Hallo mal wieder,

habe eben schon in der anderen Kategorie gepostet und bin nun hierher verwiesen worden.
Ich habe einen provisorischen Scan mit Malware durchgeführt, es wurde etwas gefunden, ich habe dies unter Quarantäne gestellt.
Vor einiger Zeit hatte ich den 50 Euro Virus drauf und seither "kleinere" Probleme.
Ich habe das aber wie gesagt alles schon in der anderen Kat gepostet.
Weiß jetzt grad gar nicht genau, wie ich das Problem beschreiben soll.
Mir wurde jetzt nah gelegt, ich solle nun hier posten...und dabei weiß ich gar nicht, ob ich eigentlich einen Virus draufhabe.
Habe jetzt mal alles ausgeführt, was angefordert ist und hier nun der DDS.txt und im Anhang dann die anderen Sachen.
Hoffe dass die Zip Datei funktioniert.
Sorry, wenn ich grad so unglaublich unklar schreibe. Bin grad selber etwas verwirrt.

LG

Lena-Laura

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.2.0
Run by lena-laura at 0:30:45 on 2012-04-12
Microsoft Windows 7 Starter   6.1.7601.1.1252.49.1031.18.2039.982 [GMT 2:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\windows\system32\svchost.exe -k apphost
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\System32\AsusService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\windows\system32\CISVC.EXE
C:\windows\System32\svchost.exe -k ipripsvc
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\windows\system32\conhost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\windows\System32\tcpsvcs.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\svchost.exe -k iissvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\EeePC\HotkeyService\HotKeyMon.exe
C:\Program Files\EeePC\HotkeyService\HotkeyService.exe
C:\Program Files\EeePC\SHE\SuperHybridEngine.exe
C:\Windows\System32\igfxpers.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Freecorder\FLVSrvc.exe
C:\Program Files\FILSHtray\FILSHtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\windows\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\windows\system32\svchost.exe -k SDRSVC
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\conhost.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
mStart Page = 
uInternet Settings,ProxyOverride = *.local
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
{555d4d79-4bd2-4094-a395-cfc534424a05}
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [Google Update] "c:\users\lena-laura\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [Userinit] c:\users\lena-laura\appdata\roaming\appconf32.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [HotkeyService] AsusSender.exe c:\program files\eeepc\hotkeyservice\HotkeyService.exe
mRun: [HotKeyMon] AsusSender.exe c:\program files\eeepc\hotkeyservice\HotKeyMon.exe
mRun: [SuperHybridEngine] AsusSender.exe c:\program files\eeepc\she\SuperHybridEngine.exe
mRun: [SynAsusAcpi] %ProgramFiles%\Synaptics\SynTP\SynAsusAcpi.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [Freecorder FLV Service] "c:\program files\freecorder\FLVSrvc.exe" /run
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [FILSHtray] "c:\program files\filshtray\FILSHtray.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [<NO NAME>] 
StartupFolder: c:\users\lena-l~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\users\lena-l~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Nach Microsoft E&xel exportieren - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{10D8D06D-13E7-46A5-AEC4-38C5609E3260} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}\1462F40284F6473507F647 : DhcpNameServer = 192.168.12.1
TCP: Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}\353686E656C6C60257E64602351657265627 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}\3636C6 : DhcpNameServer = 217.68.161.141 217.68.161.171
TCP: Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}\65966716C646960284F64756C6021303 : DhcpNameServer = 192.168.1.33
TCP: Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}\65966716C646960284F64756C60293 : DhcpNameServer = 192.168.1.33
TCP: Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}\75C414E4D2133444030393 : DhcpNameServer = 192.168.2.1 192.168.2.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - 
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\lena-laura\appdata\roaming\mozilla\firefox\profiles\ztgpl636.default\
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre7\bin\new_plugin\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
FF - plugin: c:\program files\tracker software\pdf viewer\npPDFXCviewNPPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\lena-laura\appdata\local\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\users\lena-laura\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_228.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.softonic_i.newTab - false
FF - user.js: extensions.softonic_i.tlbrSrchUrl - hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=
FF - user.js: extensions.softonic_i.id - b0a1e4500000000000000625d3f6b5b0
FF - user.js: extensions.softonic_i.instlDay - 15399
FF - user.js: extensions.softonic_i.vrsn - 1.5.11.5
FF - user.js: extensions.softonic_i.vrsni - 1.5.11.5
FF - user.js: extensions.softonic_i.vrsnTs - 1.5.11.51:14:30
FF - user.js: extensions.softonic_i.prtnrId - softonic
FF - user.js: extensions.softonic_i.prdct - softonic
FF - user.js: extensions.softonic_i.aflt - SD
FF - user.js: extensions.softonic_i.smplGrp - eng7
FF - user.js: extensions.softonic_i.tlbrId - de12JANdefault
FF - user.js: extensions.softonic_i.instlRef - MON00015
FF - user.js: extensions.softonic_i.dfltLng - de
FF - user.js: extensions.softonic_i.excTlbr - false
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-5-1 11608]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2010-5-1 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-5-1 269480]
R2 AsusService;Asus Launcher Service;c:\windows\system32\AsusService.exe [2010-2-25 219136]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-5-1 66616]
R2 iprip;RIP-Überwachung;c:\windows\system32\svchost.exe -k ipripsvc [2009-7-14 20992]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\drivers\L1C62x86.sys [2009-8-13 51712]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-11 253600]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-4-1 183560]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-11-8 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2011-5-13 1492840]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-6-14 52224]
.
=============== Created Last 30 ================
.
2012-04-11 13:17:25	418464	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-04-11 13:11:00	7384	----a-w-	c:\users\lena-laura\appdata\roaming\BAcroIEHelpe101.dll
2012-04-11 13:11:00	226808	----a-w-	c:\users\lena-laura\appdata\roaming\AcroIEHelpe101.dll
2012-04-11 02:10:27	--------	d-----w-	c:\users\lena-laura\appdata\roaming\11009
2012-04-10 23:02:45	--------	d-----w-	c:\users\lena-laura\appdata\local\{F863156E-F87C-496F-B226-C7DDAE68E633}
2012-04-10 23:02:32	--------	d-----w-	c:\users\lena-laura\appdata\local\{F025FC7C-40A5-4051-AAA9-E0C028AE904A}
2012-04-10 23:00:43	--------	d-----w-	c:\users\lena-laura\appdata\local\{EE6A1AB8-9E47-4E9F-9169-AC4A88785E2A}
2012-04-10 23:00:29	--------	d-----w-	c:\users\lena-laura\appdata\local\{D581E52F-86D8-4DD7-AF56-E656EEECC13C}
2012-04-09 15:33:44	--------	d-----w-	c:\users\lena-laura\appdata\roaming\11008
2012-04-09 15:33:37	7384	----a-w-	c:\users\lena-laura\appdata\roaming\BAcroIEHelpe099.dll
2012-04-09 15:00:18	--------	d-----w-	c:\users\lena-laura\appdata\roaming\UAs
2012-04-08 20:06:53	--------	d-----w-	c:\users\lena-laura\appdata\roaming\11007
2012-04-08 20:06:32	264	----a-w-	c:\users\lena-laura\appdata\roaming\srvblck5.tmp
2012-04-08 20:06:25	--------	d-----w-	c:\users\lena-laura\appdata\roaming\xmldm
2012-04-08 20:06:24	--------	d-----w-	c:\users\lena-laura\appdata\roaming\kock
2012-04-08 03:27:23	--------	d-----w-	c:\users\lena-laura\appdata\roaming\HpUpdate
2012-04-08 03:27:15	--------	d-----w-	c:\windows\Hewlett-Packard
2012-04-07 16:07:53	--------	d-----w-	c:\users\lena-laura\appdata\local\{0F687047-71DC-499C-9399-34C7414D9952}
2012-04-07 01:51:33	--------	d-----w-	c:\program files\VS Revo Group
2012-04-07 01:44:41	--------	d-----w-	c:\program files\CCleaner
2012-04-06 10:39:07	--------	d-----w-	c:\programdata\Mediafour
2012-04-06 10:37:50	--------	d-----w-	c:\program files\Mediafour
2012-04-04 19:36:09	--------	d-----w-	c:\users\lena-laura\appdata\local\{1A7B5EB3-7759-41FE-AA09-79525CBC2E2D}
2012-04-04 19:35:00	--------	d-----w-	c:\users\lena-laura\appdata\local\{81A290BE-954A-4168-806C-81CA377D7DE2}
2012-04-04 19:25:37	--------	d-----w-	c:\users\lena-laura\appdata\local\{02F6304D-037F-4A4C-8003-5437EE5FA85D}
2012-04-03 18:10:31	--------	d-----r-	c:\users\lena-laura\appdata\roaming\Brother
2012-03-31 00:09:10	--------	d-----w-	c:\users\lena-laura\appdata\local\{4CB2A80D-8224-4701-B414-6843804829AD}
2012-03-24 21:14:13	--------	d-----w-	c:\program files\MixMeister BPM Analyzer
2012-03-18 15:22:48	592824	----a-w-	c:\program files\mozilla firefox\gkmedias.dll
2012-03-18 15:22:48	44472	----a-w-	c:\program files\mozilla firefox\mozglue.dll
2012-03-15 02:02:04	3968368	----a-w-	c:\windows\system32\ntkrnlpa.exe
2012-03-15 02:02:00	3913584	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-03-14 15:33:42	2343424	----a-w-	c:\windows\system32\win32k.sys
2012-03-14 15:33:38	1077248	----a-w-	c:\windows\system32\DWrite.dll
2012-03-14 15:32:43	8192	----a-w-	c:\windows\system32\rdrmemptylst.exe
2012-03-14 15:32:43	129536	----a-w-	c:\windows\system32\rdpcorekmts.dll
2012-03-14 15:32:42	58880	----a-w-	c:\windows\system32\rdpwsx.dll
2012-03-14 15:32:37	826880	----a-w-	c:\windows\system32\rdpcore.dll
2012-03-14 15:32:36	24576	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-03-14 15:32:36	183808	----a-w-	c:\windows\system32\drivers\rdpwd.sys
.
==================== Find3M  ====================
.
2012-04-11 15:19:05	70304	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-11 00:51:03	637848	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-02-11 00:51:03	567184	----a-w-	c:\windows\system32\deployJava1.dll
2012-02-10 17:23:09	152576	----a-w-	c:\windows\system32\msclmd.dll
.
============= FINISH:  0:33:52,34 ===============
         

Hi,

das hier sollte Dein Problem sein:
uRun: [Userinit] c:\users\lena-laura\appdata\roaming\appconf32.exe

Bitte ab sofort nichts mehr mit Hombeanking etc., von einem sauberen Rechner aus alle entsprechenden Passwörter ändern (wird wahrscheinlich ein Banker-Trojaner sein!)

Poste bitte noch mal ein OTL-Log:
OTL
Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop

• Doppelklick auf die OTL.exe

• Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen

• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output

• Unter Extra Registry, wähle bitte Use SafeList

• Klicke nun auf Run Scan links oben

• Wenn der Scan beendet wurde werden 2 Logfiles erstellt (OTL.TXT und EXTRAS.TXT)

• Poste die Logfiles hier in den Thread

chris

hi chris,

otl funktioniert leider nicht. hängt sich immer wieder auf und ich bekomme keine rückmeldung. was nun?

lg

lena-laura

hi chris,

ich nochmal.
hab`s jetzt nochmal im abgesichterten modus versucht und siehe da...es hat geklappt.
im anhang die otl.txt und extras.txt datei.
hoffe, das ist ok, dass ich die beide als anhang mitschicke und nicht hier reinkopiere.

lg
lena-laura

Hi,

• Doppelklick auf die OTL.exe, um das Programm auszuführen.

• Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

• Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

:OTL
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKCU..\Run: [Userinit] C:\Users\lena-laura\AppData\Roaming\appconf32.exe ()
[2012.04.11 04:10:27 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\11009
[2012.04.09 17:33:44 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\11008
[2012.04.09 17:00:18 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\UAs
[2012.04.08 22:06:53 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\11007
[2012.04.08 22:06:25 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\xmldm
[2012.04.08 22:06:24 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\kock
[2012.04.12 12:52:17 | 000,000,016 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\blckdom.res

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = dword:0x01

:Commands
[emptytemp]
[Reboot]
         

• Den roten Run Fixes! Button anklicken.

• Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

• Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

• %systemroot%\_OTL

Malwarebytes Antimalware (MAM)
Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html
Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen:
http://filepony.de/download-chameleon/
Danach bitte update der Signaturdateien (Reiter "Aktualisierungen" -> Suche nach Aktualisierungen")
Fullscan und alles bereinigen lassen! Log posten.

Panda-TLD4-Killer
Den Killler auf das Desktop runterladen:
TDSS-Killer
Starte den Killer, den anschließenden Neustart erlauben!
Falls die Sicherheitslösung mosert, bitte ausschalten oder yorkyt.exe als Ausnahme zulassen!
Nach dem Reboot sollte der Killer von alleine starten (Please wait... Running...),
nicht unterbrechen, nichts am Rechner machen (Laufzeit ca. 5 Minuten).
Wird etwas gefunden, (Detected and requested some bad files) zuerst das Log posten (liegt da wo die Exe liegt, also auf dem Desktop), ->poste den Inhalt der yorkyt.exe.log.
Falls Freigabe erteilt Ja auswählen, der Rechner wird neu gestartet und die erkannten (verseuchten) Treiber ausgetauscht, die TLD-Files gelöscht (yorkyt startet wieder automatisch, nicht unterbrechen!).
Poste nach der Bereinigung noch mal das Log...

chris

So!

Hier erstmal das OTL Log

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Userinit deleted successfully.
C:\Users\lena-laura\AppData\Roaming\appconf32.exe moved successfully.
C:\Users\lena-laura\AppData\Roaming\11009\components folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\11009 folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\11008\components folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\11008 folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\UAs folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\11007\components folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\11007 folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\xmldm folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\kock folder moved successfully.
C:\Users\lena-laura\AppData\Roaming\blckdom.res moved successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"cval" | dword:0x01 /E : value set successfully!
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: DefaultAppPool
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: lena-laura
->Temp folder emptied: 105406 bytes
->Temporary Internet Files folder emptied: 3476675 bytes
->Java cache emptied: 16652 bytes
->FireFox cache emptied: 131089943 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 8633 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10595908 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 139,00 mb
 
 
OTL by OldTimer - Version 3.2.39.2 log created on 04122012_225305

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
         

Hi,

was sagt MAM?

chris

läuft grad noch durch...dauert bestimmt noch ne weile....

ok, dann bis morgen...
chris

gute nacht!

OH nein, Finale und Sibelius....die Programme waren infiziert. Wie ärgerlich. Kann ich die jetzt trotzdem noch nutzen?
Hier das Malware Log.

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.12.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
lena-laura :: PC [Administrator]

12.04.2012 23:10:51
mbam-log-2012-04-12 (23-10-51).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 319528
Laufzeit: 2 Stunde(n), 30 Minute(n), 1 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Userinit (Backdoor.Agent) -> Daten: C:\Users\lena-laura\AppData\Roaming\appconf32.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\lena-laura\Downloads\installer_finale_2007.exe (PUP.Adbunbler) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\lena-laura\Downloads\SoftonicDownloader_fuer_finale-notepad.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\lena-laura\Downloads\SoftonicDownloader_fuer_sibelius.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\lena-laura\AppData\Roaming\appconf32.exe (Backdoor.Agent) -> Löschen bei Neustart.

(Ende)
         

yorkyt.exe log vor dem neustart im anhang...musste die datei umbenennen....war zu groß und dann ist sie nicht erkannt worden und und und...hoffe aber, dass es so funktioniert!

und nach dem neustart....diesmal etwas kürzer ;-)

2012-04-13 02:19:11: Restarting...
2012-04-13 02:21:09: ****************************************************
2012-04-13 02:21:09:  Starting UP ... v 0.0.0.220
2012-04-13 02:21:09: ****************************************************
2012-04-13 02:21:11: Stop TPSRV returns: 2
2012-04-13 02:21:26: Listing processes...
2012-04-13 02:21:26:    :[System Process]:0
2012-04-13 02:21:27:    :System:4
2012-04-13 02:21:27:    :smss.exe:288
2012-04-13 02:21:27:    :csrss.exe:412
2012-04-13 02:21:27:    :wininit.exe:452
2012-04-13 02:21:27:    :csrss.exe:460
2012-04-13 02:21:27:    :services.exe:512
2012-04-13 02:21:28:    :winlogon.exe:544
2012-04-13 02:21:28:    :lsass.exe:556
2012-04-13 02:21:28:    :lsm.exe:564
2012-04-13 02:21:28:    :svchost.exe:696
2012-04-13 02:21:29:    :svchost.exe:780
2012-04-13 02:21:29:    :svchost.exe:868
2012-04-13 02:21:29:    :svchost.exe:912
2012-04-13 02:21:29:    :svchost.exe:944
2012-04-13 02:21:30:    :audiodg.exe:1048
2012-04-13 02:21:30:    :svchost.exe:1092
2012-04-13 02:21:30:    :svchost.exe:1236
2012-04-13 02:21:30:    :svchost.exe:1372
2012-04-13 02:21:30:    :spoolsv.exe:1524
2012-04-13 02:21:31:    :sched.exe:1552
2012-04-13 02:21:31:    :avguard.exe:1644
2012-04-13 02:21:31:    :svchost.exe:1672
2012-04-13 02:21:31:    :AppleMobileDeviceService.exe:1696
2012-04-13 02:21:31:    :AsusService.exe:1780
2012-04-13 02:21:31:    :mDNSResponder.exe:1816
2012-04-13 02:21:31:    :CISVC.EXE:1856
2012-04-13 02:21:31:    :avshadow.exe:1912
2012-04-13 02:21:31:    :conhost.exe:1920
2012-04-13 02:21:31:    :svchost.exe:1928
2012-04-13 02:21:31:    :taskhost.exe:1964
2012-04-13 02:21:32:    :svchost.exe:2016
2012-04-13 02:21:32:    :dwm.exe:324
2012-04-13 02:21:32:    :svchost.exe:488
2012-04-13 02:21:33:    :explorer.exe:444
2012-04-13 02:21:33:    :SeaPort.EXE:796
2012-04-13 02:21:33:    :TCPSVCS.EXE:1280
2012-04-13 02:21:33:    :svchost.exe:1200
2012-04-13 02:21:33:    :svchost.exe:1400
2012-04-13 02:21:33:    :WLIDSVC.EXE:2060
2012-04-13 02:21:33:    :WLIDSVCM.EXE:2380
2012-04-13 02:21:33:    :svchost.exe:2764
2012-04-13 02:21:33:    :yorkyt.exe:3084
2012-04-13 02:21:33:    :WmiPrvSE.exe:3192
2012-04-13 02:21:34:    :SynTPEnh.exe:3224
2012-04-13 02:21:34:    :SynAsusAcpi.exe:3300
2012-04-13 02:21:34:    :RtHDVCpl.exe:3388
2012-04-13 02:21:34:    :HotKeyMon.exe:3396
2012-04-13 02:21:34:    :HotkeyService.exe:3408
2012-04-13 02:21:35:    :SuperHybridEngine.exe:3416
2012-04-13 02:21:35:    :avgnt.exe:3452
2012-04-13 02:21:35:    :WmiPrvSE.exe:3492
2012-04-13 02:21:35:    :hkcmd.exe:3572
2012-04-13 02:21:35:    :igfxpers.exe:3620
2012-04-13 02:21:35:    :DivXUpdate.exe:3696
2012-04-13 02:21:35:    :igfxsrvc.exe:3728
2012-04-13 02:21:35:    :FLVSrvc.exe:3828
2012-04-13 02:21:35:    :SynTPHelper.exe:3956
2012-04-13 02:21:35:    :FILSHtray.exe:3988
2012-04-13 02:21:35:    :jusched.exe:3996
2012-04-13 02:21:35:    :APSDaemon.exe:4012
2012-04-13 02:21:37:    :iTunesHelper.exe:4072
2012-04-13 02:21:38:    :hpwuschd2.exe:2144
2012-04-13 02:21:38:    :SearchIndexer.exe:2240
2012-04-13 02:21:38:    :Skype.exe:1840
2012-04-13 02:21:38: 
2012-04-13 02:21:38: Starting cleanup mode...
2012-04-13 02:23:10:  ... Done with files, now folders
2012-04-13 02:23:47: All DONE
         

Hi,

da lief was schief/faul, OTL hat das Teil gelöscht und MAM danach nochmal ???
Auch der Killer hat was gefunden...

Poste bitte noch einmal ein neues OTL-Log...

chris

Hier das OTL Log....Im Anhang Extras.txt. Ach so, habe die Einstellung genommen, die du ganz am Anfang vorgegeben hast...also das Häckchen bei SafeList Extra Registry)....gib mir Bescheid, falls du es anders benötigst.

OTL logfile created on: 13.04.2012 12:09:06 - Run 5
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\lena-laura\Downloads
 Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 71,25% Memory free
3,98 Gb Paging File | 3,42 Gb Available in Paging File | 85,89% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 80,00 Gb Total Space | 47,16 Gb Free Space | 58,95% Space Free | Partition Type: NTFS
Drive D: | 59,03 Gb Total Space | 0,01 Gb Free Space | 0,02% Space Free | Partition Type: NTFS
 
Computer Name: PC | User Name: lena-laura | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\lena-laura\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (NMIndexingService) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe File not found
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (WAS) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) -- C:\Windows\System32\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) -- C:\Windows\System32\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (AsusService) -- C:\Windows\System32\AsusService.exe ()
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (iprip) -- C:\Windows\System32\iprip.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBModem) -- system32\DRIVERS\lgusbmodem.sys File not found
DRV - (UsbDiag) -- system32\DRIVERS\lgusbdiag.sys File not found
DRV - (usbbus) -- system32\DRIVERS\lgusbbus.sys File not found
DRV - (LGVMODEM) -- system32\DRIVERS\lgvmodem.sys File not found
DRV - (lgbusenum) -- system32\DRIVERS\lgbtbus.sys File not found
DRV - (LgBttPort) -- system32\DRIVERS\lgbtport.sys File not found
DRV - (hwusbdev) -- system32\DRIVERS\ewusbdev.sys File not found
DRV - (hwdatacard) -- system32\DRIVERS\ewusbmdm.sys File not found
DRV - (huawei_enumerator) -- system32\DRIVERS\ew_jubusenum.sys File not found
DRV - (ewusbnet) -- system32\DRIVERS\ewusbnet.sys File not found
DRV - (ew_hwusbdev) -- system32\DRIVERS\ew_hwusbdev.sys File not found
DRV - (catchme) -- C:\Users\LENA-L~1\AppData\Local\Temp\catchme.sys File not found
DRV - (btwrchid) -- C:\windows\system32\DRIVERS\btwrchid.sys File not found
DRV - (btwl2cap) -- system32\DRIVERS\btwl2cap.sys File not found
DRV - (btwavdt) -- C:\windows\system32\DRIVERS\btwavdt.sys File not found
DRV - (btwaudio) -- system32\drivers\btwaudio.sys File not found
DRV - (ANDModem) -- system32\DRIVERS\lgandmodem.sys File not found
DRV - (AndGps) -- system32\DRIVERS\lgandgps.sys File not found
DRV - (AndDiag) -- system32\DRIVERS\lganddiag.sys File not found
DRV - (Andbus) -- system32\DRIVERS\lgandbus.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (USB28xxBGA) -- C:\Windows\System32\drivers\emBDA.sys (eMPIA Technology, Inc.)
DRV - (USB28xxOEM) -- C:\Windows\System32\drivers\emOEM.sys (eMPIA Technology, Inc.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{6AE1C493-DB3D-410C-8219-6ACFC715776A}: "URL" = hxxp://suche.t-online.de/fast-cgi/tsc?q={searchTerms}&sr=searchbar
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 87 01 1B 1A FE F0 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=10588
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNC_de
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\lena-laura\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\lena-laura\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\lena-laura\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.06.17 20:24:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.18 17:22:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.11 02:31:05 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\lena-laura\AppData\Roaming\11012 [2012.04.12 22:53:19 | 000,000,000 | ---D | M]
 
[2011.05.12 19:36:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Extensions
[2012.02.29 02:14:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions
[2012.02.29 02:14:29 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Users\lena-laura\AppData\Roaming\mozilla\Firefox\Profiles\ztgpl636.default\extensions\ffxtlbra@softonic.com
[2011.11.10 02:17:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011.11.13 04:42:42 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.04.12 22:53:19 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\LENA-LAURA\APPDATA\ROAMING\11012
() (No name found) -- C:\USERS\LENA-LAURA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZTGPL636.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI
[2012.03.18 17:22:47 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.23 12:50:38 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012.02.12 17:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.04.23 16:07:10 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012.02.12 17:09:48 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Yahoo! Deutschland (Enabled)
CHR - default_search_provider: search_url = hxxp://de.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}
CHR - default_search_provider: suggest_url = hxxp://de-sayt.ff.search.yahoo.com/gossip-de-sayt?output=fxjson&command={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\Application\18.0.1025.151\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\Application\18.0.1025.151\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\Application\18.0.1025.151\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npPDFXCviewNPPlugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\lena-laura\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\lena-laura\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: AT_Porsche = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkclphmapdcppbmekmbkcjfanpmoidpg\3_1\
CHR - Extension: Skype Click to Call = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: Mehr Leistung und Videoformate f\u00FCr dein HTML5 \u003Cvideo\u003E = C:\Users\lena-laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.126_0\
 
O1 HOSTS File: ([2012.02.07 18:04:15 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [FILSHtray] C:\Program Files\FILSHtray\FILSHtray.exe (FILSH Media GmbH)
O4 - HKLM..\Run: [Freecorder FLV Service] C:\Program Files\Freecorder\FLVSrvc.exe (Applian Technologies, Inc.)
O4 - HKLM..\Run: [HotKeyMon] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HotkeyService] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SuperHybridEngine] C:\windows\System32\AsusSender.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4 - Startup: C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{10D8D06D-13E7-46A5-AEC4-38C5609E3260}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{18A4EB30-28E1-4E04-8664-4351C9AD8B76}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) -  File not found
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.04.13 01:53:23 | 000,000,000 | ---D | C] -- C:\windows\System32\DBBK
[2012.04.12 22:58:38 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\UAs
[2012.04.12 22:57:33 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\xmldm
[2012.04.12 22:53:05 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.04.12 13:15:24 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\11012
[2012.04.12 03:30:59 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb
[2012.04.12 03:30:54 | 001,799,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript9.dll
[2012.04.12 03:30:52 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll
[2012.04.12 03:30:51 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\url.dll
[2012.04.12 03:30:50 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll
[2012.04.12 03:30:48 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl
[2012.04.12 03:01:45 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntkrnlpa.exe
[2012.04.12 03:01:43 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntoskrnl.exe
[2012.04.12 02:15:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.04.12 02:15:11 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.04.11 15:17:25 | 000,418,464 | ---- | C] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe
[2012.04.11 01:02:45 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{F863156E-F87C-496F-B226-C7DDAE68E633}
[2012.04.11 01:02:32 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{F025FC7C-40A5-4051-AAA9-E0C028AE904A}
[2012.04.11 01:00:43 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{EE6A1AB8-9E47-4E9F-9169-AC4A88785E2A}
[2012.04.11 01:00:29 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{D581E52F-86D8-4DD7-AF56-E656EEECC13C}
[2012.04.08 05:27:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
[2012.04.08 05:27:23 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\HpUpdate
[2012.04.08 05:27:15 | 000,000,000 | ---D | C] -- C:\windows\Hewlett-Packard
[2012.04.07 18:07:53 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{0F687047-71DC-499C-9399-34C7414D9952}
[2012.04.07 03:51:34 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012.04.07 03:51:33 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012.04.07 03:44:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.04.07 03:44:41 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.04.06 12:39:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Mediafour
[2012.04.06 12:37:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mediafour
[2012.04.04 21:36:09 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{1A7B5EB3-7759-41FE-AA09-79525CBC2E2D}
[2012.04.04 21:35:00 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{81A290BE-954A-4168-806C-81CA377D7DE2}
[2012.04.04 21:25:37 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{02F6304D-037F-4A4C-8003-5437EE5FA85D}
[2012.04.03 20:10:31 | 000,000,000 | R--D | C] -- C:\Users\lena-laura\AppData\Roaming\Brother
[2012.03.31 02:09:10 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Local\{4CB2A80D-8224-4701-B414-6843804829AD}
[2012.03.24 23:14:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MixMeister
[2012.03.24 23:14:13 | 000,000,000 | ---D | C] -- C:\Program Files\MixMeister BPM Analyzer
[2012.03.14 17:33:42 | 002,343,424 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys
[2012.03.14 17:33:38 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\DWrite.dll
[2012.03.14 17:32:43 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpcorekmts.dll
[2012.03.14 17:32:43 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdrmemptylst.exe
[2012.03.14 17:32:42 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpwsx.dll
[2012.03.14 17:32:37 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpcore.dll
[1 C:\Users\lena-laura\AppData\Roaming\*.tmp files -> C:\Users\lena-laura\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.04.13 12:07:43 | 000,065,536 | ---- | M] () -- C:\windows\System32\Ikeext.etl
[2012.04.13 12:07:36 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.04.13 11:47:52 | 000,001,140 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000UA.job
[2012.04.13 11:47:50 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012.04.13 09:14:50 | 000,704,072 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012.04.13 09:14:50 | 000,655,402 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012.04.13 09:14:50 | 000,145,342 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012.04.13 09:14:50 | 000,118,952 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012.04.13 09:01:27 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.13 09:01:27 | 000,009,696 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.13 03:22:00 | 000,001,088 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3837843822-382491344-1778226907-1000Core.job
[2012.04.13 00:43:02 | 000,000,016 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\blckdom.res
[2012.04.12 23:03:52 | 000,001,027 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.04.12 12:23:24 | 000,226,792 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\AcroIEHelpe102.dll
[2012.04.12 12:23:24 | 000,007,368 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\BAcroIEHelpe102.dll
[2012.04.12 02:18:46 | 000,003,860 | ---- | M] () -- C:\Users\lena-laura\Documents\Documents.zip
[2012.04.12 02:18:13 | 000,003,517 | ---- | M] () -- C:\Users\lena-laura\Documents\Documents.7z
[2012.04.12 02:17:03 | 000,001,366 | ---- | M] () -- C:\Users\lena-laura\Documents\gmer.7z
[2012.04.12 02:16:49 | 000,002,347 | ---- | M] () -- C:\Users\lena-laura\Documents\Attach.7z
[2012.04.12 00:25:21 | 000,000,000 | ---- | M] () -- C:\Users\lena-laura\defogger_reenable
[2012.04.11 17:19:05 | 000,418,464 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerApp.exe
[2012.04.11 17:19:05 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\windows\System32\FlashPlayerCPLApp.cpl
[2012.04.09 17:33:37 | 000,007,384 | ---- | M] () -- C:\Users\lena-laura\AppData\Roaming\BAcroIEHelpe099.dll
[2012.04.08 02:47:58 | 000,000,000 | ---- | M] () -- C:\windows\Path.idx
[2012.04.08 02:09:31 | 000,014,741 | ---- | M] () -- C:\Users\lena-laura\Documents\singding.odt
[2012.04.07 16:25:05 | 000,434,880 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012.04.07 03:51:34 | 000,001,182 | ---- | M] () -- C:\Users\lena-laura\Desktop\Revo Uninstaller.lnk
[2012.04.07 03:44:44 | 000,000,925 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.04.05 16:07:28 | 000,034,799 | ---- | M] () -- C:\Users\lena-laura\Documents\AA EKS.pdf
[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012.03.31 02:31:00 | 000,059,345 | ---- | M] () -- C:\Users\lena-laura\Desktop\IMG_4428.JPG
[2012.03.31 01:50:33 | 000,014,016 | ---- | M] () -- C:\Users\lena-laura\Documents\blog.odt
[2012.03.30 06:55:19 | 000,012,652 | ---- | M] () -- C:\Users\lena-laura\Documents\anfart.odt
[2012.03.26 20:30:17 | 000,003,215 | ---- | M] () -- C:\Users\lena-laura\Documents\yam-win.zip.torrent
[2012.03.26 20:30:17 | 000,000,000 | ---- | M] () -- C:\Users\lena-laura\Documents\yam-win.zip
[2012.03.25 05:28:16 | 000,029,205 | ---- | M] () -- C:\Users\lena-laura\Documents\mama.odt
[2012.03.24 21:35:35 | 000,005,120 | ---- | M] () -- C:\Users\lena-laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.22 03:09:49 | 000,013,949 | ---- | M] () -- C:\Users\lena-laura\Documents\diary22.märz2.odt
[2012.03.22 03:09:33 | 000,020,816 | ---- | M] () -- C:\Users\lena-laura\Documents\diary22.märz.odt
[2012.03.21 14:11:39 | 000,038,090 | ---- | M] () -- C:\Users\lena-laura\Documents\01.2012.pdf
[2012.03.21 13:49:13 | 000,031,801 | ---- | M] () -- C:\Users\lena-laura\Documents\untermiete neu.pdf
[1 C:\Users\lena-laura\AppData\Roaming\*.tmp files -> C:\Users\lena-laura\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.04.12 22:57:42 | 000,000,016 | ---- | C] () -- C:\Users\lena-laura\AppData\Roaming\blckdom.res
[2012.04.12 12:23:24 | 000,226,792 | ---- | C] () -- C:\Users\lena-laura\AppData\Roaming\AcroIEHelpe102.dll
[2012.04.12 12:23:24 | 000,007,368 | ---- | C] () -- C:\Users\lena-laura\AppData\Roaming\BAcroIEHelpe102.dll
[2012.04.12 02:18:46 | 000,003,860 | ---- | C] () -- C:\Users\lena-laura\Documents\Documents.zip
[2012.04.12 02:18:13 | 000,003,517 | ---- | C] () -- C:\Users\lena-laura\Documents\Documents.7z
[2012.04.12 02:17:03 | 000,001,366 | ---- | C] () -- C:\Users\lena-laura\Documents\gmer.7z
[2012.04.12 02:16:49 | 000,002,347 | ---- | C] () -- C:\Users\lena-laura\Documents\Attach.7z
[2012.04.12 00:25:21 | 000,000,000 | ---- | C] () -- C:\Users\lena-laura\defogger_reenable
[2012.04.11 15:17:27 | 000,000,884 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2012.04.09 17:33:37 | 000,007,384 | ---- | C] () -- C:\Users\lena-laura\AppData\Roaming\BAcroIEHelpe099.dll
[2012.04.08 02:47:58 | 000,000,000 | ---- | C] () -- C:\windows\Path.idx
[2012.04.08 02:09:28 | 000,014,741 | ---- | C] () -- C:\Users\lena-laura\Documents\singding.odt
[2012.04.07 16:24:46 | 000,434,880 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2012.04.07 03:51:34 | 000,001,182 | ---- | C] () -- C:\Users\lena-laura\Desktop\Revo Uninstaller.lnk
[2012.04.07 03:44:44 | 000,000,925 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.04.05 16:07:25 | 000,034,799 | ---- | C] () -- C:\Users\lena-laura\Documents\AA EKS.pdf
[2012.03.31 01:50:29 | 000,014,016 | ---- | C] () -- C:\Users\lena-laura\Documents\blog.odt
[2012.03.30 06:55:15 | 000,012,652 | ---- | C] () -- C:\Users\lena-laura\Documents\anfart.odt
[2012.03.26 20:30:17 | 000,003,215 | ---- | C] () -- C:\Users\lena-laura\Documents\yam-win.zip.torrent
[2012.03.26 20:30:17 | 000,000,000 | ---- | C] () -- C:\Users\lena-laura\Documents\yam-win.zip
[2012.03.25 03:11:22 | 000,029,205 | ---- | C] () -- C:\Users\lena-laura\Documents\mama.odt
[2012.03.24 21:35:33 | 000,005,120 | ---- | C] () -- C:\Users\lena-laura\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.22 03:09:47 | 000,013,949 | ---- | C] () -- C:\Users\lena-laura\Documents\diary22.märz2.odt
[2012.03.22 03:09:31 | 000,020,816 | ---- | C] () -- C:\Users\lena-laura\Documents\diary22.märz.odt
[2012.03.21 14:11:36 | 000,038,090 | ---- | C] () -- C:\Users\lena-laura\Documents\01.2012.pdf
[2012.03.21 13:49:10 | 000,031,801 | ---- | C] () -- C:\Users\lena-laura\Documents\untermiete neu.pdf
[2012.02.07 17:40:22 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2012.02.07 17:40:22 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2012.02.07 17:40:22 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2012.02.07 17:40:22 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2012.02.07 17:40:22 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2012.02.02 19:46:43 | 000,000,425 | ---- | C] () -- C:\windows\BRWMARK.INI
[2012.02.02 19:46:43 | 000,000,027 | ---- | C] () -- C:\windows\BRPP2KA.INI
[2011.10.20 14:30:59 | 000,000,000 | ---- | C] () -- C:\Users\lena-laura\AppData\Roaming\wklnhst.dat
[2011.03.20 12:12:35 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.05 01:59:32 | 000,005,632 | ---- | C] () -- C:\windows\System32\StarOpen.sys
 
========== Files - Unicode (All) ==========
[2012.03.09 17:28:17 | 000,030,044 | ---- | M] ()(C:\Users\lena-laura\Documents\Capital+M+Artists_K+�+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt�.pdf) -- C:\Users\lena-laura\Documents\Capital+M+Artists_K+Ü+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt….pdf
[2012.03.09 17:28:17 | 000,030,044 | ---- | C] ()(C:\Users\lena-laura\Documents\Capital+M+Artists_K+�+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt�.pdf) -- C:\Users\lena-laura\Documents\Capital+M+Artists_K+Ü+N+S+T+L+E+R+P+R+O+F+I+L_Formular_Akt….pdf

< End of report >
         

Hi,

die kommen schneller als wie ich sie wegbekomme, gestern Abend kurz vor Mitternacht hat sich wieder was eingenistet...
Mit was surfst du? Firefox mit NoScript und WOT?

OTL:

• Doppelklick auf die OTL.exe, um das Programm auszuführen.

• Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

• Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

:OTL
[2012.04.12 22:53:19 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\LENA-LAURA\APPDATA\ROAMING\11012
[2012.04.12 22:58:38 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\UAs
[2012.04.12 22:57:33 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\xmldm
[2012.04.12 13:15:24 | 000,000,000 | ---D | C] -- C:\Users\lena-laura\AppData\Roaming\11012
[2012.04.12 22:57:42 | 000,000,016 | ---- | C] () -- C:\Users\lena-laura\AppData\Roaming\blckdom.res

:Commands
[purity]
[emptytemp]
[Reboot]
         

• Den roten Run Fixes! Button anklicken.

• Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

• Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

• %systemroot%\_OTL

Hitman

Lade Dir die passende Version von Hitman runter (32/64Bit), laufen lassen und Log posten.
ACHTUNG: Firewall muss für Hitman geöffnet sein (Zugriff unbedingt erlauben!)
Downloads - SurfRight

Dann solltest Du Dir vielleicht sowas hier noch installieren:
Zusätzlich zu Avira und der Windows-Firewall noch Threadfire-free Herunterladen Kostenlos).
Zum Surfen Firefox mit den PlugIns "WOT" (http://filepony.de/?q=WOT) und
"NoScript" (http://filepony.de/download-noscript//)) verwenden,
einen "Guest"-Account (keine Adminrechte! XP: (Schritt 6: Eingeschränkte Rechte für Viren - Schritt für Schritt: Windows XP absichern - CHIP Online,
Vista/Win7: Windows-7-Anleitung: Benutzerkonten anlegen und verwalten - NETZWELT) anlegen.

chris