Windows system blockiert

sgber10 · 27.12.2011, 12:45

Hallo an alle,

leider bin auch ich seit kurzem von diesem Problem betroffen:

achtung aus sicherheitsgründen wurde ihr windows system blockiert
durch das besuchen von seiten mit infizierten und pornografischen inhalten
ist das computersystem an eine kritische grenze angekommen
nach der das system zusammenbrechen und die ganzen daten verloren gehen könnten.
um das system wieder herstellen zu können, müssen sie ein zusätzliches sicherheitsupdate herrunter laden.
dieses update ist ein kostenpflichtiges upgrade für besonders infizierte windows systeme
es schützt das system vollständig von virus und schadprogrammen, stabilisiert ihr computer system
und verhindert den datenverlust.

Habe den OTL Scan gemacht, allerdings ohne vorher etwas in das OTL- Fenster kopiert zu haben (hätte ich das machen müssen?), also einfach nur den Scan durchlaufen lassen, hier die Ergebnisse:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 27.12.2011 12:22:49 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Steffen Grundmann\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 78,24% Memory free
6,19 Gb Paging File | 5,74 Gb Available in Paging File | 92,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,63 Gb Total Space | 26,07 Gb Free Space | 16,97% Space Free | Partition Type: NTFS
Drive D: | 303,34 Gb Total Space | 5,54 Gb Free Space | 1,83% Space Free | Partition Type: NTFS
Drive F: | 702,31 Mb Total Space | 637,27 Mb Free Space | 90,74% Space Free | Partition Type: UDF
Drive L: | 931,51 Gb Total Space | 400,96 Gb Free Space | 43,04% Space Free | Partition Type: NTFS
 
Computer Name: STEFFENGRUND-PC | User Name: Steffen Grundmann | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Steffen Grundmann\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Pml Driver HPZ12) --  File not found
SRV - (Net Driver HPZ12) --  File not found
SRV - (Iomega Activity Disk2) --  File not found
SRV - (Kodak AiO Network Discovery Service) -- C:\Programme\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (AVerRemote) -- C:\Programme\Common Files\AVerMedia\Service\AVerRemote.exe (AVerMedia)
SRV - (TestHandler) -- C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Technology Solutions)
SRV - (AVerScheduleService) -- C:\Programme\Common Files\AVerMedia\Service\AVerScheduleService.exe ()
SRV - (ClipInc001) -- C:\Program Files\Tobit ClipInc\Server\ClipInc-Server.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (UPnPService) -- C:\Programme\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
SRV - (Iomega App Services) -- C:\Programme\Iomega\System32\AppServices.exe (Iomega Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (AVPolCIR) -- C:\Windows\System32\drivers\AVPolCIR.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (AVerPola) -- C:\Windows\System32\drivers\AVerPola.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (sfsync04) StarForce Protection Synchronization Driver (version 4.x) -- C:\Windows\System32\drivers\sfsync04.sys (Protection Technology (StarForce))
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (MxlW2k) -- C:\Windows\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (AVerAF15DMBTH) -- C:\Windows\System32\drivers\AVerAF15DMBTH.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (ahcix86s) -- C:\Windows\system32\drivers\ahcix86s.sys (AMD Technologies Inc.)
DRV - (JRAID) -- C:\Windows\system32\drivers\jraid.sys (JMicron Technology Corp.)
DRV - (nmwcd) -- C:\Windows\System32\drivers\nmwcd.sys (Nokia)
DRV - (nmwcdcm) -- C:\Windows\System32\drivers\nmwcdcm.sys (Nokia)
DRV - (nmwcdcj) -- C:\Windows\System32\drivers\nmwcdcj.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\nmwcdc.sys (Nokia)
DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (iomdisk) -- C:\Windows\System32\DRIVERS\iomdisk.sys (Iomega Corporation)
DRV - (Cinemsup) -- C:\Windows\System32\drivers\cinemsup.sys (Sonic Solutions)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://msn.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 50 80 24 0C 0F 5F CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\InprocServer32 File not found
IE - HKCU\..\URLSearchHook: {1CFFA392-0898-4b1c-89D1-6E98F9D8EF78} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.0.198: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.0.198: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.0.198: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
 
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2009.03.28 11:43:07 | 000,181,149 | ---- | M]) - C:\Windows\System32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 downloads.aaa1screensavers.com #[Bargin Buddy]
O1 - Hosts: 127.0.0.1 dl.aaascreensavers.com
O1 - Hosts: 127.0.0.1 abcsearch.com
O1 - Hosts: 127.0.0.1 admin.abcsearch.com
O1 - Hosts: 127.0.0.1 www3.abcsearch.com #[Browseraid]
O1 - Hosts: 127.0.0.1 www.abcsearch.com
O1 - Hosts: 127.0.0.1 abc517.net #[Trojan.Mitglieder.H]
O1 - Hosts: 127.0.0.1 absoluagency.com #[Trojan.StartPage.H]
O1 - Hosts: 127.0.0.1 acestats.com
O1 - Hosts: 127.0.0.1 www.acestats.com
O1 - Hosts: 127.0.0.1 actualnames.com #[Parasite.ActualNames][Spyware.ActualNames]
O1 - Hosts: 127.0.0.1 www.actualnames.com
O1 - Hosts: 127.0.0.1 ad-up.com
O1 - Hosts: 127.0.0.1 www.ad-up.com
O1 - Hosts: 127.0.0.1 adatom.com
O1 - Hosts: 127.0.0.1 aesp.adatom.com
O1 - Hosts: 127.0.0.1 adbest.com
O1 - Hosts: 127.0.0.1 adserv.adbonus.com
O1 - Hosts: 127.0.0.1 www.adbonus.com
O1 - Hosts: 127.0.0.1 ad2.adcept.net
O1 - Hosts: 127.0.0.1 ad3.adcept.net
O1 - Hosts: 127.0.0.1 www.adcept.net
O1 - Hosts: 127.0.0.1 adcomplete.com
O1 - Hosts: 127.0.0.1 www.adcomplete.com
O1 - Hosts: 127.0.0.1 www.adcopy.info
O1 - Hosts: 5234 more lines...
O2 - BHO: (G DATA WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AVKWebIE.dll File not found
O2 - BHO: (Shareaza Web Download Hook) - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Programme\Shareaza\RazaWebHook32.dll (Shareaza Development Team)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll File not found
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (G DATA WebFilter) - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files\G DATA InternetSecurity\Webfilter\AVKWebIE.dll File not found
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll File not found
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe" File not found
O4 - HKLM..\Run: [ClipIncSrvTray] C:\Program Files\Tobit ClipInc\Player\ClipIncTray.exe (Tobit.Software)
O4 - HKLM..\Run: [Conime] C:\Windows\System32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Drag'n'Drop_Autolaunch] C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe (Iomega Corporation)
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [EnergySettings] C:\Programme\Fujitsu Siemens Computers\Energy Settings\EnergySettings.exe (Fujitsu Siemens Computers GmbH)
O4 - HKLM..\Run: [Google EULA Launcher] c:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
O4 - HKLM..\Run: [Iomega Automatic Backup 1.0.1] C:\Programme\Iomega\Iomega Automatic Backup\iBackup.exe (Iomega Corporation)
O4 - HKLM..\Run: [MMTray] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe (MUSICMATCH, Inc.)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe (Nokia)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [TkBellExe] c:\program files\real\realplayer\Update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{26EA70E9-BF7B-11DD-8723-806E6F6E6963}] C:\Users\Steffen Grundmann\AppData\Roaming\Microsoft\dllhsts.exe (Mozilla Foundation)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [ClipIncSrvTray] C:\Program Files\Tobit ClipInc\Player\ClipIncTray.exe (Tobit.Software)
O4 - HKCU..\Run: [Iomega Automatic Backup] C:\Programme\Iomega\Iomega Automatic Backup\iBackup.exe (Iomega Corporation)
O4 - HKCU..\Run: [Personal ID] C:\Programme\coolspot AG\Personal ID\pid.exe (coolspot AG, Düsseldorf)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Steffen Grundmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &AOL Toolbar-Suche - c:\program files\aol\aol toolbar 4.0\resources\de-DE\local\search.html File not found
O8 - Extra context menu item: Download with &Shareaza - C:\Program Files\Shareaza\RazaWebHook32.dll (Shareaza Development Team)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 4.0\aoltb.dll File not found
O9 - Extra Button: SecretCity 3DChat - {D401C3A2-12EF-4D1D-A086-F3AB10B565BF} - C:\PROGRA~1\SECRET~1\\SECRET~1.EXE File not found
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: localhost ([]http in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A6C9CDA8-C6B7-477D-9E42-8375C52BB421}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) -C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{26ea70ee-bf7b-11dd-8723-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{26ea70ee-bf7b-11dd-8723-806e6f6e6963}\Shell\AutoRun\command - "" = F:\setup.exe
O33 - MountPoints2\{a21071fc-352a-11e0-a478-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{a21071fc-352a-11e0-a478-00038a000015}\Shell\AutoRun\command - "" = M:\NPSAI.exe
O33 - MountPoints2\{a2107200-352a-11e0-a478-00038a000015}\Shell\AutoRun\command - "" = M:\setupSNK.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.27 11:50:09 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Steffen Grundmann\Desktop\OTL.exe
[2011.12.25 22:14:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011.12.24 10:02:06 | 000,000,000 | -HSD | C] -- C:\found.002
[2011.12.22 21:08:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011.12.22 21:07:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Ask
[2011.12.22 21:06:59 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2011.12.22 21:06:59 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2011.12.22 21:06:59 | 000,149,280 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2011.12.22 09:51:29 | 000,000,000 | ---D | C] -- C:\Users\Steffen Grundmann\AppData\Roaming\Opera
[2011.12.20 12:24:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\t@x 2011
[2011.12.20 12:24:08 | 000,000,000 | ---D | C] -- C:\Users\Steffen Grundmann\AppData\Local\Buhl
[2011.12.20 12:21:19 | 000,000,000 | ---D | C] -- C:\Program Files\Buhl finance
[2011.12.20 12:20:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Buhl Data Service GmbH
[2011.12.20 12:20:06 | 000,000,000 | ---D | C] -- C:\Users\Steffen Grundmann\AppData\Local\Buhl Data Service
[2011.12.18 17:33:45 | 000,000,000 | ---D | C] -- C:\Users\Steffen Grundmann\AppData\Roaming\Simfy
[2011.12.18 17:32:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\simfy
[2011.12.18 17:32:25 | 000,000,000 | ---D | C] -- C:\Program Files\simfy
[2011.12.18 17:32:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[3 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.27 12:20:14 | 000,001,356 | ---- | M] () -- C:\Users\Steffen Grundmann\AppData\Local\d3d9caps.dat
[2011.12.27 11:50:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Steffen Grundmann\Desktop\OTL.exe
[2011.12.27 11:38:10 | 000,067,584 | --S- | M] () -- C:\Windows\BootStat.dat
[2011.12.27 11:34:07 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.27 11:29:58 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.27 11:29:57 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.27 11:29:57 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.26 20:08:57 | 000,000,000 | ---- | M] () -- C:\Users\Steffen Grundmann\AppData\Local\{2279BD5C-92D5-46E3-8EAB-DCA0F94442ED}
[2011.12.25 11:14:31 | 000,002,243 | ---- | M] () -- C:\Windows\epplauncher.mif
[2011.12.24 14:51:40 | 002,159,260 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.12.24 14:51:40 | 000,603,776 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.24 14:51:40 | 000,600,294 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.12.24 14:51:40 | 000,108,176 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.12.24 13:31:30 | 000,499,000 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.12.22 20:47:42 | 000,002,148 | ---- | M] () -- C:\Users\Steffen Grundmann\.recently-used.xbel
[2011.12.21 20:36:52 | 000,002,023 | ---- | M] () -- C:\Users\Public\Desktop\KODAK AiO Home Center.lnk
[2011.12.21 16:39:02 | 000,151,552 | ---- | M] () -- C:\Users\Steffen Grundmann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.20 12:25:38 | 000,000,063 | ---- | M] () -- C:\Windows\wiso.ini
[2011.12.20 12:24:53 | 000,002,024 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\t@x aktuell.lnk
[2011.12.20 12:24:53 | 000,001,999 | ---- | M] () -- C:\Users\Public\Desktop\t@x 2011.lnk
[2011.12.18 17:34:28 | 000,000,032 | ---- | M] () -- C:\Users\Steffen Grundmann\.simfy
[2011.12.18 17:32:27 | 000,000,720 | ---- | M] () -- C:\Users\Public\Desktop\simfy.lnk
[3 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.26 20:08:57 | 000,000,000 | ---- | C] () -- C:\Users\Steffen Grundmann\AppData\Local\{2279BD5C-92D5-46E3-8EAB-DCA0F94442ED}
[2011.12.25 11:14:31 | 000,002,243 | ---- | C] () -- C:\Windows\epplauncher.mif
[2011.12.24 23:04:15 | 000,067,584 | --S- | C] () -- C:\Windows\BootStat.dat
[2011.12.22 20:47:42 | 000,002,148 | ---- | C] () -- C:\Users\Steffen Grundmann\.recently-used.xbel
[2011.12.21 20:36:52 | 000,002,023 | ---- | C] () -- C:\Users\Public\Desktop\KODAK AiO Home Center.lnk
[2011.12.20 12:25:33 | 000,000,063 | ---- | C] () -- C:\Windows\wiso.ini
[2011.12.20 12:24:53 | 000,002,024 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\t@x aktuell.lnk
[2011.12.20 12:24:53 | 000,001,999 | ---- | C] () -- C:\Users\Public\Desktop\t@x 2011.lnk
[2011.12.18 17:34:28 | 000,000,032 | ---- | C] () -- C:\Users\Steffen Grundmann\.simfy
[2011.12.18 17:32:27 | 000,000,720 | ---- | C] () -- C:\Users\Public\Desktop\simfy.lnk
[2011.11.26 13:12:56 | 000,000,000 | ---- | C] () -- C:\ProgramData\1baf71527e35d3bb2501f83c957e267c_c
[2011.11.22 01:02:47 | 000,000,004 | ---- | C] () -- C:\Windows\msoffice.ini
[2011.03.07 09:20:14 | 004,444,500 | ---- | C] () -- C:\Users\Steffen Grundmann\AppData\Roaming\quickzip51.msi
[2011.01.05 10:46:25 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.12.05 18:46:11 | 000,054,784 | ---- | C] () -- C:\Windows\System32\UnzDll.dll
[2010.10.16 10:49:52 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2010.10.05 12:02:37 | 000,001,356 | ---- | C] () -- C:\Users\Steffen Grundmann\AppData\Local\d3d9caps.dat
[2010.06.27 11:55:28 | 000,049,152 | R--- | C] () -- C:\Windows\System32\AVerIO.dll
[2010.06.27 11:55:28 | 000,003,456 | R--- | C] () -- C:\Windows\System32\AVerIO.sys
[2010.06.27 11:55:27 | 000,598,016 | R--- | C] () -- C:\Windows\System32\sptlib21.dll
[2010.06.27 11:55:27 | 000,294,912 | R--- | C] () -- C:\Windows\System32\sptlib11.dll
[2010.06.27 11:55:27 | 000,290,816 | R--- | C] () -- C:\Windows\System32\sptlib22.dll
[2010.06.27 11:55:27 | 000,249,856 | R--- | C] () -- C:\Windows\System32\sptlib03.dll
[2010.06.27 11:55:27 | 000,249,856 | R--- | C] () -- C:\Windows\System32\sptlib01.dll
[2010.06.27 11:55:27 | 000,225,280 | R--- | C] () -- C:\Windows\System32\sptlib02.dll
[2010.06.27 11:55:27 | 000,135,168 | R--- | C] () -- C:\Windows\System32\sptlib12.dll
[2010.05.26 17:22:57 | 000,000,350 | ---- | C] () -- C:\Windows\System32\AP6RMHV.BIN
[2010.05.26 17:22:57 | 000,000,252 | ---- | C] () -- C:\Windows\System32\AP6RMJX.BIN
[2010.05.26 17:22:57 | 000,000,252 | ---- | C] () -- C:\Windows\System32\AP6RMJH.BIN
[2010.05.26 17:22:57 | 000,000,238 | ---- | C] () -- C:\Windows\System32\AP6RMFP.BIN
[2010.05.26 17:22:57 | 000,000,189 | ---- | C] () -- C:\Windows\System32\AP6RMKS.BIN
[2010.05.26 17:22:57 | 000,000,126 | ---- | C] () -- C:\Windows\System32\AP6RMHR.BIN
[2010.04.18 21:39:58 | 000,000,008 | ---- | C] () -- C:\Users\Steffen Grundmann\AppData\Roaming\NMM-MetaData.db
[2009.10.19 22:33:45 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.10.19 22:33:45 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.06.12 07:55:04 | 000,119,475 | ---- | C] () -- C:\Windows\hpqins00.dat
[2009.06.08 07:28:55 | 000,017,089 | ---- | C] () -- C:\Users\Steffen Grundmann\AppData\Roaming\UserTile.png
[2009.04.25 15:13:43 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009.04.25 15:13:43 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.01.27 16:51:07 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2009.01.21 21:07:54 | 000,100,864 | ---- | C] () -- C:\Windows\System32\Dc50ip32.dll
[2009.01.21 21:07:54 | 000,065,864 | ---- | C] () -- C:\Windows\System32\Digita.sys
[2009.01.21 21:07:53 | 000,151,552 | ---- | C] () -- C:\Windows\System32\SfClientDLL.dll
[2009.01.21 21:07:53 | 000,138,752 | ---- | C] () -- C:\Windows\System32\Iordy.dll
[2009.01.21 21:07:53 | 000,007,936 | ---- | C] () -- C:\Windows\System32\dc280u.sys
[2009.01.21 21:07:53 | 000,007,808 | ---- | C] () -- C:\Windows\System32\dc240u.sys
[2009.01.16 20:26:33 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2009.01.15 20:16:28 | 000,442,368 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2009.01.12 16:20:09 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.01.11 11:08:11 | 000,151,552 | ---- | C] () -- C:\Users\Steffen Grundmann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.10.28 11:14:14 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.10.28 11:14:14 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008.10.28 11:10:28 | 000,004,984 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2008.10.28 10:46:38 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.04.28 11:11:16 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.04.25 14:23:38 | 000,012,288 | ---- | C] () -- C:\Windows\System32\EvOnlDiag.dll
[2008.01.21 08:15:58 | 002,159,260 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 08:15:58 | 000,603,776 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2006.11.02 13:47:37 | 000,499,000 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,600,294 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,108,176 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005.12.07 12:31:00 | 000,202,752 | R--- | C] () -- C:\Windows\System32\CddbCdda.dll
[1999.09.20 11:05:32 | 000,013,387 | ---- | C] () -- C:\Windows\System32\CinemSup.sys
[1999.01.27 23:50:00 | 000,132,608 | ---- | C] () -- C:\Windows\System32\Zipdll.dll
[1999.01.27 23:50:00 | 000,038,400 | ---- | C] () -- C:\Windows\System32\Zipsfx.bin
 
========== LOP Check ==========
 
[2011.01.20 14:34:33 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\.k3d
[2011.04.24 18:21:43 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Canon
[2011.01.21 11:42:46 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\DAZ 3D
[2009.03.01 16:03:45 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Engelmann Media
[2011.12.22 20:47:43 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\gtk-2.0
[2009.03.01 12:27:00 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Iomega Automatic Backup
[2009.01.21 20:56:03 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Leadertech
[2009.01.11 13:15:37 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\MAGIX
[2010.04.18 21:39:58 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Nokia
[2010.03.21 10:43:19 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\OpenOffice.org
[2011.12.22 09:51:29 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Opera
[2009.12.04 11:37:37 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\PC Suite
[2009.06.08 07:28:55 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\PeerNetworking
[2010.10.12 15:02:46 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Philipp Winterberg
[2011.02.13 13:36:38 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Samsung
[2009.01.28 10:53:21 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Serif
[2009.12.04 16:43:39 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Shareaza
[2011.12.18 17:33:45 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Simfy
[2011.10.30 11:31:57 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Temp
[2009.01.15 20:40:16 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Tobit
[2011.01.21 12:30:26 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Usenet.nl
[2010.08.11 12:03:59 | 000,000,000 | ---D | M] -- C:\Users\Steffen Grundmann\AppData\Roaming\Utherverse
[2011.12.24 19:34:18 | 000,032,556 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 16 bytes -> C:\Users\Steffen Grundmann\Downloads:Shareaza.GUID
@Alternate Data Stream - 16 bytes -> C:\Users\Steffen Grundmann\Documents\Shareaza Downloads:Shareaza.GUID
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:8B4F37E5

< End of report >

--- --- ---

--- --- ---
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 27.12.2011 12:22:49 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Steffen Grundmann\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19019)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 78,24% Memory free
6,19 Gb Paging File | 5,74 Gb Available in Paging File | 92,70% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 153,63 Gb Total Space | 26,07 Gb Free Space | 16,97% Space Free | Partition Type: NTFS
Drive D: | 303,34 Gb Total Space | 5,54 Gb Free Space | 1,83% Space Free | Partition Type: NTFS
Drive F: | 702,31 Mb Total Space | 637,27 Mb Free Space | 90,74% Space Free | Partition Type: UDF
Drive L: | 931,51 Gb Total Space | 400,96 Gb Free Space | 43,04% Space Free | Partition Type: NTFS
 
Computer Name: STEFFENGRUND-PC | User Name: Steffen Grundmann | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2548680E-848F-4D21-AC00-E03DE340E5EB}" = lport=445 | protocol=6 | dir=in | app=system | 
"{2D99CDA7-8E2B-4AED-8D8D-939915941469}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{60ED9444-BA88-4562-90F0-974F01389FAF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{68DF1554-4DB1-44BC-8C73-5BB6D3DA72A5}" = lport=139 | protocol=6 | dir=in | app=system | 
"{79A8306E-83B1-48AF-9090-F969AF7470E8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{7FD0BC98-BD42-443F-8BDD-30CBCFC6D70C}" = rport=445 | protocol=6 | dir=out | app=system | 
"{A05306EF-1945-445E-8F2B-4BFB579E74FA}" = rport=138 | protocol=17 | dir=out | app=system | 
"{AF6EB561-AA31-448E-BB45-065194E2AD6F}" = rport=139 | protocol=6 | dir=out | app=system | 
"{C669DE7E-07AC-4C2D-996D-B81828ECA6AD}" = lport=137 | protocol=17 | dir=in | app=system | 
"{CD851360-FE52-4A57-B90E-EB0004C24B65}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D0A22B30-6005-42FC-A3F6-B8926E7F131E}" = rport=137 | protocol=17 | dir=out | app=system | 
"{E057ECF2-D671-4353-8C0B-70A25382EAFD}" = lport=138 | protocol=17 | dir=in | app=system | 
"{F2E67D8C-E4B6-4564-997A-1E75C7AFACE8}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06377A00-BC5B-4009-9450-4323D5E455A5}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vra\waol.exe | 
"{07A8B698-3227-4BC6-893E-5D71ECA403B9}" = protocol=6 | dir=in | app=c:\program files\firefly studios\stronghold 2\stronghold2.exe | 
"{165A0859-5211-4BB7-9F40-A9986E585129}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{30B3B4E7-5C2F-4292-AF95-029D6A282960}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1232134000\ee\aolsoftware.exe | 
"{3586F688-2901-4D87-9923-7E730EE24D05}" = protocol=17 | dir=in | app=c:\program files\firefly studios\stronghold crusader\stronghold_crusader_extreme.exe | 
"{38ADD001-5FDA-4682-AAD2-B2BA122A13D6}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{3A840C44-5FB7-41DC-ACA2-113D3F23E0BC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{3B0B0D7E-F7B5-4C6B-95E7-71D0DE25CD74}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{3FA05D17-5D57-44E3-A201-8FC5FDCC92FF}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1232134000\ee\aolsoftware.exe | 
"{3FB5C010-E4D5-444A-95C1-8F617A428116}" = protocol=6 | dir=in | app=c:\program files\firefly studios\stronghold\stronghold.exe | 
"{4AC15C0E-C272-4C53-B587-8D418A99D1B0}" = protocol=17 | dir=in | app=c:\program files\firefly studios\stronghold 2\stronghold2.exe | 
"{515E275E-16CF-4EE9-9EB8-0531BCD30E92}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5CC0E461-B689-471A-BE77-C6CB8D858266}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{654E452A-A0D1-4063-B050-560701BDE83B}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{715BA93C-AFFE-43F3-B462-46418A7A3455}" = protocol=6 | dir=in | app=c:\program files\firefly studios\stronghold legends\strongholdlegends.exe | 
"{7C0B1030-26B6-44F5-B646-FB21F7DE77FD}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{7F9E2F6B-BF28-4D39-9C4E-854BB7789BD9}" = protocol=17 | dir=in | app=c:\program files\firefly studios\stronghold legends\strongholdlegends.exe | 
"{86C8461D-E68F-4EAA-87CC-28E43837CC6E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{92257A7A-4CA4-485B-90EA-C29194FA31F3}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{9CAC79C9-0672-46A0-BFF8-F918EB9261CD}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"{AAFA3B8F-1408-49D0-BF35-963073E38F7C}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"{AFDDB79E-8271-4CCA-82C6-8DB64EB6FAD6}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe | 
"{B572260E-AED6-44D0-9D64-E7AFAD721905}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"{B6B88CFE-4F64-4C5C-8983-EF9663BAD689}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{B7D17C52-20D7-4322-AAAE-E1EF1B95D4C5}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{C38C0F67-45C0-41D9-9D72-7DC66038CE5E}" = protocol=17 | dir=in | app=c:\program files\firefly studios\stronghold\stronghold.exe | 
"{C7E54EFD-27F5-49E9-8FFE-0568EB6A70EB}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vra\waol.exe | 
"{CA1DA685-FB89-4EB5-B607-647D1AB76387}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{D665109E-26D9-4048-8AF1-84EBAC78E55A}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe | 
"{DB17C4AE-A8A4-48A6-A06F-9DE4D8F2EA88}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{DBD5CAF1-1CE9-41FC-A79D-9416BBDF1CB1}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"{E2F4DD21-BFC5-4C03-8F4F-459565976EEA}" = protocol=6 | dir=in | app=c:\program files\firefly studios\stronghold crusader\stronghold crusader.exe | 
"{EB5D6621-FCBC-4D4A-B352-3D7EF1BA8B23}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{F2D2A813-464C-4300-9BA7-21A15D329267}" = protocol=17 | dir=in | app=c:\program files\firefly studios\stronghold crusader\stronghold crusader.exe | 
"{F356A512-9A6C-4A46-B816-AF184886FE6B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{FCD454C2-D011-49B0-98F6-FA5FF84A55A0}" = protocol=6 | dir=in | app=c:\program files\firefly studios\stronghold crusader\stronghold_crusader_extreme.exe | 
"TCP Query User{A3B93CF9-3471-451F-A539-8C1461BC352E}C:\program files\emule\emule.exe" = protocol=6 | dir=in | app=c:\program files\emule\emule.exe | 
"TCP Query User{C0FBB357-50EF-4A7A-9357-B0AD095F9DB8}C:\program files\shareaza\shareaza.exe" = protocol=6 | dir=in | app=c:\program files\shareaza\shareaza.exe | 
"UDP Query User{45372161-98E6-4B10-B5A5-DCF6AE28409D}C:\program files\shareaza\shareaza.exe" = protocol=17 | dir=in | app=c:\program files\shareaza\shareaza.exe | 
"UDP Query User{9A37DC26-E393-4D25-9264-C1E3184B447F}C:\program files\emule\emule.exe" = protocol=17 | dir=in | app=c:\program files\emule\emule.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
""AREAL - Sharewareversion"" = "AREAL - Sharewareversion"
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{066D65EA-ED53-44E4-A96A-F81B6E409D2E}" = PC Connectivity Solution
"{08094E03-AFE4-4853-9D31-6D0743DF5328}" = QuickTime
"{080FE95E-5A89-4A54-BAAA-D769971B7C2D}" = Corel Home Office 5.0.36
"{10A0255E-0B73-4397-AB4E-E3667EDA70E4}_is1" = FotoMix version 8.2
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{16D2C649-CBA8-44EE-B730-12584667D487}" = Stronghold 2
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{1DA8594C-2F14-4491-B155-2BF3A999622D}" = Fire Department 2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26792CA7-D87A-4DBE-896B-C2F66B344511}" = Sonic CinePlayer
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 30
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{42ABF3F2-2C5E-43FA-BBFF-58E4295F23CA}" = Iomega Automatic Backup
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D9DD45B-E79A-4F04-898E-B2C3769AB729}" = Serif DrawPlus X2
"{50D69C54-6963-49A6-B762-A9FF8F56AF0F}" = Brockhaus multimedial 2008
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}" = Nokia PC Suite
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{66A405D2-BA14-4594-BF36-B3B544F0754E}" = Stronghold Legends
"{6803A6E6-48FF-48AB-B558-7B651BBE1031}" = Nero 8 Essentials
"{6A35E37C-BAB1-80E8-8EDE-4B8220381563}" = simfy
"{6CCF80FD-EBBE-4FA8-AAB2-FF28BD3FC2B7}" = Die Völker 2 Bonus Pack
"{70AA9B4F-64F7-4B0D-ADD8-05802D61AF72}" = Windows Live Toolbar
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74224F8D-4A17-4816-9EDB-7BB854DE532C}" = NVIDIA PhysX v8.04.25
"{7613592F-B20C-4E1B-B2DD-67F0784D4373}" = Energy Settings
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87AF4C0E-D953-424B-8108-3127CA217E6F}" = Quick Zip 5.1
"{89E0B0D4-DFC3-49B9-8E88-F1B801325C8A}" = Emergency 3
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader Extreme
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8F50EC3D-C482-4445-9E4B-991A766047D5}_is1" = MAESTIA Version 201012
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9605D5C2-F545-40F2-B39A-0462E4CD3811}" = Windows Vista Demo Screen Saver
"{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}" = Nokia Connectivity Cable Driver
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4C534E-431F-4A17-97D4-D1682B19A054}" = Emergency4
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A260B422-70E1-41E2-957D-F76FA21266D5}" = Apple Software Update
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A90000000001}" = Adobe Reader 9 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B0414A3B-3AE3-47B8-8FC0-2129781FF425}" = t@x 2011
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3C7CA81-27EB-11D4-A59C-00E02C071F5C}" = Adobe ActiveShare 1.5
"{B6E9A977-C2C7-4CA0-0001-98605B7C7D3E}" = MyTube Recorder
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C53CCE8A-8DEE-4E2C-8A4D-425F0FF70471}" = Iomega DVD wizard
"{C917BA70-28A3-4C74-B163-41FD8C8E1A5A}" = Stronghold
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CCB1507A-AAEA-4778-AC4B-DD5EAB1A961E}" = Iomega HotBurn Pro
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C3}" = WinZip 15.5
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E28B1E6F-E0AA-4228-AB89-DB4A0C89D426}" = AVerTV
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{EF59DB7F-7426-426E-B862-7031F83ED304}" = SystemDiagnostics
"{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F722209B-739E-40E4-ADB1-062BD032A0DB}" = Personal ID
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"0852D05415AB9A4F1EF451E342267F76C776ED2F" = Windows-Treiberpaket - Nokia Modem  (11/03/2006 6.82.0.1)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AOL Toolbar 4.0" = 
"AVerMedia H830 USB Hybrid TV" = AVerMedia H830 USB Hybrid TV 10.0.0.24
"AVerMedia MCE Encoder x86" = AVerMedia MCE Encoder x86 3.0.1.6
"AVerMedia Media Center Plug-ins" = AVerMedia Media Center Plug-ins 2.0.8.0
"BH - RT" = Blitzkrieg Anthology: BH - RT
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"Canon MOV Encoder" = Canon MOV Encoder
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DPP" = Canon Utilities Digital Photo Professional 3.9
"Duplicate Finder_is1" = Duplicate Finder
"Eastern Front" = Eastern Front
"eMule" = eMule
"EOS Utility" = Canon Utilities EOS Utility
"Fire Department 3" = Fire Department 3
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition
"Free RAR Extract Frog" = Free RAR Extract Frog
"GameSpy Arcade" = GameSpy Arcade
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"InstallShield_{42ABF3F2-2C5E-43FA-BBFF-58E4295F23CA}" = Iomega Automatic Backup
"InstallShield_{E28B1E6F-E0AA-4228-AB89-DB4A0C89D426}" = AVerTV
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"MAGIX Foto Manager 2008 D" = MAGIX Foto Manager 2008 5.0.3.351 (D)
"MAGIX Fotobuch" = MAGIX Fotobuch 3.6
"MAGIX Media Suite D" = MAGIX Media Suite 1.12.0.89 (D)
"MAGIX Music Manager 2007 D" = MAGIX Music Manager 2007 8.2.0.76 (D)
"MAGIX Online Druck Service D" = MAGIX Online Druck Service 2.3.2.0 (D)
"MAGIX Ringtone Maker SE D" = MAGIX Ringtone Maker SE 3.1.0.4 (D)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MUSICMATCH Jukebox" = MUSICMATCH Jukebox
"MyCamera Download Plugin" = CANON iMAGE GATEWAY MyCamera Download Plugin
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoStitch" = Canon Utilities PhotoStitch
"Picasa2" = Picasa 2
"Picture Style Editor" = Canon Utilities Picture Style Editor
"RealPlayer 15.0" = RealPlayer
"SADK" = Die Siedler - Aufbruch der Kulturen
"Secret City" = Secret City
"Shareaza_is1" = Shareaza 2.5.2.0
"Simfy" = simfy
"Tobit ClipInc Server" = ClipInc. 
"Usenet.nl_is1" = Usenet.nl
"ViewpointMediaPlayer" = Viewpoint Media Player
"WFTK" = Canon Utilities WFT Utility
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"Xvid_is1" = Xvid 1.1.3 final uninstall
"YTdetect" = Yahoo! Detect
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"SteuerFuchs Signier-Tool" = SteuerFuchs Signier-Tool
"World of Warcraft Trial" = Probeversion von World of Warcraft
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 26.12.2011 15:10:50 | Computer Name = SteffenGrund-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 26.12.2011 15:58:54 | Computer Name = SteffenGrund-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 26.12.2011 15:59:37 | Computer Name = SteffenGrund-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 26.12.2011 15:59:51 | Computer Name = SteffenGrund-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 27.12.2011 06:00:51 | Computer Name = SteffenGrund-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung explorer.exe, Version 6.0.6002.18005, Zeitstempel
 0x49e01da5, fehlerhaftes Modul AFLDLL.DLL_unloaded, Version 0.0.0.0, Zeitstempel
 0x3f254340, Ausnahmecode 0xc0000005, Fehleroffset 0x20204960,  Prozess-ID 0x684, 
Anwendungsstartzeit 01ccc408ea940b80.
 
Error - 27.12.2011 06:01:00 | Computer Name = SteffenGrund-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 27.12.2011 06:30:38 | Computer Name = SteffenGrund-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 27.12.2011 06:30:45 | Computer Name = SteffenGrund-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel
 0x49e01da5, fehlerhaftes Modul ole32.dll, Version 6.0.6002.18277, Zeitstempel 0x4c28d53e,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00047336,  Prozess-ID 0x45c, Anwendungsstartzeit
 01ccc4827b93f0b4.
 
Error - 27.12.2011 06:38:25 | Computer Name = SteffenGrund-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 27.12.2011 06:38:46 | Computer Name = SteffenGrund-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 13.03.2011 08:54:48 | Computer Name = SteffenGrund-PC | Source = ehRecvr | ID = 4
Description = 
 
[ System Events ]
Error - 27.12.2011 06:30:39 | Computer Name = SteffenGrund-PC | Source = Service Control Manager | ID = 7023
Description = 
 
Error - 27.12.2011 06:30:39 | Computer Name = SteffenGrund-PC | Source = Service Control Manager | ID = 7023
Description = 
 
Error - 27.12.2011 06:35:30 | Computer Name = SteffenGrund-PC | Source = bowser | ID = 8003
Description = 
 
Error - 27.12.2011 06:37:41 | Computer Name = SteffenGrund-PC | Source = sfsync04 | ID = 262145
Description = 
 
Error - 27.12.2011 06:38:19 | Computer Name = SteffenGrund-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 27.12.2011 06:38:25 | Computer Name = SteffenGrund-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 27.12.2011 06:38:35 | Computer Name = SteffenGrund-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 27.12.2011 06:38:36 | Computer Name = SteffenGrund-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 27.12.2011 06:38:46 | Computer Name = SteffenGrund-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 27.12.2011 06:38:46 | Computer Name = SteffenGrund-PC | Source = Service Control Manager | ID = 7026
Description = 
 
 
< End of report >

--- --- ---

Hoffe ihr könnt damit was anfangen.

Gruß

Steffen

markusg · 27.12.2011, 17:34

hi

achtung!

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [{26EA70E9-BF7B-11DD-8723-806E6F6E6963}] C:\Users\Steffen Grundmann\AppData\Roaming\Microsoft\dllhsts.exe (Mozilla Foundation)
 :Files
C:\Users\Steffen Grundmann\AppData\Roaming\Microsoft\dllhsts.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
öffne Computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

sgber10 · 27.12.2011, 18:59

Hallo,

vielen Dank erstmal für die super Hilfe, scheint alles wieder normal zu funktionieren.
Hier das Protokoll das ich nach dem Fix bekommen habe:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{26EA70E9-BF7B-11DD-8723-806E6F6E6963} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EA70E9-BF7B-11DD-8723-806E6F6E6963}\ not found.
File C:\Users\Steffen Grundmann\AppData\Roaming\Microsoft\dllhsts.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Steffen Grundmann
->Flash cache emptied: 456 bytes

User: user

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Steffen Grundmann
->Temp folder emptied: 4181107 bytes
->Temporary Internet Files folder emptied: 224982824 bytes
->Java cache emptied: 9544545 bytes
->Google Chrome cache emptied: 6175672 bytes
->Flash cache emptied: 0 bytes

User: user

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 57808578 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 289,00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 12272011_181625

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Nochmals vielen Dank

Steffen

markusg · 27.12.2011, 19:09

bitte weiter mit dem upload um den ich gebeten habe

sgber10 · 27.12.2011, 19:32

würde ich gerne machen, aber wie bekomme ich den link zum Thema im Forum in das Feld - wie geht das

markusg · 27.12.2011, 20:04

einfach in der adressleiste markieren, rechtsklick kopieren und dann im upload channel im richtigen feld einfügen

sgber10 · 28.12.2011, 11:46

Hallo,

danke für den tipp, der upload sollte jetzt ok sein

Steffen

markusg · 28.12.2011, 11:57

jo sehr gut.

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

sgber10 · 28.12.2011, 12:35

So, Combofix ist fertig, hier die Datei

Combofix Logfile:

Code:

ATTFilter

ComboFix 11-12-27.01 - Steffen Grundmann 28.12.2011  12:19:26.1.4 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3071.1755 [GMT 1:00]
ausgeführt von:: c:\users\Steffen Grundmann\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Steffen Grundmann\AppData\Roaming\Opera\Opera\opera.exe
c:\windows\Fonts\Copasbb_.ttf
c:\windows\Fonts\Crazgbl_.ttf
c:\windows\Fonts\seagbi.ttf
c:\windows\Fonts\TT0209M_.TTF
c:\windows\Fonts\tt0303m_.ttf
c:\windows\hosts
c:\windows\IsUn0407.exe
c:\windows\system32\CddbCdda.dll
c:\windows\system32\pthreadVC.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-28 bis 2011-12-28  ))))))))))))))))))))))))))))))
.
.
2011-12-28 11:26 . 2011-12-28 11:26	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-12-27 17:17 . 2011-12-27 17:17	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE51DD59-C4F5-4AA1-88CF-8E8AB62AE680}\offreg.dll
2011-12-27 16:45 . 2011-12-27 18:19	--------	d-----w-	C:\_OTL
2011-12-25 21:14 . 2011-12-25 21:41	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2011-12-24 09:02 . 2011-12-24 09:02	--------	d-----w-	C:\found.002
2011-12-23 10:19 . 2011-11-21 10:47	6823496	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CE51DD59-C4F5-4AA1-88CF-8E8AB62AE680}\mpengine.dll
2011-12-22 20:08 . 2011-12-22 20:08	--------	d-----w-	c:\program files\Common Files\Java
2011-12-22 20:07 . 2011-12-22 20:07	--------	d-----w-	c:\programdata\Ask
2011-12-20 11:24 . 2011-12-20 11:25	--------	d-----w-	c:\users\Steffen Grundmann\AppData\Local\Buhl
2011-12-20 11:21 . 2011-12-20 11:21	--------	d-----w-	c:\program files\Buhl finance
2011-12-20 11:20 . 2011-12-20 11:25	--------	d-----w-	c:\programdata\Buhl Data Service GmbH
2011-12-20 11:20 . 2011-12-20 11:20	--------	d-----w-	c:\users\Steffen Grundmann\AppData\Local\Buhl Data Service
2011-12-18 16:33 . 2011-12-18 16:33	--------	d-----w-	c:\users\Steffen Grundmann\AppData\Roaming\Simfy
2011-12-18 16:32 . 2011-12-18 16:32	--------	d-----w-	c:\program files\simfy
2011-12-18 16:32 . 2011-12-18 16:32	--------	d-----w-	c:\program files\Common Files\Adobe AIR
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-26 14:15 . 2011-11-24 00:03	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 04:54 . 2011-06-12 19:49	472808	----a-w-	c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"ClipIncSrvTray"="c:\program files\Tobit ClipInc\Player\ClipIncTray.exe" [2008-07-02 591112]
"Iomega Automatic Backup"="c:\program files\Iomega\Iomega Automatic Backup\iBackup.exe" [2003-06-12 3014656]
"Personal ID"="c:\progra~1\COOLSP~1\PERSON~1\PID.EXE" [2010-08-30 1132984]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-03-30 116056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-08-27 6281760]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"EnergySettings"="c:\program files\Fujitsu Siemens Computers\Energy Settings\EnergySettings.exe" [2008-09-19 113664]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2011-01-06 30192]
"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"ClipIncSrvTray"="c:\program files\Tobit ClipInc\Player\ClipIncTray.exe" [2008-07-02 591112]
"Drag'n'Drop_Autolaunch"="c:\program files\Iomega HotBurn Pro\Autolaunch.exe" [2003-07-28 114688]
"Iomega Automatic Backup 1.0.1"="c:\program files\Iomega\Iomega Automatic Backup\ibackup.exe" [2003-06-12 3014656]
"MMTray"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" [2002-05-20 90112]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"Skytel"="Skytel.exe" [2008-08-27 1833504]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
"Conime"="c:\windows\system32\conime.exe" [2009-04-11 69120]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2011-06-16 2510848]
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2011-11-22 296056]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]
.
c:\users\Steffen Grundmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AVer HID Receiver.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe [2010-6-27 155648]
AVerQuick.lnk - c:\program files\Common Files\AVerMedia\AVerQuick\AVerQuick.exe [2010-6-27 651264]
Sonic CinePlayer Quick Launch.lnk - c:\program files\Common Files\Sonic Shared\cinetray.exe [2002-9-18 98304]
t@x aktuell.lnk - c:\program files\Buhl finance\tax Steuersoftware 2011\taxaktuell.exe [2011-12-20 531752]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1ca59485e1f6690;Google Update Service (gupdate1ca59485e1f6690);c:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 133104]
R3 AVerAF15DMBTH;AVerMedia A850 USB;c:\windows\system32\Drivers\AVerAF15DMBTH.sys [2009-01-05 487168]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2011-01-06 30192]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 133104]
R3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 AVerRemote;AVerRemote;c:\program files\Common Files\AVerMedia\Service\AVerRemote.exe [2009-04-08 344064]
S2 AVerScheduleService;AVerScheduleService;c:\program files\Common Files\AVerMedia\Service\AVerScheduleService.exe [2008-12-09 405504]
S2 ClipInc001;ClipInc 001;c:\program files\Tobit ClipInc\Server\ClipInc-Server.exe 001 [x]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKAiOHostService.exe [2011-12-19 394672]
S3 AVerPola;AVerMedia USB Polaris Series Capture Service;c:\windows\system32\DRIVERS\AVerPola.sys [2009-08-05 314752]
S3 AVPolCIR;AVerMedia USB Polaris Series Custom IR Service;c:\windows\system32\DRIVERS\AVPolCIR.sys [2009-08-05 32896]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - dnbudf
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 10:04]
.
2011-12-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-30 10:04]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://msn.de/
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
IE: &AOL Toolbar-Suche - c:\program files\aol\aol toolbar 4.0\resources\de-DE\local\search.html
IE: {{D401C3A2-12EF-4D1D-A086-F3AB10B565BF} - c:\progra~1\SECRET~1\\SECRET~1.EXE
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files\Ask.com\GenericAskToolbar.dll
URLSearchHooks-{1CFFA392-0898-4b1c-89D1-6E98F9D8EF78} - (no file)
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
HKLM-Run-NPSStartup - (no file)
HKLM-Run-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
AddRemove-AOL Toolbar 4.0 - c:\program files\AOL\AOL Toolbar 4.0\uninstall.exe
AddRemove-Eastern Front - c:\windows\IsUn0407.exe
AddRemove-MUSICMATCH Jukebox - c:\windows\IsUn0407.exe
AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-12-28 12:26
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
 [0] 0x508B0845
.
Scanne versteckte Autostarteinträge... 
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  Personal ID = c:\progra~1\COOLSP~1\PERSON~1\PID.EXE? 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-12-28  12:28:20
ComboFix-quarantined-files.txt  2011-12-28 11:28
.
Vor Suchlauf: 24 Verzeichnis(se), 26.547.466.240 Bytes frei
Nach Suchlauf: 29 Verzeichnis(se), 26.171.359.232 Bytes frei
.
- - End Of File - - E099028508A9DF52DBAC246187EDBF0E

--- --- ---

markusg · 28.12.2011, 12:37

malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

sgber10 · 28.12.2011, 14:54

der scan hat leider etwas gedauert

Malwarebytes Anti-Malware (Test) 1.60.0.1800
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2011.12.28.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19019
Steffen Grundmann :: STEFFENGRUND-PC [Administrator]

Schutz: Aktiviert

28.12.2011 12:44:47
mbam-log-2011-12-28 (12-44-47).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 617096
Laufzeit: 2 Stunde(n), 5 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33524C00-63FB-43DB-A6BF-0A4E14B24649} (Adware.Zwangi) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Qoobox\Quarantine\C\Users\Steffen Grundmann\AppData\Roaming\Opera\Opera\opera.exe.vir (Trojan.Agent.BH) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\12272011_174512\C_Users\Steffen Grundmann\AppData\Roaming\Microsoft\dllhsts.exe (Trojan.FakeFF) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg · 28.12.2011, 16:18

wieso hat sich wer beschwert? :-)

lade den CCleaner standard:
CCleaner Download - CCleaner 3.14.1616
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

sgber10 · 28.12.2011, 17:37

im Anhang die liste

markusg · 28.12.2011, 18:00

deinstaliere:
Adobe ActiveShare
Adobe AIR
Adobe Flash Player beide
Adobe - Andere Version des Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Apple
Ask
Blitzkrieg nicht beschriftet, falls unnötig weg
Brockhaus
ClipInc
Die Siedler nicht beschriftet, falls unnötig weg
Die ebenso
ElsterFormular schon total veraltet.
https://www.elster.de/elfo_home.php
upgraden!
Emergency4 nicht beschriftet
Emergency ebenfalls
eMule wenn du dort illegale downloads machst, musst du dich über malware kaum wundern.
strafbar ists oben drein und kann sehr sehr teuer werden
GameSpy
Google Toolbar sicherheitsrisiko, weg damit
MAGIX Ringtone
Nero
Nokia alle
PC Connectivity
Picasa
Usenet
Viewpoint
Windows Live falls davon nichts genutzt wird, alle weg
Windows Vista Demo

ccleaner öffnen analysieren, bereinigen

sgber10 · 28.12.2011, 19:29

So, alle von Dir genannten Programme sind soweit entfernt, bis auf die nicht von mir nicht beschrifteten, sind alles Spiele

27.12.2011, 19:09	#4
markusg /// Malware-holic	Windows system blockiert bitte weiter mit dem upload um den ich gebeten habe __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

27.12.2011, 20:04	#6
markusg /// Malware-holic	Windows system blockiert einfach in der adressleiste markieren, rechtsklick kopieren und dann im upload channel im richtigen feld einfügen __________________ --> Windows system blockiert

Windows system blockiert

Log-Analyse und Auswertung: Windows system blockiert