PC (Vista) fährt nur noch im abgesicherten Modus hoch

shogun74 · 01.12.2011, 09:45

Hallo,
gestern kam bei mir folgende Meldung: Achtung, aus Sicherheitsgründen wurde Ihr Windows System blockiert. - Auch nach mehrmaligem Neustart.
Habe dann im Abgesicherten Modus eine Systemwiederherstellung durchgeführt. Nun fährt der PC (Vista) nur noch im abgesicherten Modus hoch. Was kann ich tun, damit Windows wieder normal läuft?
Habe mit OTL gescannt: siehe Anhang
Wäre echt super, wenn mir bei diesem Problem jemand weiterhelfen könnte!

Larusso · 01.12.2011, 16:55

Mein Name ist Daniel und ich werde dir mit deinem Malware Relevanten Problemen helfen.

Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.

Lies dir meine Anleitungen erst einmal durch. Sollte irgendetwas unklar sein, Frage bevor du beginnst.
Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden
Sollte ich innerhalb der nächsten 3 Tage keine Antwort von dir erhalten, werde ich das Thema aus meinen Abonnements löschen.
Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst und Installiere / Deinstalliere keine Software ohne Aufforderung.
Poste die Logfiles direkt in deinen Thread und nicht als Anhang, ausser du wurdest dazu aufgefordert. Erschwert mir das Auswerten.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

:otl
[2009.12.11 20:11:35 | 000,001,361 | ---- | C] () -- C:\Users\Tobias\AppData\Local\tidkhu.exe
[2009.12.09 20:11:11 | 000,001,361 | ---- | C] () -- C:\Users\Tobias\AppData\Local\tqwubx.exe
[2009.12.07 20:09:53 | 000,001,361 | ---- | C] () -- C:\Users\Tobias\AppData\Local\gaslmffr.exe
[2009.12.03 20:09:10 | 000,235,861 | ---- | C] () -- C:\Users\Tobias\AppData\Local\lkiah_nav.dat
[2009.12.03 20:09:10 | 000,005,619 | ---- | C] () -- C:\Users\Tobias\AppData\Local\lkiah_navps.dat
[2009.12.03 20:09:10 | 000,003,383 | ---- | C] () -- C:\Users\Tobias\AppData\Local\lkiah.dat
[2009.12.01 19:34:06 | 000,001,361 | ---- | C] () -- C:\Users\Tobias\AppData\Local\bwkiu.exe
[2009.11.28 19:59:36 | 000,001,361 | ---- | C] () -- C:\Users\Tobias\AppData\Local\xilch.exe
[2009.11.26 19:59:13 | 000,001,361 | ---- | C] () -- C:\Users\Tobias\AppData\Local\trpntyde.exe
[2009.11.24 19:58:50 | 000,001,361 | ---- | C] () -- C:\Users\Tobias\AppData\Local\amxdp.exe
CHR - Extension: No name found = C:\Users\Tobias\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.1\
:commands
[emptytemp]

Schliesse bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt )
Kopiere nun den Inhalt hier in Deinen Thread

Bitte poste in deiner nächsten Antwort
Berichte ob der Rechner wieder normal startet

shogun74 · 01.12.2011, 21:40

Hallo Daniel,
danke für Deine Mühe! Habe alles so ausgeführt wie beschrieben.
Leider erschein nach dem Neustart kein Textdokument. Auch nicht unter der Eingabe C:\_OTL\MovedFiles\<time_date>.txt. Der Rechner fährt leider weiterhin nur im Abges. Modus hoch!
mfg

Larusso · 01.12.2011, 22:01

Kein Problem.

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\*.manifest /3
/md5start
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Wenn der Scan beendet wurde, wird sich ein Textdokument öffnen.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

shogun74 · 01.12.2011, 22:23

So, der Scan ist durch; hier der Inhalt des Textdokuments:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 01.12.2011 22:12:34 - Run 2
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Tobias\Desktop\Pictures\Mallorca
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,37 Gb Total Physical Memory | 2,85 Gb Available Physical Memory | 84,66% Memory free
6,92 Gb Paging File | 6,60 Gb Available in Paging File | 95,46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 315,34 Gb Total Space | 97,63 Gb Free Space | 30,96% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 10,84 Gb Free Space | 54,22% Space Free | Partition Type: FAT32
 
Computer Name: TOBIAS-PC | User Name: Tobias | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Tobias\Desktop\Pictures\Mallorca\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\WinRAR\RarExt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (a2free) -- C:\Program Files\a-squared Free\a2service.exe (Emsi Software GmbH)
SRV - (ServiceLayer) -- C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (srvcPVR) -- C:\Program Files\Sceneo\AbsolutTV\Services\PVR\pvrservice.exe (Buhl Data Service GmbH)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe (MAGIX®)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (x10nets) -- C:\Program Files\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (LTXMD_VAC) Litex Media Virtual Audio Cabel (WDM) -- C:\Windows\System32\drivers\lmvac.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (PAC7311) -- C:\Windows\System32\drivers\PA707UCM.SYS (PixArt Imaging Inc.)
DRV - (ElbyDelay) -- C:\Windows\System32\drivers\ElbyDelay.sys (Elaborate Bytes AG)
DRV - (3xHybrid) -- C:\Windows\System32\drivers\3xHybrid.sys (Philips Semiconductors GmbH)
DRV - (ElbyCDFL) -- C:\Windows\System32\drivers\ElbyCDFL.sys (SlySoft, Inc.)
DRV - (Atc002) -- C:\Windows\System32\drivers\L260x86.sys (Attansic Corporation)
DRV - (XUIF) -- C:\Windows\System32\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.)
DRV - (X10Hid) -- C:\Windows\System32\drivers\x10hid.sys (X10 Wireless Technology, Inc.)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (NPF) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies)
DRV - (ASPI) -- C:\Windows\System32\drivers\ASPI32.SYS (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=445c8bd8000000000000001d60409b1e&tlver=1.4.19.19&affID=17160
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Nachrichten - Service - Shopping bei t-online.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.startzentrale.de"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Tobias\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.12.01 01:49:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.09.08 11:10:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\finder@meingutscheincode.de: C:\Program Files\Mein Gutscheincode Finder\Firefox [2011.07.14 17:29:09 | 000,000,000 | ---D | M]
 
[2011.09.08 11:10:54 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tobias\AppData\Roaming\mozilla\Extensions
[2011.09.08 11:10:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011.07.14 17:29:09 | 000,000,000 | ---D | M] (preisspion.de) -- C:\PROGRAM FILES\MEIN GUTSCHEINCODE FINDER\FIREFOX
[2009.09.02 08:50:46 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011.09.03 07:18:05 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.09.03 01:19:44 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.06.29 11:23:56 | 000,002,423 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011.09.03 01:13:56 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.09.03 01:19:44 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.03 01:19:44 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.03 01:19:44 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.03 01:19:44 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können.) - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll (Conversion One GmbH)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH)
O2 - BHO: (TBSB03968 Class) - {AA61DE26-FA67-4575-9033-918671094293} - C:\Users\Tobias\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll ()
O3 - HKLM\..\Toolbar: (Toolbar fuer eBay) - {000E148C-F7A7-445A-9044-93BF6CE09ECB} - C:\Users\Tobias\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll ()
O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (Toolbar fuer eBay) - {000E148C-F7A7-445A-9044-93BF6CE09ECB} - C:\Users\Tobias\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Germany GmbH)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [PAC7311_Monitor] C:\Windows\PixArt\PAC7311\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Program Files\GoogleEULA\EULALauncher.exe ( )
O4 - HKLM..\Run: [TVBroadcast] C:\Program Files\Sceneo\AbsolutTV\Services\ODSBC\ODSBCApp.exe (ODSoft multimedia)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [EPSON S21 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIFAE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [Facebook Update] C:\Users\Tobias\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay - eine der größten deutschen Shopping-Websites File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay - eine der größten deutschen Shopping-Websites File not found
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 82.212.62.62 78.42.43.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1E3850FD-2FB6-416C-9615-75C779B99C9D}: DhcpNameServer = 82.212.62.62 78.42.43.62
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Tobias\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\Program Files\DVD Region+CSS Free\DVDShell.dll (Fengtao Software Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{42d18859-8d69-11de-a7ec-001d60409b1e}\Shell\AutoRun\command - "" = J:\setupSNK.exe
O33 - MountPoints2\{50e51917-9bff-11dc-8a3f-001d60409b1e}\Shell\AutoRun\command - "" = Torpark.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.2
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.2
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.01 21:05:18 | 000,000,000 | ---D | C] -- C:\_OTL
[2011.12.01 00:49:24 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011.11.22 11:08:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.11.03 16:37:29 | 000,000,000 | ---D | C] -- C:\Users\Tobias\AppData\Local\Facebook
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.01 22:11:52 | 000,001,356 | ---- | M] () -- C:\Users\Tobias\AppData\Local\d3d9caps.dat
[2011.12.01 21:46:37 | 000,640,920 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.12.01 21:46:37 | 000,607,854 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.12.01 21:46:37 | 000,131,604 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.01 21:46:37 | 000,108,796 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.12.01 21:42:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.01 21:02:05 | 000,000,049 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2011.12.01 00:11:49 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.01 00:11:49 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.29 18:46:05 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.11.28 20:06:03 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.11.28 19:42:01 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001UA.job
[2011.11.27 20:56:34 | 000,073,728 | ---- | M] () -- C:\Users\Tobias\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.26 16:42:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001Core.job
[2011.11.23 21:21:17 | 328,067,926 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.11.23 12:52:25 | 000,236,736 | ---- | M] () -- C:\Users\Tobias\Desktop\2270C575-155D-2438-0654D421DBEFFF59.pdf
[2011.11.23 12:46:01 | 000,008,492 | ---- | M] () -- C:\Users\Tobias\Desktop\2270C575-155D-2438-0654D421DBEFFF52.pdf
 
========== Files Created - No Company Name ==========
 
[2011.11.23 21:21:17 | 328,067,926 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.11.23 12:52:25 | 000,236,736 | ---- | C] () -- C:\Users\Tobias\Desktop\2270C575-155D-2438-0654D421DBEFFF59.pdf
[2011.11.23 12:46:01 | 000,008,492 | ---- | C] () -- C:\Users\Tobias\Desktop\2270C575-155D-2438-0654D421DBEFFF52.pdf
[2011.11.03 16:37:36 | 000,000,932 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001UA.job
[2011.11.03 16:37:35 | 000,000,910 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001Core.job
[2011.06.28 11:05:08 | 000,000,275 | ---- | C] () -- C:\Users\Tobias\AppData\Local\HamsterVideoConverterSettings.cfg
[2010.10.06 13:55:40 | 000,001,356 | ---- | C] () -- C:\Users\Tobias\AppData\Local\d3d9caps.dat
[2009.11.18 12:20:20 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2009.11.18 12:20:20 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2009.11.18 12:20:20 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2009.11.18 12:20:20 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2009.11.18 12:20:20 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2009.11.18 12:20:20 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2009.11.18 12:20:20 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2009.11.18 12:20:20 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2009.11.18 12:20:20 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2009.11.18 12:20:20 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2009.11.18 12:20:20 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2009.11.18 12:20:20 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2009.11.18 12:20:20 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2009.11.18 12:20:20 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2009.11.18 12:20:20 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2009.11.18 12:20:20 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2009.11.18 12:20:20 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2009.11.18 12:20:20 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2009.11.18 12:20:20 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009.11.08 10:08:42 | 000,000,089 | ---- | C] () -- C:\Users\Tobias\AppData\Local\drgds.bat
[2009.09.17 18:41:33 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.17 18:41:33 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008.11.18 13:52:44 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.11.13 13:50:57 | 000,155,648 | ---- | C] () -- C:\Windows\System32\daspi32u.dll
[2008.11.13 13:50:57 | 000,106,496 | ---- | C] () -- C:\Windows\System32\IO_PORT.DLL
[2008.11.13 13:50:57 | 000,102,400 | ---- | C] () -- C:\Windows\System32\FVC.DLL
[2008.11.13 13:50:57 | 000,032,768 | ---- | C] () -- C:\Windows\System32\SQ1394.DLL
[2008.11.13 13:50:56 | 000,010,624 | ---- | C] () -- C:\Windows\System32\GENEUSB.SYS
[2008.08.28 19:10:26 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.07.18 13:34:23 | 000,000,012 | ---- | C] () -- C:\Windows\sversion.ini
[2008.05.04 15:07:54 | 000,626,688 | ---- | C] () -- C:\Windows\System32\xvid.dll
[2008.02.27 20:07:21 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008.01.09 15:01:19 | 000,000,000 | ---- | C] () -- C:\Users\Tobias\AppData\Roaming\Default.PLS
[2008.01.06 10:42:32 | 000,007,207 | ---- | C] () -- C:\Windows\Disktool.INI
[2008.01.06 10:42:32 | 000,003,677 | ---- | C] () -- C:\Windows\SoundCon.INI
[2008.01.06 10:42:31 | 000,006,399 | ---- | C] () -- C:\Windows\fwupgrade.ini
[2008.01.06 10:31:27 | 000,003,082 | ---- | C] () -- C:\Windows\System32\affv9869p4now.sys
[2008.01.04 22:58:50 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.01.04 22:56:24 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008.01.02 16:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2007.12.25 17:57:56 | 000,000,292 | ---- | C] () -- C:\Windows\bienemaja.ini
[2007.12.01 13:51:18 | 000,004,866 | ---- | C] () -- C:\ProgramData\ywasvxup.hvs
[2007.12.01 13:50:58 | 000,000,042 | ---- | C] () -- C:\Windows\IniFile1.ini
[2007.11.26 15:58:42 | 000,000,043 | -HS- | C] () -- C:\ProgramData\.zreglib
[2007.11.26 15:54:19 | 000,000,067 | ---- | C] () -- C:\Windows\DVDRegionFree.INI
[2007.11.22 16:39:19 | 000,000,022 | ---- | C] () -- C:\ProgramData\C9B086CE-4A3B-11DB-8373-B622A1EF5492
[2007.11.13 23:34:12 | 000,024,206 | ---- | C] () -- C:\Users\Tobias\AppData\Roaming\UserTile.png
[2007.11.13 17:05:57 | 000,001,444 | ---- | C] () -- C:\Windows\photoimpression.ini
[2007.11.13 17:05:31 | 000,000,021 | ---- | C] () -- C:\Windows\PI_setup.ini
[2007.11.12 15:57:22 | 000,000,416 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2007.11.12 14:48:20 | 000,000,482 | ---- | C] () -- C:\Windows\System32\Remover.ini
[2007.11.09 13:56:47 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe
[2007.11.09 13:56:46 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe
[2007.11.09 13:56:46 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe
[2007.11.09 13:56:46 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe
[2007.11.09 13:56:46 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2007.11.09 13:56:45 | 000,471,552 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2007.11.09 11:55:50 | 000,073,728 | ---- | C] () -- C:\Users\Tobias\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.08.21 12:34:56 | 000,006,642 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007.08.20 15:59:13 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll
[2007.08.20 15:39:05 | 000,299,008 | ---- | C] () -- C:\Windows\System32\midas.dll
[2007.08.20 15:39:05 | 000,120,320 | ---- | C] () -- C:\Windows\System32\UnzDll.dll
[2007.08.20 15:29:53 | 000,000,199 | ---- | C] () -- C:\Windows\WISO.INI
[2007.08.20 14:18:13 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe
[2007.06.26 12:01:49 | 000,003,072 | ---- | C] () -- C:\Windows\System32\34CoInstaller.dll
[2007.02.06 01:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2007.01.31 14:48:36 | 000,000,518 | ---- | C] () -- C:\Windows\System32\SP7311.ini
[2006.12.11 05:06:31 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006.11.02 16:33:31 | 000,640,920 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:33:31 | 000,131,604 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,371,280 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,607,854 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,108,796 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.09.20 06:34:10 | 000,000,000 | ---- | C] () -- C:\Windows\Buhl.ini
[2005.08.02 22:24:01 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2002.10.15 23:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\System32\unrar.dll
 
========== LOP Check ==========
 
[2007.11.28 22:49:41 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\AD ON Multimedia
[2010.06.27 20:01:55 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Amazon
[2008.01.08 18:59:27 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Axara
[2011.10.04 19:53:34 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\BOM
[2008.05.30 21:03:41 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\BonkEnc
[2007.11.09 11:10:46 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Buhl Data Service GmbH
[2007.11.12 16:03:44 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Canon
[2010.10.03 22:34:49 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\ClickPotatoLite
[2011.06.29 13:10:43 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\CocoonSoftware
[2011.08.03 16:11:27 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Desktopicon
[2011.05.29 20:22:55 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\EPSON
[2011.08.03 16:11:27 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\FreeFLVConverter
[2011.06.29 13:17:50 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\FreeVideoConverter
[2011.07.14 17:31:08 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\GetRightToGo
[2011.04.12 19:41:13 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\IPACS
[2007.11.10 21:10:35 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\MAGIX
[2008.05.30 23:46:16 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\NCH Swift Sound
[2009.10.15 15:52:19 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Nokia
[2009.10.15 15:55:50 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\PC Suite
[2007.11.13 23:34:12 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\PeerNetworking
[2008.11.13 14:08:10 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\PIE
[2007.11.12 15:57:12 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\ScanSoft
[2010.05.09 17:50:47 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Search Settings
[2009.04.22 12:54:39 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\SlySoft
[2007.11.09 23:35:13 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Sonavis
[2008.02.27 20:13:23 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\STOIK
[2009.01.22 11:24:17 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\Toolbars
[2011.07.01 09:38:04 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\TuneUp Software
[2007.11.11 17:34:42 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\TVcentral-Core
[2009.11.08 08:19:58 | 000,000,000 | ---D | M] -- C:\Users\Tobias\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2011.11.26 16:42:00 | 000,000,910 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001Core.job
[2011.11.28 19:42:01 | 000,000,932 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001UA.job
[2011.11.28 20:23:12 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.03.30 11:20:57 | 000,000,420 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{9B47CEB2-0040-4349-921E-7E1BCFF6B981}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2007.11.09 10:53:26 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2011.04.05 20:58:59 | 000,000,000 | ---D | M] -- C:\.mtvconvertertmp
[2008.03.30 09:14:09 | 000,000,000 | ---D | M] -- C:\2c081c8a19fca746f66e379737
[2008.03.21 12:24:11 | 000,000,000 | ---D | M] -- C:\Alley 19
[2009.10.09 19:54:17 | 000,000,000 | -HSD | M] -- C:\Boot
[2007.11.12 15:52:37 | 000,000,000 | -H-D | M] -- C:\CanoScan
[2008.05.14 10:10:57 | 000,000,000 | ---D | M] -- C:\CloneDVDTemp
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2007.11.09 10:49:20 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.03.27 20:36:00 | 000,000,000 | ---D | M] -- C:\Downloads
[2009.02.17 20:49:28 | 000,000,000 | ---D | M] -- C:\Flippern
[2008.03.18 16:01:37 | 000,000,000 | ---D | M] -- C:\Intel
[2008.04.24 19:41:03 | 000,000,000 | ---D | M] -- C:\Movavi files
[2008.01.19 12:15:42 | 000,000,000 | ---D | M] -- C:\mp4
[2010.05.07 16:41:05 | 000,000,000 | ---D | M] -- C:\My Music
[2011.06.29 11:34:53 | 000,000,000 | ---D | M] -- C:\Neuer Ordner
[2009.11.20 20:31:46 | 000,000,000 | ---D | M] -- C:\Office40
[2008.05.14 14:30:05 | 000,000,000 | ---D | M] -- C:\OutputFolder
[2008.03.30 09:54:26 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2007.11.09 13:53:46 | 000,000,000 | ---D | M] -- C:\Phenomedia AG
[2011.10.04 19:46:59 | 000,000,000 | ---D | M] -- C:\Program Files
[2011.07.15 18:55:14 | 000,000,000 | ---D | M] -- C:\ProgramData
[2007.11.09 10:49:20 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.11.29 19:26:12 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.05.06 14:00:53 | 000,000,000 | ---D | M] -- C:\Temp
[2007.12.25 17:57:56 | 000,000,000 | ---D | M] -- C:\Tivola
[2007.11.09 10:52:59 | 000,000,000 | R--D | M] -- C:\Users
[2011.06.29 13:32:13 | 000,000,000 | ---D | M] -- C:\video output
[2011.12.01 21:09:08 | 000,000,000 | ---D | M] -- C:\Windows
[2011.11.05 17:33:38 | 000,000,000 | ---D | M] -- C:\WmrPro
[2011.12.01 21:05:18 | 000,000,000 | ---D | M] -- C:\_OTL
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2007.11.14 21:09:04 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2007.11.14 21:09:04 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.18 22:33:12 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.18 22:33:26 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.18 22:33:26 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 10:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.18 22:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.18 22:33:34 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.18 22:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.18 22:33:38 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.18 22:33:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-11-25 20:20:36
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Zimmer Malta.tif:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Zahlen - Trick.rtf:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\wunschkonzert - CD 1.odt:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Wunschkonzert -  CD 2.odt:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\skizze.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Seehospitz Norderney.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Schnappi (Makaber).wmv:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Restaurant New Dolmen.tif:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Rayman Die blauen Berge; Lösungen.htm:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Nitschke, Böhnke,Branik 2001.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Nitschke, Böhnke, Branik,2001.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Nitschke, Böhnke, Branik 2001.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Nitschke ,Böhnke, Branik 2001.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\New Dolmen Hotel Malta.tif:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Michael Branik 2001.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Meer Malta.tif:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\LVA Kurverschiebung 2005.doc:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Krimiserien auf Video - DVD.odt:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Kontaktanzeige bei Kontaktbörse 2001.htm:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\kolymbia beach Rhodos.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Handy - Kauf 2005.pdf:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Geburtsurkunde Noemi Hölzle.bmp:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\furzmaschine_V1.exe:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Fred Metzler 2001.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Flirtpool -  Kontaktanzeigen 2000.htm:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\eBay-Kauf 3 Tage Wellness & Romantik Pur im Hotel Sonnenhof.htm:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Dolmen Hotel Malta.tif:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Darsteller Veigelesbühne 2001.jpg:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Carina 2001.JPG:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\Bewerbung auf Wohnung 2002.doc:KAVICHS
@Alternate Data Stream - 36 bytes -> C:\Users\Tobias\Desktop\Eigene Dateien\6 Monate T&T.doc:KAVICHS
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:613F7882
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:C39E55C5

< End of report >

--- --- ---

Larusso · 01.12.2011, 22:34

Entweder ich seh den Wald vor lauter Bäumen nicht, oder das Teil versteckt sich ganz gut.

Poste mir bitte die aktuelle Logfile von Malwarebytes
Starte Malwarebytes--> Reiter Scan-Berichte--> klick auf den aktuellsten Bericht--> es öffnet sich automatisch ein Text-Dokument

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

shogun74 · 01.12.2011, 22:46

wo finde ich denn Malwarebytes?

Larusso · 01.12.2011, 22:49

aaaah, sorry. Mein Fehler. Dachte das wär bereits am System. Hab ich wohl was verwechselt.

Fahre bitte mit Combofix fort

shogun74 · 01.12.2011, 23:27

Der Rechner fährt weiterhin nur im abges. Modus hoch. Hier der Inhalt des Textdokuments:

Combofix Logfile:

Code:

ATTFilter

ComboFix 11-12-01.03 - Tobias 01.12.2011  23:00:46.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3447.2724 [GMT 1:00]
ausgeführt von:: c:\users\Tobias\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\ClickPotatoLite
c:\program files\ClickPotatoLite\bin\10.0.530.0\firefox\extensions\install.rdf
c:\program files\Dealio Toolbar
c:\program files\Dealio Toolbar\config.ini
c:\program files\Dealio Toolbar\DealioToolbarIE.dll
c:\program files\Dealio Toolbar\Res\amazon.gif
c:\program files\Dealio Toolbar\Res\apple.gif
c:\program files\Dealio Toolbar\Res\barnes.gif
c:\program files\Dealio Toolbar\Res\bestbuy.gif
c:\program files\Dealio Toolbar\Res\dealio_logo.gif
c:\program files\Dealio Toolbar\Res\dealio_logo_hover.gif
c:\program files\Dealio Toolbar\Res\ebay.gif
c:\program files\Dealio Toolbar\Res\icon_settings.gif
c:\program files\Dealio Toolbar\Res\macys.gif
c:\program files\Dealio Toolbar\Res\newegg.gif
c:\program files\Dealio Toolbar\Res\overstock.gif
c:\program files\Dealio Toolbar\Res\search-button-hover.gif
c:\program files\Dealio Toolbar\Res\search-button.gif
c:\program files\Dealio Toolbar\Res\search-chevron-hover.gif
c:\program files\Dealio Toolbar\Res\search-chevron.gif
c:\program files\Dealio Toolbar\Res\search_amazon.gif
c:\program files\Dealio Toolbar\Res\search_dealio.gif
c:\program files\Dealio Toolbar\Res\search_ebay.gif
c:\program files\Dealio Toolbar\Res\search_yahoo.gif
c:\program files\Dealio Toolbar\Res\separator.gif
c:\program files\Dealio Toolbar\Res\target.gif
c:\program files\Dealio Toolbar\Res\walmart.gif
c:\program files\Dealio Toolbar\Res\widgets.xml
c:\program files\Dealio Toolbar\SearchSettingsKit.exe
c:\program files\Dealio Toolbar\WidgiHelper.exe
c:\programdata\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\programdata\ClickPotatoLiteSA
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSA.dat
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSA_kyf.dat
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSAAbout.mht
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSAau.dat
c:\programdata\ClickPotatoLiteSA\ClickPotatoLiteSAEULA.mht
c:\users\Tobias\AppData\Roaming\AD ON Multimedia
c:\users\Tobias\AppData\Roaming\AD ON Multimedia\eBay Shortcuts\config.ini
c:\users\Tobias\AppData\Roaming\AD ON Multimedia\eBay Shortcuts\eBayShortcuts.exe
c:\users\Tobias\AppData\Roaming\ClickPotatoLite
c:\users\Tobias\AppData\Roaming\Desktopicon
c:\users\Tobias\AppData\Roaming\Desktopicon\config.ini
c:\users\Tobias\AppData\Roaming\Desktopicon\eBayShortcuts.exe
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-01 bis 2011-12-01  ))))))))))))))))))))))))))))))
.
.
2011-12-01 22:04 . 2011-12-01 22:05	--------	d-----w-	c:\users\Tobias\AppData\Local\temp
2011-12-01 22:04 . 2011-12-01 22:04	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-12-01 20:42 . 2011-12-01 20:42	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{B39CA123-287B-45E0-9D69-1C8590FDA6AC}\offreg.dll
2011-12-01 20:05 . 2011-12-01 20:05	--------	d-----w-	C:\_OTL
2011-12-01 13:25 . 2008-01-02 15:37	192512	----a-w-	c:\windows\system32\igfxres.dll
2011-12-01 07:48 . 2011-10-07 03:48	6668624	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{B39CA123-287B-45E0-9D69-1C8590FDA6AC}\mpengine.dll
2011-11-09 11:51 . 2011-10-17 11:41	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
2011-11-09 11:51 . 2011-09-20 21:02	905088	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-11-09 11:51 . 2011-09-30 15:57	707584	----a-w-	c:\program files\Common Files\System\wab32.dll
2011-11-03 15:37 . 2011-11-03 15:37	--------	d-----w-	c:\users\Tobias\AppData\Local\Facebook
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-19 21:56 . 2011-05-14 19:02	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-06 13:30 . 2011-10-13 12:28	2043392	----a-w-	c:\windows\system32\win32k.sys
2011-09-03 06:18 . 2011-09-08 10:10	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
2006-05-03 09:06	163328	--sha-r-	c:\windows\System32\flvDX.dll
2007-02-21 10:47	31232	--sha-r-	c:\windows\System32\msfDX.dll
2008-03-16 12:30	216064	--sha-r-	c:\windows\System32\nbDX.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}]
2011-06-22 03:02	252832	----a-w-	c:\program files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA61DE26-FA67-4575-9033-918671094293}]
2008-08-14 13:57	2484224	----a-w-	c:\users\Tobias\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{000E148C-F7A7-445A-9044-93BF6CE09ECB}"= "c:\users\Tobias\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll" [2008-08-14 2484224]
.
[HKEY_CLASSES_ROOT\clsid\{000e148c-f7a7-445a-9044-93bf6ce09ecb}]
[HKEY_CLASSES_ROOT\TBSB03968.TBSB03968.3]
[HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]
[HKEY_CLASSES_ROOT\TBSB03968.TBSB03968]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{000E148C-F7A7-445A-9044-93BF6CE09ECB}"= "c:\users\Tobias\AppData\Roaming\Toolbars\Toolbar fuer eBay\ebay.dll" [2008-08-14 2484224]
.
[HKEY_CLASSES_ROOT\clsid\{000e148c-f7a7-445a-9044-93bf6ce09ecb}]
[HKEY_CLASSES_ROOT\TBSB03968.TBSB03968.3]
[HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}]
[HKEY_CLASSES_ROOT\TBSB03968.TBSB03968]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-12 153136]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"Facebook Update"="c:\users\Tobias\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-11-03 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-09 4702208]
"TVBroadcast"="c:\program files\Sceneo\AbsolutTV\SERVICES\ODSBC\ODSBCApp.exe" [2007-08-07 797696]
"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
"PAC7311_Monitor"="c:\windows\PixArt\PAC7311\Monitor.exe" [2006-11-03 319488]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"Skytel"="Skytel.exe" [2007-08-03 1826816]
"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-08-03 273544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{93994DE8-8239-4655-B1D1-5F4E91300429}"= "c:\program files\DVD Region+CSS Free\DVDShell.dll" [2004-10-09 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [2009-11-20 1858144]
R3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-01-08 1136600]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 18:02	114688	----a-w-	c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-11-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001Core.job
- c:\users\Tobias\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-03 15:37]
.
2011-11-28 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2820939661-2706991073-3357424421-1001UA.job
- c:\users\Tobias\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-11-03 15:37]
.
2011-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-23 13:53]
.
2011-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-23 13:53]
.
2011-12-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2820939661-2706991073-3357424421-1001.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 08:47]
.
2011-03-30 c:\windows\Tasks\User_Feed_Synchronization-{9B47CEB2-0040-4349-921E-7E1BCFF6B981}.job
- c:\windows\system32\msfeedssync.exe [2008-03-30 21:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay - eine der größten deutschen Shopping-Websites
TCP: DhcpNameServer = 82.212.62.62 78.42.43.62
FF - ProfilePath - c:\users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\ltp5tzxg.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.startzentrale.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)
AddRemove-Alley 19 Bowling - e:\alley19\Remove.exe
AddRemove-ArcSoft PhotoImpression - c:\windows\IsUn0407.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-12-01 23:05
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(1492)
c:\windows\system32\igfxsrvc.dll
.
Zeit der Fertigstellung: 2011-12-01  23:06:37
ComboFix-quarantined-files.txt  2011-12-01 22:06
.
Vor Suchlauf: 25 Verzeichnis(se), 104.835.575.808 Bytes frei
Nach Suchlauf: 28 Verzeichnis(se), 106.940.440.576 Bytes frei
.
- - End Of File - - 6326E772EBFCACAB47F3CA1551D0BED2

--- --- ---

Larusso · 01.12.2011, 23:48

Schauen wir, ob Du eine gültige Produkt-Lizenz hast. Lade das Tool MGADiag.exe von dieser Seite herunter, führe es aus und kopieren den Output per Copy&Paste (den Button Copy drücken) hier in den Thread.

Downloade Dir bitte WVCheck von Artellos.com

Speichere die Datei auf dem Desktop. ( solltest Du dir die .zip Datei herunter geladen haben musst Du diese zuerst entpacken )
Starte die .exe mit Doppelklick
Vista und Win7 User: mit Rechtsklick "als Admin ausführen" starten
Wie beschrieben, kann das Tool eine Weile brauchen.
Wenn es erledigt ist, kopiere den Inhalt des Textdokumentes hier in deinen Thread

shogun74 · 01.12.2011, 23:58

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Genuine
Validation Code: 0
Cached Online Validation Code: N/A, hr = 0x80070426
Windows Product Key: *****-*****-H2QD2-V4DCP-X7QB8
Windows Product Key Hash: MvKKFuoJKNIo4kxOa/fSwfVoEj0=
Windows Product ID: 89578-OEM-7332157-00102
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.0.6002.2.00010300.2.0.003
ID: {039A313E-3936-4B7A-B76A-F9B1545359BC}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.7.59.1
Signed By: Microsoft
Product Name: Windows Vista (TM) Home Premium
Architecture: 0x00000000
Build lab: 6002.vistasp2_gdr.110617-0336
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{039A313E-3936-4B7A-B76A-F9B1545359BC}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-X7QB8</PKey><PID>89578-OEM-7332157-00102</PID><PIDType>2</PIDType><SID>S-1-5-21-2820939661-2706991073-3357424421</SID><SYSTEM><Manufacturer>MEDIONPC</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0202 </Version><SMBIOSVersion major="2" minor="4"/><Date>20070808000000.000000+000</Date></BIOS><HWID>AB323507018400FA</HWID><UserLCID>0407</UserLCID><SystemLCID>0407</SystemLCID><TimeZone>Mitteleuropäische Zeit(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>MEDION</OEMID><OEMTableID>MEDIONAG</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software Licensing service is not running.

Windows Activation Technologies-->
N/A

HWID Data-->
HWID Hash Current: MgAAAAEABAABAAEAAQAAAAAAAgABAAEA6GF4+NLtmJNa/6p2SOQqBuD58vTIiaxWKoU=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20000
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC A_M_I_ OEMAPIC
FACP A_M_I_ OEMFACP
HPET A_M_I_ OEMHPET
MCFG A_M_I_ OEMMCFG
SLIC MEDION MEDIONAG
OEMB A_M_I_ AMI_OEM

shogun74 · 02.12.2011, 00:02

Hier vom WV Chek das Textdokument:

- DokuWindows Validation Check
Version: 1.9.12.5
Log Created On: 0000_02-12-2011
-----------------------

Windows Information
-----------------------
Windows Version: Windows Vista Service Pack 2
Windows Mode: Safe Mode with Networking
Systemroot Path: C:\Windows

WVCheck's Auto Update Check
-----------------------
Auto-Update Option: Download updates and install them automatically.
-----------------------
Last Success Time for Update Detection: 2011-11-29 17:48:38
Last Success Time for Update Download: 2011-11-29 17:49:19
Last Success Time for Update Installation: 2011-11-25 20:20:36

WVCheck's Registry Check Check
-----------------------
Antiwpa: Not Found
-----------------------
Chew7Hale: Not Found
-----------------------

WVCheck's File Dump
-----------------------
WVCheck found no known bad files.

WVCheck's Dir Dump
-----------------------
WVCheck found no known bad directories.

WVCheck's Missing File Check
-----------------------
WVCheck found no missing Windows files.

WVCheck's HOSTS File Check
-----------------------
WVCheck found no bad lines in the hosts file.

WVCheck's MD5 Check
EXPERIMENTAL!!
-----------------------
user32.dll - 75510147b94598407666f4802797c75a

-------- End of File, program close at 0000_02-12-2011 --------

Larusso · 02.12.2011, 00:35

Was passiert wenn du deinen Rechner in den Normalmodus startest ? Fehlermeldung oder sonst irgendwas ?
Die Logfiles scheinen sauber

shogun74 · 02.12.2011, 00:41

Nein, es kommt keine Fehlermeldung!
Beim Hochfahren drück ich F1, dann F8 um auszuwähllen,was geschehen soll.
Wenn ich dann auf "Windows normal starten gehe, fährt er trotzdem im Abges. Modus hoch. Wenn ich nichts mache ebenso.

Larusso · 02.12.2011, 01:11

OKay, die Logfiles sehen erstmal sauber aus.
Melde dich bitte im Windows Bereich und sag denen, dass Du von mir dahin verwiesen wurdest.

01.12.2011, 22:49	#8
Larusso /// Selecta Jahrusso	PC (Vista) fährt nur noch im abgesicherten Modus hoch aaaah, sorry. Mein Fehler. Dachte das wär bereits am System. Hab ich wohl was verwechselt. Fahre bitte mit Combofix fort __________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie

PC (Vista) fährt nur noch im abgesicherten Modus hoch

Log-Analyse und Auswertung: PC (Vista) fährt nur noch im abgesicherten Modus hoch