26 10:53:31 | 000,000,440 | ---- | C] () -- C:\ProgramData\ElNK5iz0ZfKie3
[2012.03.26 10:51:11 | 000,012,800 | ---- | C] () -- C:\Windows\DCEBoot64.exe
[2011.12.17 18:44:25 | 000,130,048 | ---- | C] () -- C:\Windows\SysWow64\dlnafJBF.DLL
[2011.10.09 23:17:37 | 000,000,085 | ---- | C] () -- C:\Users\SvenM\AppData\Roaming\wfbshelp.ini
[2011.10.06 21:10:31 | 000,010,566 | RHS- | C] () -- C:\Users\SvenM\ntuser.pol
[2011.09.28 11:34:44 | 000,316,928 | ---- | C] () -- C:\Windows\SysWow64\hpcc3117.DLL
[2011.09.12 10:52:54 | 000,000,028 | ---- | C] () -- C:\Windows\pdf995.ini
[2011.09.12 10:51:53 | 000,047,616 | ---- | C] () -- C:\Windows\SysWow64\pdf995mon64.dll
[2011.09.12 10:51:53 | 000,000,060 | ---- | C] () -- C:\Windows\wpd99.drv
[2011.07.21 08:52:25 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2011.06.30 17:53:54 | 000,063,488 | ---- | C] () -- C:\Windows\ssdal_nc.exe
[2010.04.03 15:32:17 | 000,048,500 | RHS- | C] () -- C:\ProgramData\ntuser.pol

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 04:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2011.10.06 21:12:52 | 000,000,000 | ---D | M] -- C:\Users\SBSAdmin\AppData\Roaming\FRITZ!
[2011.10.06 21:12:46 | 000,000,000 | ---D | M] -- C:\Users\SBSAdmin\AppData\Roaming\Windows Small Business Server
[2012.08.09 16:58:02 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\.oit
[2011.10.09 23:17:40 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\AstroGrep
[2013.05.11 12:08:33 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Azureus
[2013.01.18 18:35:45 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\calibre
[2013.06.29 07:14:49 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Dropbox
[2011.10.07 15:31:18 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\esProtokolle
[2011.10.09 23:17:40 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\EssentialGrammarInUse
[2011.11.15 17:48:04 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\FileZilla
[2012.09.03 09:50:00 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\FreePDF
[2012.12.12 10:21:03 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\FRITZ!
[2012.03.08 19:15:56 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\IrfanView
[2011.10.11 06:28:05 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Myybil
[2012.09.12 19:11:43 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Nokia
[2011.10.09 23:17:56 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Nuance
[2011.10.10 12:15:43 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Nuke
[2012.09.12 18:27:02 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\PC Suite
[2011.10.09 23:17:56 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\pdf995
[2012.09.03 10:09:46 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Softland
[2011.10.09 23:18:05 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Stegisoft
[2011.10.09 23:18:06 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Swiftdata
[2013.05.16 09:32:17 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\TeamViewer
[2013.01.14 08:48:22 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Thunderbird
[2013.06.27 19:50:16 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\TuneUpMedia
[2011.10.06 21:10:31 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Windows Small Business Server
[2011.10.09 23:18:06 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\WinPump
[2011.10.09 23:18:06 | 000,000,000 | ---D | M] -- C:\Users\SvenM\AppData\Roaming\Zeon
[2011.10.06 20:59:02 | 000,000,000 | ---D | M] -- C:\Users\test\AppData\Roaming\FRITZ!

========== Purity Check ==========

< End of report >

Unwanted pop-up ads in Firefox and IE

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information