Der nächste: Aus Sicherheitsgründen wurde ihr Windowssystem blockiert

emma12 · 12.02.2012, 19:06

Hallo liebes Trojaner-Board,

mich hat der elende "Aus Sicherheitsgründen wurde ihr Windowssystem blockiert"-Tojaner auch erwischt. Ich würde mich sehr freuen, wenn ihr mir auch bei der Bereinigung meines Computers helfen könntet.

Den ersten Schritt habe ich mir aus den anderen Threads zu diesem Trojaner abgeschaut. Ich habe den Computer im angesicherten Modus mit Netzwerk gestartet, OTL heruntergeladen und den Scan laufen gelassen.

Den Inhalt der Logfiles findet ihr weiter unten.

Vielen Dank im Voraus!!!

OTL.txt:

Code:

ATTFilter

OTL logfile created on: 12.02.2012 18:46:20 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\***********\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,47 Gb Available Physical Memory | 73,63% Memory free
4,21 Gb Paging File | 3,87 Gb Available in Paging File | 91,93% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 12,39 Gb Free Space | 16,62% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 67,35 Gb Free Space | 99,50% Space Free | Partition Type: NTFS
 
Computer Name: ***********-PC | User Name: *********** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (All) ==========
 
PRC - C:\Users\***********\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\System32\lsass.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\winlogon.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wininit.exe (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\svchost.exe  [comLaunch] (Microsoft Corporation)
PRC - C:\Windows\System32\smss.exe (Microsoft Corporation)
PRC - C:\Windows\System32\services.exe (Microsoft Corporation)
PRC - C:\Windows\System32\lsm.exe (Microsoft Corporation)
PRC - C:\Windows\System32\csrss.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\js3250.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Users\***********\AppData\Roaming\Mozilla\Firefox\Profiles\m5eq1o6n.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll ()
MOD - C:\Users\***********\AppData\Roaming\Mozilla\Firefox\Profiles\m5eq1o6n.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll ()
MOD - C:\Program Files\WinRAR\rarext.dll ()
MOD - C:\Program Files\Adobe\Reader 8.0\Reader\viewerps.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (InCDsrv) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
SRV - (ASLDRService) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
SRV - (spmgr) -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe ()
SRV - (StkSSrv) -- C:\Windows\System32\StkCSrv.exe (Syntek America Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ss_mdm) -- C:\Windows\System32\drivers\ss_mdm.sys (MCCI Corporation)
DRV - (ss_mdfl) -- C:\Windows\System32\drivers\ss_mdfl.sys (MCCI Corporation)
DRV - (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM) -- C:\Windows\System32\drivers\ss_bus.sys (MCCI Corporation)
DRV - (incdrm) -- C:\Windows\System32\drivers\InCDRm.sys (Nero AG)
DRV - (InCDPass) -- C:\Windows\System32\drivers\InCDPass.sys (Nero AG)
DRV - (InCDfs) -- C:\Windows\System32\drivers\InCDfs.sys (Nero AG)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (StkCMini) -- C:\Windows\System32\drivers\StkCMini.sys (Syntek)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (ghaio) -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys ()
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (SE27bus) Sony Ericsson Device 039 Driver driver (WDM) -- C:\Windows\System32\drivers\SE27bus.sys (MCCI)
DRV - (WmXlCore) -- C:\Windows\System32\drivers\WmXlCore.sys (Logitech Inc.)
DRV - (WmFilter) -- C:\Windows\System32\drivers\WmFilter.sys (Logitech Inc.)
DRV - (WmBEnum) -- C:\Windows\System32\drivers\WmBEnum.sys (Logitech Inc.)
DRV - (WmVirHid) -- C:\Windows\System32\drivers\WmVirHid.sys (Logitech Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 2
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8064.0206: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer: C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.26\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.04 09:12:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.26\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.04 09:12:08 | 000,000,000 | ---D | M]
 
[2008.12.07 15:47:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***********\AppData\Roaming\mozilla\Extensions
[2012.02.11 21:45:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***********\AppData\Roaming\mozilla\Firefox\Profiles\m5eq1o6n.default\extensions
[2011.11.23 20:22:35 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***********\AppData\Roaming\mozilla\Firefox\Profiles\m5eq1o6n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.07.25 11:40:57 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\***********\AppData\Roaming\mozilla\Firefox\Profiles\m5eq1o6n.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.04.10 18:58:45 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\***********\AppData\Roaming\mozilla\Firefox\Profiles\m5eq1o6n.default\extensions\firefox@tvunetworks.com
[2008.12.21 17:36:00 | 000,000,681 | ---- | M] () -- C:\Users\***********\AppData\Roaming\Mozilla\Firefox\Profiles\m5eq1o6n.default\searchplugins\ask.xml
[2009.06.19 11:25:17 | 000,001,632 | ---- | M] () -- C:\Users\***********\AppData\Roaming\Mozilla\Firefox\Profiles\m5eq1o6n.default\searchplugins\live-search.xml
[2009.02.06 11:33:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2008.12.07 15:47:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\talkback@mozilla.org
[2011.03.12 13:46:51 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.03.12 13:46:51 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.03.12 13:46:51 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.03.12 13:46:51 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.03.12 13:46:51 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll ()
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe ()
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ASUSTPE] C:\Windows\System32\ASUSTPE.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE (ASUSTeK Computer INC.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [ffdwnd] C:\Users\***********\AppData\Local\Mozilla\Firefox\firefox.exe (3M Touch Systems, Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0DB1CF22-3F7E-4E4D-86A3-FABBDB816753}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5F6BBCC8-BC8D-459A-AFEA-E3746B8FBA1C}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img17.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img17.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{95657106-fea1-11dd-95ab-001d60de5ed7}\Shell - "" = AutoRun
O33 - MountPoints2\{95657106-fea1-11dd-95ab-001d60de5ed7}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{95657120-fea1-11dd-95ab-001d60de5ed7}\Shell - "" = AutoRun
O33 - MountPoints2\{95657120-fea1-11dd-95ab-001d60de5ed7}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{b117b55c-a4c4-11dc-b646-001d60de5ed7}\Shell\AutoRun\command - "" = G:\
O33 - MountPoints2\{b117b55c-a4c4-11dc-b646-001d60de5ed7}\Shell\explore\Command - "" = WScript.exe .\autorun.vbs
O33 - MountPoints2\{b117b55c-a4c4-11dc-b646-001d60de5ed7}\Shell\open\Command - "" = WScript.exe .\autorun.vbs
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.12 18:41:52 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\***********\Desktop\OTL.exe
[2012.01.15 22:03:30 | 000,000,000 | ---D | C] -- C:\Users\***********\Documents\30. Geburstag
[2007.01.24 11:08:39 | 000,005,632 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.12 18:41:08 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\***********\Desktop\OTL.exe
[2012.02.12 18:37:02 | 000,032,768 | ---- | M] () -- C:\Users\***********\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.12 18:37:02 | 000,001,356 | ---- | M] () -- C:\Users\***********\AppData\Local\d3d9caps.dat
[2012.02.12 18:37:02 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2012.02.12 18:34:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.12 18:32:42 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.02.12 18:05:55 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.12 18:05:46 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.12 18:05:46 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.11 22:13:20 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.02.11 21:35:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.11 21:15:09 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{88AFEE2D-21ED-4A74-9E94-2E1C8EEE152D}.job
[2012.01.27 00:21:24 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
 
========== Files Created - No Company Name ==========
 
[2009.04.20 14:41:46 | 000,001,356 | ---- | C] () -- C:\Users\***********\AppData\Local\d3d9caps.dat
[2009.02.13 12:13:55 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2009.02.12 18:40:26 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2009.01.19 23:14:35 | 000,004,096 | -H-- | C] () -- C:\Users\***********\AppData\Local\keyfile3.drm
[2009.01.15 14:15:48 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2008.12.28 12:40:56 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.11.21 22:47:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.11.21 22:44:16 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008.04.04 18:46:31 | 000,105,318 | ---- | C] () -- C:\Windows\hpqins16.dat
[2008.02.21 10:19:40 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.12.30 21:56:15 | 000,032,768 | ---- | C] () -- C:\Users\***********\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.12.24 17:24:11 | 000,001,024 | ---- | C] () -- C:\Windows\System32\clauth2.dll
[2007.12.24 17:24:11 | 000,001,024 | ---- | C] () -- C:\Windows\System32\clauth1.dll
[2007.12.24 17:24:11 | 000,000,000 | ---- | C] () -- C:\Windows\System32\serauth2.dll
[2007.12.24 17:24:11 | 000,000,000 | ---- | C] () -- C:\Windows\System32\serauth1.dll
[2007.12.24 17:24:11 | 000,000,000 | ---- | C] () -- C:\Windows\System32\nsprs.dll
[2007.12.24 17:19:40 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll
[2007.12.24 17:19:40 | 000,000,205 | ---- | C] () -- C:\Windows\System32\lsprst7.dll
[2007.11.30 20:46:48 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2007.11.28 19:15:55 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007.11.27 12:47:11 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2007.11.26 22:50:39 | 000,164,347 | ---- | C] () -- C:\Windows\hpoins19.dat
[2007.11.26 21:53:34 | 000,000,546 | ---- | C] () -- C:\Windows\System32\AB.DAT
[2007.11.01 09:49:51 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe
[2007.11.01 09:32:56 | 000,033,136 | ---- | C] () -- C:\Windows\ASScrPro.exe
[2007.11.01 09:32:45 | 000,037,232 | ---- | C] () -- C:\Windows\ASScrProlog.exe
[2007.11.01 09:32:41 | 000,012,288 | ---- | C] () -- C:\Windows\impborl.dll
[2007.04.18 10:14:04 | 000,641,344 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2007.04.18 10:14:04 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2007.04.18 10:14:04 | 000,116,706 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2007.04.18 10:14:04 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007.04.18 10:06:01 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2007.04.18 09:33:08 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2007.03.13 21:01:59 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2007.03.06 15:55:03 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.03.06 15:30:01 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2007.03.06 12:04:53 | 000,143,676 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007.01.16 08:01:47 | 000,061,440 | ---- | C] () -- C:\Windows\StkUnist.exe
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,376,552 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,610,142 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,103,924 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 08:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 08:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2006.03.09 19:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
 
========== LOP Check ==========
 
[2010.05.01 12:50:39 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\elsterformular
[2010.12.13 22:07:36 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\everpixx
[2009.05.17 21:42:08 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\FMA
[2009.07.06 15:02:51 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\Image Zone Express
[2009.04.20 14:55:06 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\LimeWire
[2007.12.05 17:05:37 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\Printer Info Cache
[2009.02.13 12:18:42 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\Samsung
[2009.04.17 14:18:35 | 000,000,000 | ---D | M] -- C:\Users\***********\AppData\Roaming\uTorrent
[2012.02.12 18:32:44 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.02.11 21:15:09 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{88AFEE2D-21ED-4A74-9E94-2E1C8EEE152D}.job
 
========== Purity Check ==========
 
 

< End of report >

Extras.txt

Code:

ATTFilter

OTL Extras logfile created on: 12.02.2012 18:46:20 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\**************\Desktop
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,47 Gb Available Physical Memory | 73,63% Memory free
4,21 Gb Paging File | 3,87 Gb Available in Paging File | 91,93% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 12,39 Gb Free Space | 16,62% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 67,35 Gb Free Space | 99,50% Space Free | Partition Type: NTFS
 
Computer Name: **************-PC | User Name: ************** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [CEWE FOTOSCHAU] -- "C:\Users\**************\Downloads\Mein CEWE FOTOBUCH\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Mein CEWE FOTOBUCH] -- "C:\Users\**************\Downloads\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe" "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03166EE3-5297-4728-842B-286CE6605ADB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{0632190D-068C-4960-8FC6-340FBF21637C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{1C43FADA-C5E2-42A4-8CBE-6C446460390C}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{28EA605C-D646-4232-AD3C-DA295A309EFA}" = rport=138 | protocol=17 | dir=out | app=system | 
"{49697D26-FAA9-4525-ADF5-B6259B232C69}" = lport=445 | protocol=6 | dir=in | app=system | 
"{656B2986-0785-440F-9192-6CF7A25CC585}" = lport=138 | protocol=17 | dir=in | app=system | 
"{6AADF25D-2A68-478E-A188-247790DB8CD1}" = lport=139 | protocol=6 | dir=in | app=system | 
"{79C2463E-B71D-49FB-B81B-AD1DAD398D46}" = rport=139 | protocol=6 | dir=out | app=system | 
"{8697A9D5-6D30-4CFD-BAE1-8E3ADF2274A5}" = rport=137 | protocol=17 | dir=out | app=system | 
"{983F7B4B-4EEE-4EB4-9969-124074F7E48A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{9FA29F5C-7B48-4DB6-8E81-D3A6E9297F58}" = lport=137 | protocol=17 | dir=in | app=system | 
"{D8C4E0C5-6585-432A-8772-071469AAC135}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{E9C5CB54-CD34-4F97-BEA3-90CF54023554}" = rport=445 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{334F1C22-01EB-49E4-9B9D-6E9311DF8477}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{34297D13-7484-4729-AC01-D9C474E66A39}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{4FCDEE6E-65E0-48E8-B581-636301FE2221}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{58C0BB9E-AD0D-40E3-9BC8-4CCDE890926D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{67648289-5C69-4057-97F2-D6C81863CA0F}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{929753CA-670E-4CCA-9C44-19F94C0A838D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{9B286485-0E74-4573-9B61-A247AFF4213C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{9DF34EE7-828B-4B6F-AA5E-D2EC44DE9072}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{A2005CB3-BBD4-4C59-A4B4-25A4647E9881}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{A5788B29-2409-46A0-AC2C-3EFB22162430}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{B5CC216F-3C17-4E04-8C9E-172F89CE9E14}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{CF52BCE4-C90B-43CD-AF66-463B47CF5104}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{EB6B7D13-DDB1-4C31-B074-529E50C32EFA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"TCP Query User{080F150F-2861-47A9-AD62-63F733D4CA7A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{3FF166F0-D282-4280-A171-66473F2F657B}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"TCP Query User{44946AE0-5252-4618-A951-167A14F0DC78}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{5ADB598D-B73C-4048-BBB5-041E6E283952}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{73E4D477-7F62-4927-9C08-76B6166C8345}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | 
"TCP Query User{7FC4CE77-B963-4BDF-9B19-B13D2E8CFAF2}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"TCP Query User{B02D24EE-A9D7-4315-92E4-734555A4244C}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | 
"TCP Query User{C386196F-FA87-4E94-BCDB-256C2E2B5D78}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{0DA45C37-5108-426D-ABD8-EC39A6096316}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
"UDP Query User{2FEBC233-1F34-4AEB-B56C-F4B6FFAA9CB8}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"UDP Query User{461E5FDB-966A-4782-A62F-D684C41DE891}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | 
"UDP Query User{7E6C7B08-6D6A-4F87-8BA5-1CEB744D0F9F}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{9EFA9363-AB05-444B-B669-8F819140E89B}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | 
"UDP Query User{CDF35026-F4FA-4C00-B1AF-BACF2BB63163}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{F5963983-F431-4978-B21E-51D8AC0B3E65}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{FEF3BB24-9A46-4B42-A974-F5C12140A758}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{04F707AE-1AFD-FCB3-15FB-678EB18E5276}" = Catalyst Control Center Graphics Light
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0B75F2BE-EA34-C35E-795B-14B6AD05EF33}" = CCC Help English
"{0C352FE8-D3C7-5679-3916-94B703AE2568}" = Catalyst Control Center Localization Portuguese
"{0CEF967E-5776-AAB4-24B7-B77B1CFD1F1B}" = ccc-utility
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{119B7481-0216-40D2-A5CC-C3E1F461ECC1}" = Windows Live Fotogalerie
"{12127C0A-4364-AF17-890A-161497C7C445}" = CCC Help Polish
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B9AE6F8-4554-46D3-AE85-7EF52EE0C4B7}" = Tischtennis
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2
"{1F1D117B-2819-5686-F837-6F573CD98D1B}" = Catalyst Control Center Localization Thai
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{26DBD556-77EA-04E4-ED34-9C341ECBCD10}" = Catalyst Control Center Localization Turkish
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Driver Installation Program
"{2DE63F00-FDAA-54A5-CB0D-14CE878A6BEB}" = Catalyst Control Center Localization Czech
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{34B92C91-1B7F-CA25-A565-D7B93050A7E5}" = Catalyst Control Center Localization Spanish
"{363AA734-FEDD-B361-AC59-99F8F323881A}" = CCC Help Norwegian
"{36CEB090-7231-0532-59A3-3D5CD5EBB689}" = Catalyst Control Center Graphics Previews Vista
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E46600E-8E92-AE52-F505-2552A0EA1697}" = CCC Help Danish
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{41CE9D26-2DF7-498D-8E16-314507EDEE21}" = Samsung PC Studio 3
"{4385133D-4A33-2565-7B46-80A89EA0E888}" = Catalyst Control Center Localization Italian
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{54B1E5A3-1B29-4582-A226-172A1FC7BA6C}" = Windows Live Family Safety
"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{58AEE3E0-8746-11DD-81B6-000AE67E2618}_is1" = grafstat4
"{592ED299-14EF-4C0F-92B4-B62E7CD5A2BE}_is1" = everpixx 6.1
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{5E6D6161-5509-4f55-9372-1E01792F843A}" = F300_Help
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{61F128C7-59EB-98EA-FE59-2BE6332DF04B}" = CCC Help Chinese Traditional
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{63B3A1B7-DE32-A193-486A-6A39D08C235C}" = CCC Help Chinese Standard
"{63EC2860-FAC7-5BC0-5F6A-BCE20C0EBC80}" = Catalyst Control Center Localization Norwegian
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{666472B6-06A7-0C3A-6165-9A133013BDB2}" = Catalyst Control Center Localization Chinese Traditional
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B387AB8-A460-5B93-0517-0A9B0D4318B9}" = Catalyst Control Center Graphics Full New
"{6CF08F61-9C7D-8F20-ADED-7A40AEE6F2B7}" = Catalyst Control Center Localization Chinese Standard
"{6D9B9CF3-1E9C-45B6-B41E-5CF568605556}" = SPSS 15.0 für Windows [Auswertung Version]
"{6E32B134-CA8D-49DD-B94C-0DB155CE70B5}" = ccc-Branding
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72DCA752-2EAC-3FC8-60C9-19A0D3884302}" = CCC Help Hungarian
"{7463A3EB-F88E-00FC-6081-AD02FB321C54}" = Catalyst Control Center Localization Swedish
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{780950E3-008C-FE5E-AEE6-5EF77D81B31F}" = Catalyst Control Center Core Implementation
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D83D3A4-0F45-8075-0AB6-B6D1106CF1B8}" = CCC Help Dutch
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{83A40382-EA9B-A1DF-C2E9-32D65E0B8C23}" = Catalyst Control Center Localization Hungarian
"{83E06C1E-B97B-2679-5EFA-7D0D7FA1ADF1}" = CCC Help Swedish
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{863373A8-5B31-2CBA-16E2-6780AE724DB4}" = CCC Help Portuguese
"{876FF807-179D-663C-3989-B9E97DD7DF43}" = Catalyst Control Center Localization Russian
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{88F36928-8B64-08CB-983A-8B2042CF15D0}" = Catalyst Control Center Localization Dutch
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
"{90120000-0015-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0410-0000-0000000FF1CE}" = Microsoft Office Access MUI (Italian) 2007
"{90120000-0015-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0413-0000-0000000FF1CE}" = Microsoft Office Access MUI (Dutch) 2007
"{90120000-0015-0413-0000-0000000FF1CE}_PROHYBRIDR_{DC387AA5-94A6-4920-B004-D59846526D81}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0016-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0413-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Dutch) 2007
"{90120000-0016-0413-0000-0000000FF1CE}_PROHYBRIDR_{DC387AA5-94A6-4920-B004-D59846526D81}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0018-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0413-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Dutch) 2007
"{90120000-0018-0413-0000-0000000FF1CE}_PROHYBRIDR_{DC387AA5-94A6-4920-B004-D59846526D81}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
"{90120000-0019-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0410-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Italian) 2007
"{90120000-0019-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0413-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Dutch) 2007
"{90120000-0019-0413-0000-0000000FF1CE}_PROHYBRIDR_{DC387AA5-94A6-4920-B004-D59846526D81}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0410-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Italian) 2007
"{90120000-001A-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0413-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Dutch) 2007
"{90120000-001A-0413-0000-0000000FF1CE}_PROHYBRIDR_{DC387AA5-94A6-4920-B004-D59846526D81}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_PROHYBRIDR_{AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001B-0410-0000-0000000FF1CE}_PROHYBRIDR_{71CCE0F1-A3B4-49C9-A328-1DABE845E0C4}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0413-0000-0000000FF1CE}" = Microsoft Office Word MUI (Dutch) 2007
"{90120000-001B-0413-0000-0000000FF1CE}_PROHYBRIDR_{DC387AA5-94A6-4920-B004-D59846526D81}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_PROHYBRIDR_{14809F99-C601-4D4A-9391-F1E8FAA964C5}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_PROHYBRIDR_{D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-002C-0413-0000-0000000FF1CE}" = Microsoft Office Proofing (Dutch) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_PROHYBRIDR_{B165D3C2-40AE-4D39-86F7-E5C87C4264C0}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-006E-0410-0000-0000000FF1CE}_PROHYBRIDR_{0A75DA12-55CB-4DE5-8B6A-74D97847204E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0413-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Dutch) 2007
"{90120000-006E-0413-0000-0000000FF1CE}_PROHYBRIDR_{89C8E56A-90D8-4598-B0E6-EB28F6270E07}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9029363A-8173-435A-9C7C-94AE7E4945D8}_is1" = floAt's Mobile Agent 2
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials
"{937EC4CC-5B69-2990-FC5B-512E1520D0DA}" = CCC Help Russian
"{93DDECDF-0AA0-B360-6A6F-288099DD2D98}" = CCC Help Finnish
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0120-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{97F32DF8-D66E-446A-A425-C1D7B45C1033}" = Nero 7 Essentials
"{99D9B4EB-FE36-8A77-ABA9-1FA02E635E63}" = Catalyst Control Center Localization Danish
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9B63540D-D942-4C38-B42E-A48AE0145970}" = Virtua Tennis 3
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3103F91-39CE-BEDE-680A-D41F26F97D8F}" = CCC Help Thai
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A6752CB8-1FA2-070B-C80E-B3B67781603C}" = CCC Help Spanish
"{A7714FC2-BFEC-31A6-AA47-321676B73DFA}" = CCC Help German
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch
"{AD757BEF-0720-BA67-FD34-5FB5D950BD60}" = Catalyst Control Center Localization French
"{AE46ABD3-D625-467F-B5A7-8D3FFF077F0D}" = Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista
"{B01C55C2-37BC-3B95-CAE2-4D12F50FAF8F}" = Catalyst Control Center Localization Korean
"{B021DB07-517A-1FE9-05E1-2FF29870C53D}" = Catalyst Control Center Localization German
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B5D76EC0-13E1-DFEE-9DA4-5F8BC9F4C5CF}" = Catalyst Control Center Graphics Previews Common
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{B9242864-2841-4ADE-86E0-8F90F91B04DD}" = Logitech Gaming Software
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology
"{C3834E9A-09EE-3809-3479-0A2E0487EB64}" = CCC Help Greek
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CD54A3A7-2CE4-CB17-F5BC-ED6F48501AF8}" = CCC Help French
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CEF65258-EB04-DA25-3C8B-93E44F2321C6}" = CCC Help Italian
"{D1371B55-1ABB-113F-980B-5531C9529416}" = CCC Help Czech
"{D36A399D-5F74-F01C-3102-3768514B2383}" = ccc-core-static
"{DB5C6904-E162-3DA7-8D92-9F5D70FA9E7F}" = CCC Help Japanese
"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E0C2FD92-2054-781C-7719-F3FE978B571A}" = Catalyst Control Center Localization Finnish
"{E36D7B40-4411-3B38-DAC0-4CF6574C1DB9}" = Skins
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{ED03EBC3-0621-1ED7-11FA-E22D8FC79909}" = Catalyst Control Center Localization Polish
"{ED636101-1959-4360-8BF7-209436E7DEE4}" = Windows Live Sync
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1568757-E564-4cb5-8980-9333119A4384}" = F300
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F33B21FC-D4B9-522A-5B67-F87A0BAA3268}" = CCC Help Korean
"{F36828A9-4231-579E-2393-E43B299D77B8}" = Catalyst Control Center Localization Japanese
"{F6AC5364-2FB7-437a-811A-D645F22AA6AC}" = F300Trb
"{F6D1EEB6-544C-7071-DB1B-11FA4A9AC432}" = Catalyst Control Center Graphics Full Existing
"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = PowerForPhone
"{FC9CCB53-0EC6-A64E-52C2-68C70858AA56}" = CCC Help Turkish
"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FF216817-DAE6-3280-28EF-C4F12A88E33F}" = Catalyst Control Center Localization Greek
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"ATI Uninstaller" = ATI Uninstaller
"Avira AntiVir Desktop" = Avira Free Antivirus
"ElsterFormular 11.4.1.4323" = ElsterFormular
"Free Video to Mp3 Converter_is1" = Free Video to Mp3 Converter version 3.1
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.1
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"LimeWire" = LimeWire 4.18.8
"Mein CEWE FOTOBUCH" = Mein CEWE FOTOBUCH
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.26)" = Mozilla Firefox (3.6.26)
"PartyPoker" = PartyPoker
"PDFCreator Toolbar" = PDFCreator Toolbar
"PROHYBRIDR" = 2007 Microsoft Office system
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Shop for HP Supplies" = Shop for HP Supplies
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"UnityWebPlayer" = Unity Web Player
"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

markusg · 12.02.2012, 19:40

hi
bitte im script *** durch nutzernamen ersetzen damit es läuft

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [ffdwnd] C:\Users\***********\AppData\Local\Mozilla\Firefox\firefox.exe (3M Touch Systems, Inc.)
 :Files
C:\Users\***********\AppData\Local\Mozilla\Firefox\firefox.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

emma12 · 12.02.2012, 20:15

Hallo,

Danke für Deine Mühe! Bin ja wahrlich nicht die erste der Du heute bei diesem Problem hilfst.

Hab die Schritte wie Du beschrieben hast durchgeführt.
Der Computer ist nun im normalen Modus neugestartet.

Hier ist der Inhalt des Logfile:

Code:

ATTFilter

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ffdwnd deleted successfully.
C:\Users\******\AppData\Local\Mozilla\Firefox\firefox.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Public
 
User: ******
->Flash cache emptied: 94170 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
 
User: Public
 
User: ******
->Temp folder emptied: 5411 bytes
->Temporary Internet Files folder emptied: 352763963 bytes
->Java cache emptied: 20990710 bytes
->FireFox cache emptied: 106014551 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 110928465 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 7795404 bytes
RecycleBin emptied: 1828380037 bytes
 
Total Files Cleaned = 2.314,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 02122012_195940

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

markusg · 12.02.2012, 20:40

hi, surfe nur auf den von mir genannten seiten, bis wir fertig sind.
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.

emma12 · 14.02.2012, 11:13

Hallo,

es hat etwas länger gedauert, aber nach fast 2 Tagen Dauerinstallation sind alle wichtigen und optionalen Windows Updates installiert.
Was soll ich als nächstes tun?

Viele Grüße
emma12

markusg · 14.02.2012, 11:18

jo, hättest gleich die updates instaliert, wäre das pro monat nur ne sache von minuten :-)

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

emma12 · 14.02.2012, 19:52

So, ich konnte nun ComboFix ausführen.

Nachdem es durchgelaufen ist, konnte ich kein Programm mehr öffnen. Jedes Mal kam die folgenden Fehlermeldung:

Zitat:

Es wurde versucht, einen Registrierungschlüssel einem unzulässigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

Daraufhin habe ich den Computer im abgesicherten Modus neugestartet und konnte wieder Programme öffnen. Ist das ein normales Phänomen oder habe ich etwas falsch gemacht?

Hier ist der Inhalt von ComboFix.txt:

Code:

ATTFilter

ComboFix 12-02-13.01 - ******** 14.02.2012  18:49:26.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2047.1122 [GMT 1:00]
ausgeführt von:: c:\users\********\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-01-14 bis 2012-02-14  ))))))))))))))))))))))))))))))
.
.
2012-02-14 18:14 . 2012-02-14 18:14	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-02-13 22:39 . 2012-02-13 22:39	--------	d-----w-	c:\windows\LastGood.Tmp
2012-02-13 21:59 . 2011-03-12 21:55	876032	----a-w-	c:\windows\system32\XpsPrint.dll
2012-02-13 21:31 . 2012-02-13 21:31	--------	d-----w-	c:\program files\Windows Portable Devices
2012-02-13 21:23 . 2009-09-10 02:00	92672	----a-w-	c:\windows\system32\UIAnimation.dll
2012-02-13 21:23 . 2009-09-10 02:01	3023360	----a-w-	c:\windows\system32\UIRibbon.dll
2012-02-13 21:23 . 2009-09-10 02:00	1164800	----a-w-	c:\windows\system32\UIRibbonRes.dll
2012-02-13 21:17 . 2012-02-13 21:17	979456	----a-w-	c:\windows\system32\MFH264Dec.dll
2012-02-13 21:16 . 2012-02-13 21:16	519680	----a-w-	c:\windows\system32\d3d11.dll
2012-02-13 21:16 . 2012-02-13 21:16	369664	----a-w-	c:\windows\system32\WMPhoto.dll
2012-02-13 21:16 . 2012-02-13 21:16	321024	----a-w-	c:\windows\system32\PhotoMetadataHandler.dll
2012-02-13 21:16 . 2012-02-13 21:16	252928	----a-w-	c:\windows\system32\dxdiag.exe
2012-02-13 21:16 . 2012-02-13 21:16	195584	----a-w-	c:\windows\system32\dxdiagn.dll
2012-02-13 21:16 . 2012-02-13 21:16	189440	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2012-02-13 21:16 . 2012-02-13 21:16	974848	----a-w-	c:\windows\system32\WindowsCodecs.dll
2012-02-13 19:29 . 2011-10-27 08:01	3602816	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-02-13 19:29 . 2011-10-27 08:01	3550080	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-02-13 19:29 . 2011-10-14 16:03	189952	----a-w-	c:\windows\system32\winmm.dll
2012-02-13 19:29 . 2011-10-14 16:00	23552	----a-w-	c:\windows\system32\mciseq.dll
2012-02-13 19:29 . 2011-07-29 16:01	293376	----a-w-	c:\windows\system32\psisdecd.dll
2012-02-13 19:29 . 2011-07-29 16:01	217088	----a-w-	c:\windows\system32\psisrndr.ax
2012-02-13 19:29 . 2011-07-29 16:00	57856	----a-w-	c:\windows\system32\MSDvbNP.ax
2012-02-13 19:29 . 2011-07-29 16:00	69632	----a-w-	c:\windows\system32\Mpeg2Data.ax
2012-02-13 19:29 . 2011-11-18 20:23	1205064	----a-w-	c:\windows\system32\ntdll.dll
2012-02-13 19:27 . 2011-11-18 17:47	66560	----a-w-	c:\windows\system32\packager.dll
2012-02-13 19:27 . 2011-11-25 15:59	376320	----a-w-	c:\windows\system32\winsrv.dll
2012-02-13 19:27 . 2011-12-01 15:21	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
2012-02-13 19:27 . 2011-09-20 21:02	905088	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-02-13 07:21 . 2012-02-13 07:23	--------	d-----w-	c:\windows\system32\ca-ES
2012-02-13 07:21 . 2012-02-13 07:22	--------	d-----w-	c:\windows\system32\eu-ES
2012-02-13 07:21 . 2012-02-13 07:22	--------	d-----w-	c:\windows\system32\vi-VN
2012-02-13 06:39 . 2012-02-13 06:39	--------	d-----w-	c:\windows\system32\EventProviders
2012-02-13 06:08 . 2010-09-13 13:56	168960	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2012-02-13 06:08 . 2010-09-13 13:56	8147456	----a-w-	c:\windows\system32\wmploc.DLL
2012-02-12 22:40 . 2008-05-27 04:59	18904	----a-w-	c:\windows\system32\StructuredQuerySchemaTrivial.bin
2012-02-12 22:26 . 2009-04-11 06:28	644608	----a-w-	c:\windows\system32\p2psvc.dll
2012-02-12 22:25 . 2009-04-11 06:32	223208	----a-w-	c:\windows\system32\drivers\netio.sys
2012-02-12 22:24 . 2009-04-11 06:28	217088	----a-w-	c:\windows\system32\WerFault.exe
2012-02-12 22:23 . 2009-04-11 06:28	88576	----a-w-	c:\windows\system32\olepro32.dll
2012-02-12 22:22 . 2009-04-11 06:28	83968	----a-w-	c:\windows\system32\wbem\wmiutils.dll
2012-02-12 22:22 . 2009-04-11 06:28	744448	----a-w-	c:\windows\system32\wbem\wbemcore.dll
2012-02-12 22:22 . 2009-04-11 06:28	30208	----a-w-	c:\windows\system32\wbem\wbemprox.dll
2012-02-12 22:22 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\repdrvfs.dll
2012-02-12 22:22 . 2009-04-11 06:28	189440	----a-w-	c:\windows\system32\wbem\mofd.dll
2012-02-12 22:22 . 2009-04-11 06:28	614912	----a-w-	c:\windows\system32\wbem\fastprox.dll
2012-02-12 22:22 . 2009-04-11 06:28	265728	----a-w-	c:\windows\system32\wbem\esscli.dll
2012-02-12 22:22 . 2009-04-11 06:28	705536	----a-w-	c:\windows\system32\SmiEngine.dll
2012-02-12 22:22 . 2009-04-11 06:28	218624	----a-w-	c:\windows\system32\wdscore.dll
2012-02-12 22:22 . 2009-04-11 06:27	130560	----a-w-	c:\windows\system32\PkgMgr.exe
2012-02-12 22:22 . 2009-04-11 06:28	247808	----a-w-	c:\windows\system32\drvstore.dll
2012-02-12 22:19 . 2009-10-09 21:56	2048	----a-w-	c:\windows\system32\winrsmgr.dll
2012-02-12 22:17 . 2011-03-10 17:03	1162240	----a-w-	c:\windows\system32\mfc42u.dll
2012-02-12 22:17 . 2011-03-10 17:03	1136640	----a-w-	c:\windows\system32\mfc42.dll
2012-02-12 22:17 . 2010-12-29 18:28	322560	----a-w-	c:\windows\system32\sbe.dll
2012-02-12 22:17 . 2010-12-29 18:28	153088	----a-w-	c:\windows\system32\sbeio.dll
2012-02-12 22:17 . 2010-12-29 18:26	177664	----a-w-	c:\windows\system32\mpg2splt.ax
2012-02-12 22:17 . 2010-08-17 14:11	128000	----a-w-	c:\windows\system32\spoolsv.exe
2012-02-12 22:14 . 2010-06-17 18:08	10926592	----a-w-	c:\program files\Movie Maker\MOVIEMK.dll
2012-02-12 22:12 . 2010-12-17 15:45	2067968	----a-w-	c:\windows\system32\mstscax.dll
2012-02-12 22:12 . 2010-12-17 13:54	677888	----a-w-	c:\windows\system32\mstsc.exe
2012-02-12 22:12 . 2009-04-11 06:28	63488	----a-w-	c:\windows\system32\tscupgrd.exe
2012-02-12 22:12 . 2010-06-11 16:15	1248768	----a-w-	c:\windows\system32\msxml3.dll
2012-02-12 21:54 . 2010-08-31 15:44	531968	----a-w-	c:\windows\system32\comctl32.dll
2012-02-12 21:07 . 2012-02-12 21:07	--------	d-----w-	C:\PerfLogs
2012-02-12 18:54 . 2012-02-12 19:07	--------	d-----w-	C:\_OTL
2012-02-11 20:23 . 2012-01-06 04:19	6557240	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{1713CE9B-C46E-4952-BF94-5BC8682ECD63}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-14 16:56 . 2007-11-01 08:49	45056	----a-w-	c:\windows\system32\acovcnt.exe
2012-02-13 21:16 . 2012-02-13 21:16	4096	----a-w-	c:\windows\system32\drivers\de-DE\dxgkrnl.sys.mui
2012-02-12 20:29 . 2006-11-02 10:32	101888	----a-w-	c:\windows\system32\ifxcardm.dll
2012-02-12 20:29 . 2006-11-02 10:32	82432	----a-w-	c:\windows\system32\axaltocm.dll
2012-01-26 23:21 . 2009-10-04 11:09	237072	------w-	c:\windows\system32\MpSigStub.exe
2011-12-29 14:16 . 2011-12-29 14:16	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-15 19:46 . 2011-12-15 19:46	1207568	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-15 14:00 . 2011-12-29 15:20	74640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-12-15 14:00 . 2011-12-29 15:20	36000	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2011-12-15 14:00 . 2011-12-29 15:20	134856	----a-w-	c:\windows\system32\drivers\avipbb.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-03-26 149040]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-22 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-26 161328]
"InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-03-26 1057328]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 4390912]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2009-10-26 1458176]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2006-12-12 106496]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2007-11-01 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2007-11-01 33136]
"PowerForPhone"="c:\program files\PowerForPhone\PowerForPhone.exe" [2007-06-26 778240]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-06 136600]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
PDFCreator.lnk - c:\program files\PDFCreator\PDFCreator.exe [2008-2-26 2641920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-06 20:20]
.
2012-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-06 20:20]
.
2012-02-13 c:\windows\Tasks\WebReg Deskjet F300 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-12-10 20:36]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\********\AppData\Roaming\Mozilla\Firefox\Profiles\m5eq1o6n.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
pref(dom.disable_open_during_load, true);FF - user.js: yahoo.homepage.dontask - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-02-14 19:14
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5952)
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll
.
Zeit der Fertigstellung: 2012-02-14  19:19:03
ComboFix-quarantined-files.txt  2012-02-14 18:19
.
Vor Suchlauf: 9 Verzeichnis(se), 14.006.530.048 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 14.449.250.304 Bytes frei
.
- - End Of File - - 44C48AC6DA6F8A7A665D983EF20286BE

markusg · 14.02.2012, 19:54

neustarten bitte, dann gehts wieder.

malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

emma12 · 16.02.2012, 08:50

Hallo,

wieder habe ich etwas länger gebraucht, aber Malwarebytes ist nun durchgelaufen. Es wurde eine infizierte Datei gefunden und diese habe ich entfernt.

Hier ist der Log:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.15.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
********** :: **********-PC [Administrator]

Schutz: Aktiviert

15.02.2012 23:16:17
mbam-log-2012-02-15 (23-16-17).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 358687
Laufzeit: 2 Stunde(n), 33 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\02122012_195940\C_Users\**********\AppData\Local\Mozilla\Firefox\firefox.exe (Trojan.VUPX.MTS1) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg · 16.02.2012, 12:24

hi,
lade den CCleaner standard:
CCleaner Download - CCleaner 3.15.1643
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

emma12 · 18.02.2012, 11:06

Hallo,

hier ist die Liste mit meinen installierten Programmen.
Da ich den Rechner vor ein paar Jahren noch mit meinem Freund geteilt habe, sind da Programme, die ich nicht selbst installiert habe. Da habe ich unnötig oder unbekannt hintergeschrieben. Bei Programmen, die dem Namen nach wichtig erscheinen (Microsoft oder Driver), habe ich notwendig hintergeschrieben auch wenn ich sie teilweise wahrscheinlich indirekt nutze.

Hier ist die Liste:

Code:

ATTFilter

2007 Microsoft Office system	Microsoft Corporation	13.02.2012	1.169MB	12.0.6612.1000 notwenig
Activation Assistant for the 2007 Microsoft Office suites	Microsoft Corporation	31.10.2007	13,5MB notwendig	
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	04.01.2009		10.0.12.36 notwendig
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	28.12.2011		11.1.102.55 notwendig
Adobe Reader 8.1.3 - Deutsch	Adobe Systems Incorporated	13.08.2011	99,8MB	8.1.3 notwendig
Apple Application Support	Apple Inc.	18.12.2011	61,2MB	2.1.6 notwendig
Apple Mobile Device Support	Apple Inc.	18.12.2011	24,3MB	4.0.0.97 notwendig
Apple Software Update	Apple Inc.	18.12.2011	2,38MB	2.1.3.127 notwendig
ASUS InstantFun	ASUS	01.11.2007	14,6MB	1.0.0014 notwendig
ASUS Splendid Video Enhancement Technology	ASUSTeK	31.10.2007	15,8MB	1.02.15 notwendig
ASUS Touch Pad Extra		31.10.2007	0,78MB	nozwendig
Asus_Camera_ScreenSaver	ASUS	31.10.2007		2.0.0005 notwendig
Atheros Driver Installation Program	Atheros	31.10.2007	4,00KB	7.1 unbekannt
ATI Catalyst Install Manager	ATI Technologies, Inc.	05.12.2007	13,8MB	3.0.641.0 notwendig
ATI Uninstaller	ATI Technologies, Inc.	31.10.2007	13,9MB	notwendig
ATK Hotkey	ATK	31.10.2007	5,05MB	1.00.0012 unbekannt
ATK Media		31.10.2007	0,63MB	unbekannt
ATKOSD2	ATK	31.10.2007	7,35MB	6.64.1.4 unbekannt
Avira Free Antivirus	Avira	14.02.2012	167,7MB	12.0.0.898 notwendig
Bing Bar	Microsoft Corporation	21.01.2012	26,9MB	7.0.850.0 unnötig
Bonjour	Apple Inc.	18.12.2011	1,06MB	3.0.0.10 notwendig
CCleaner	Piriform	17.02.2012	4,24MB	3.15 notwendig
Compatibility Pack für 2007 Office System	Microsoft Corporation	13.02.2012	55,5MB	12.0.6612.1000 notwendig
DivX Codec	DivX, Inc.	02.01.2009	13,6MB	6.8.5 notwendig
DivX Converter	DivX, Inc.	02.01.2009	30,4MB	6.6.1 notwendig
DivX Player		02.01.2009	13,6MB	6.8.2 notwendig
DivX Web Player	DivX,Inc.	02.01.2009	2,92MB	1.4.2 notwendig
ElsterFormular	Landesfinanzdirektion Thüringen	30.04.2010	188,2MB	11.4.1.4323 notwendig
ElsterFormular 2008/2009	Steuerverwaltung des Bundes und der Länder	02.05.2009	168,0MB	10.2.0.0 notwendig
everpixx 6.1	everpixx	16.12.2011	27,0MB	notwendig
floAt's Mobile Agent 2	SourceForge	16.05.2009	15,5MB	2.1 unbekannt
Free Video to Mp3 Converter version 3.1	DVD Video Soft Limited.	20.12.2008	5,68MB unbekannt	
Free YouTube to Mp3 Converter version 3.1	DVD Video Soft Limited.	20.12.2008	5,34MB	unbekannt
Google Toolbar for Internet Explorer	Google Inc.	09.01.2012	4,07MB	7.2.2427.2330 notwendig
grafstat4	DrSoft	12.05.2010	80,5MB	4.06 unbekannt
HP Customer Participation Program 8.0	HP	25.11.2007	209MB	8.0 notwendig
HP Imaging Device Functions 8.0	HP	25.11.2007	2,46MB	8.0 notwendig
HP OCR Software 8.0	HP	25.11.2007	2,45MB	8.0 notwendig
HP Photosmart Essential	HP	26.11.2007	10,2MB	1.12.0.46 notwendig
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B	HP	25.11.2007	42,0MB	8.0 notwendig
HP Solution Center 8.0	HP	25.11.2007	2,45MB	8.0 notwendig
HP Update	Hewlett-Packard	19.10.2008	3,71MB	4.000.012.001 notwednig
iTunes	Apple Inc.	18.12.2011	170,9MB	10.5.2.11 notwendig
Java(TM) 6 Update 11	Sun Microsystems, Inc.	06.02.2009	94,4MB	6.0.110 notwendig
Java(TM) 6 Update 3	Sun Microsystems, Inc.	14.02.2008	133,2MB	1.6.0.30 notwendig
Java(TM) 6 Update 5	Sun Microsystems, Inc.	31.03.2008	136,2MB	1.6.0.50 notwendig
LifeFrame2	ASUS	01.11.2007	9,85MB	2.0.14 unbekannt
LimeWire 4.18.8	Lime Wire, LLC	15.01.2009	35,6MB	4.18.8 notwendig
Logitech Gaming Software		23.07.2008	8,48MB	4.40 notwendig
Malwarebytes Anti-Malware Version 1.60.1.1000	Malwarebytes Corporation	13.02.2012	11,5MB	1.60.1.1000 notwendig
Mein CEWE FOTOBUCH		11.12.2010	163,8MB	notwendig
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU	Microsoft Corporation	15.08.2009	37,0MB	notwendig
Microsoft .NET Framework 3.5 SP1	Microsoft Corporation	09.08.2009	37,0MB	notwendig
Microsoft .NET Framework 4 Client Profile	Microsoft Corporation	12.02.2012	120,3MB	4.0.30319 notwendig
Microsoft .NET Framework 4 Client Profile DEU Language Pack	Microsoft Corporation	12.02.2012	24,5MB	4.0.30319 notwendig
Microsoft Office File Validation Add-In	Microsoft Corporation	12.02.2012	11,2MB	14.0.5130.5003 notwendig
Microsoft Office Live Add-in 1.3	Microsoft Corporation	19.06.2009	0,48MB	2.0.2313.0 notwendig
Microsoft Office Outlook Connector	Microsoft Corporation	18.06.2009	6,14MB	12.0.6414.1000 notwendig
Microsoft Office Professional Edition 2003	Microsoft Corporation	15.02.2012	1.094MB	11.0.8173.0 notwendig
Microsoft Silverlight	Microsoft Corporation	15.02.2012	240MB	4.1.10111.0 notwendig
Microsoft SQL Server 2005 Compact Edition [ENU]	Microsoft Corporation	19.06.2009	1,74MB	3.1.0000 notwendig
Microsoft Sync Framework Runtime Native v1.0 (x86)	Microsoft Corporation	19.06.2009	0,61MB	1.0.1215.0 notwendig
Microsoft Sync Framework Services Native v1.0 (x86)	Microsoft Corporation	19.06.2009	1,45MB	1.0.1215.0 notwendig
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053	Microsoft Corporation	10.08.2009	0,25MB	8.0.50727.4053 notwendig
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	25.01.2012	0,29MB	8.0.61001 notwendig
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148	Microsoft Corporation	03.05.2010	0,19MB	9.0.30729.4148 notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729	Microsoft Corporation	01.05.2010	0,59MB	9.0.30729 notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161	Microsoft Corporation	25.01.2012	0,58MB	9.0.30729.6161 notwendig
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	13.02.2012	16,5MB	10.0.40219 notwendig
Motorola SM56 Speakerphone Modem	Motorola Inc	12.02.2012	1,91MB	6.12.25.06 unbekannt
Mozilla Firefox (3.6.26)	Mozilla	03.02.2012	31,8MB	3.6.26 (de) notwendig
MSXML 4.0 SP2 (KB927978)	Microsoft Corporation	18.04.2007	1,24MB	4.20.9841.0 notwendig
MSXML 4.0 SP2 (KB936181)	Microsoft Corporation	05.12.2007	1,27MB	4.20.9848.0 notwendig
MSXML 4.0 SP2 (KB941833)	Microsoft Corporation	07.12.2007	1,27MB	4.20.9849.0 notwendig
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	17.11.2008	1,28MB	4.20.9870.0 notwendig
MSXML 4.0 SP2 (KB973688)	Microsoft Corporation	29.12.2009	1,34MB	4.20.9876.0 notwendig
NB Probe		31.10.2007	2,56MB	unbekant
Nero 7 Essentials	Nero AG	01.11.2007	329MB	7.02.6782 notwendig
PartyPoker	PartyGaming	26.02.2009	61,0MB	128 unnötig
PDFCreator	Frank Heindörfer, Philip Chinery	25.02.2008	30,7MB	0.9.5 notwendig
PDFCreator Toolbar		25.02.2008	1,03MB	3.3.0.1 notwendig
Power4Gear eXtreme	ATK	31.10.2007	4,75MB	1.00.0011 unbekannt
PowerForPhone	PowerForPhone	31.10.2007	0,75MB	1.0.0.14 unbekannt
Realtek 8139 and 8139C+ Ethernet Network Card Driver for Windows Vista	Realtek	31.10.2007	0,61MB	1.00.0000 notwendig
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	31.10.2007	12,1MB	6.0.1.5374 notwendig
Realtek USB 2.0 Card Reader	Realtek	31.10.2007	1,80MB	unnötig
SAMSUNG Mobile Modem Driver Set		14.01.2009 unnötig
Samsung Mobile phone USB driver Software		14.01.2009 notwendig
SAMSUNG Mobile USB Modem 1.0 Software		14.01.2009 unnötig
SAMSUNG Mobile USB Modem Software		14.01.2009 unnötig
Samsung PC Studio 3	Samsung Electronics Co., Ltd.	12.02.2009	133,8MB	3.2.1.80104 unnötig
Shop for HP Supplies	HP	03.04.2008	213MB	10.0 unnötig
Skype™ 4.0	Skype Technologies S.A.	23.03.2009	32,5MB	4.0.216 notwendig
SPSS 15.0 für Windows [Auswertung Version]	SPSS Inc.	24.12.2007	450MB	15.0.1 notwendig
Synaptics Pointing Device Driver	Synaptics	31.10.2007	12,8MB	9.1.5.0 unbekannt
Tischtennis	Pixelbreaker GmbH	11.02.2009	648MB	1.21.0694 unnötig
Uninstall 1.0.0.1		20.12.2008	17,4MB	unbekannt
Unity Web Player	Unity Technologies ApS	02.02.2009	11,4MB	2.1.0f5_16147 unbekannt
USB2.0 1.3M WebCam		31.10.2007		unbekannt
Virtua Tennis 3	Sega	17.07.2008	4.067MB	1.00.0000 unnötig
Winamp	Nullsoft, Inc	29.02.2008	26,9MB	5.52 notwendig
Windows Live Anmelde-Assistent	Microsoft Corporation	19.06.2009	1,93MB	5.000.818.5 notwendig
Windows Live Essentials	Microsoft Corporation	18.06.2009	144,2MB	14.0.8064.0206 notwendig
Windows Live Sync	Microsoft Corporation	19.06.2009	2,80MB	14.0.8064.206 notwendig
Windows Live-Uploadtool	Microsoft Corporation	19.06.2009	0,22MB	14.0.8014.1029 notwendig
Windows Media Player Firefox Plugin	Microsoft Corp	14.08.2008	0,29MB	1.0.0.8 notwendig
WinFlash		31.10.2007	1,32MB	unbekannt
WinRAR		11.02.2009	3,73MB	notwendig
Wireless Console 2	ATK	31.10.2007	1,59MB	2.0.8 unbekannt
µTorrent		12.02.2009	0,26MB	1.8.2 unbekannt

markusg · 18.02.2012, 11:13

deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok

deinstaliere:
Bing
ElsterFormular : deine version ist ja ziemlich veraltet, ich würd das mal updaten:
https://www.elster.de/elfo_home.php

deinstaliere:
floAt's
Free Video
Free YouTube
Google Toolbar : auf toolbars besser verzichten machen den browser nur langsamer.
grafstat4
Java: alle
Download der kostenlosen Java-Software
downloade java jre, instalieren

deinstaliere:
Microsoft Silverlight : falls du es nicht verwendest, weg.
Mozilla : öffnen, hilfe, update, deine version ist total veraltet.
PartyPoker
PDFCreator Toolbar
PowerForPhone
Shop for HP
Skype™ :
Kostenlose Internetanrufe mit Skype. Telefone online billig anrufen
update instalieren.

deinstaliere:
Tischtennis
Unity
Virtua
Windows Live Essentials
Windows Live : wenn du da dienste nicht nutzt, alle weg
µTorrent

öffne otl, bereinigen, neustart.
öffne CCleaner analysieren, bereinigen, neustart.
testen ob alles nach wunsch läufta

emma12 · 19.02.2012, 21:51

Hallo,

ich habe die Liste abgearbeitet. OTL und CCleaner sind gelaufen.

Microsoft Outlook scheint etwas abgekommen zu haben. Allerdings weiß nicht, ob der Fehler nicht schon vorher bestand. Hab das Programm schon länger nicht mehr benutzt. Kann es sein, dass Outlook durch die Prozedur beschädigt wurde? Zuerst gab es eine Meldung, dass die MAPI32.dll beschädigt ist. Zu diesem Problem gab eine Beschreibung und Lösung auf der Microsoft Internetseite. Es kann auftreten, wenn Outlook 2003 und Outlook 2007 gleichzeitig auf einem Computer installiert sind. Ich habe die Schritte aus der Lösungsbeschreibung durchgeführt. Leider stürzt Outlook 2007 trotzdem immer ab nach dem Start.

Unabhängig davon was ist der nächste Schritt zur Bereinigung meines Computers?

Viele Grüße

markusg · 20.02.2012, 11:18

nutzt du denn outlook?
du könntest es ja mal de und reinstalieren.

emma12 · 21.02.2012, 10:54

Eigentlich brauche ich Outlook nicht. Ich werde es einfach reinstallieren, sobald ich den Bedarf habe.

Ich hatte nur die Sorge, dass der Fehler irgendetwas mit dem Trojaner zu tun hat. Aber wenn mein Computer jetzt sauber ist, lasse ich es so wie es ist. Ist die Reinigungprozedur nun eigentlich abgeschlossen? Oder kann ich noch etwas tun?

Der nächste: Aus Sicherheitsgründen wurde ihr Windowssystem blockiert

Plagegeister aller Art und deren Bekämpfung: Der nächste: Aus Sicherheitsgründen wurde ihr Windowssystem blockiert