Ich habe mit Chatzum eingefangen.

Die Systemwiederherstellung funktioniert nicht, hilft also nicht weiter.
Die Software habe ich bereits deinstalliert, aber in meinem Browser kommt es immer noch.

Hier ist der OTL-File:

 OTL logfile created on: 04.10.2012 18:06:10 - Run 2
OTL by OldTimer - Version 3.2.70.2     Folder = C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\ProgWeb
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,99 Gb Total Physical Memory | 1,26 Gb Available Physical Memory | 63,13% Memory free
3,84 Gb Paging File | 3,31 Gb Available in Paging File | 86,13% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 298,04 Gb Total Space | 125,44 Gb Free Space | 42,09% Space Free | Partition Type: NTFS
 
Computer Name: XXXX-A2296A9E1 | User Name: YYY XXXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.10.04 17:34:00 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\ProgWeb\OTL.exe
PRC - [2012.09.07 19:44:02 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.08.31 12:16:32 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe
PRC - [2012.07.03 09:04:54 | 000,252,848 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.06.16 04:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) -- C:\Programme\Norton Internet Security\Engine\19.8.0.14\ccsvchst.exe
PRC - [2011.09.16 11:08:18 | 001,804,648 | ---- | M] (Hewlett-Packard Co.) -- C:\Programme\HP\HP Photosmart 5510 series\Bin\ScanToPCActivationApp.exe
PRC - [2011.09.16 10:56:50 | 000,643,944 | ---- | M] (Hewlett-Packard Co.) -- C:\Programme\HP\HP Photosmart 5510 series\Bin\HPNetworkCommunicator.exe
PRC - [2009.02.20 18:36:00 | 000,483,420 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe
PRC - [2009.02.20 18:36:00 | 000,249,938 | ---- | M] (IDT, Inc.) -- c:\Programme\IDT\XPV10_6147v005\WDM\stacsv.exe
PRC - [2009.02.20 18:35:00 | 000,729,088 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\AESTFltr.exe
PRC - [2008.04.14 01:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.07.27 16:43:34 | 000,118,784 | ---- | M] (Creative Technology Ltd.) -- C:\Programme\Dell\Dell Webcam Manager\DellWMgr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.09.09 01:33:24 | 009,813,704 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
MOD - [2012.09.07 19:44:01 | 002,244,064 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2012.01.08 15:41:12 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll
MOD - [2009.02.27 17:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
MOD - [2008.10.24 13:00:32 | 000,143,360 | ---- | M] () -- C:\WINDOWS\system32\preflib.dll
MOD - [2008.10.24 13:00:12 | 000,753,664 | ---- | M] () -- C:\WINDOWS\system32\bcm1xsup.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (PLFlash DeviceIoControl Service)
SRV - [2012.09.09 01:33:25 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.07 19:44:01 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.08.31 12:16:32 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012.06.19 17:32:30 | 003,048,136 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.06.16 04:24:19 | 000,138,272 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Programme\Norton Internet Security\Engine\19.8.0.14\ccSvcHst.exe -- (NIS)
SRV - [2012.06.05 15:17:44 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.06.17 19:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.12.12 01:47:44 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2009.04.17 10:09:46 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.02.20 18:36:00 | 000,249,938 | ---- | M] (IDT, Inc.) [Auto | Running] -- c:\Programme\IDT\XPV10_6147v005\WDM\stacsv.exe -- (STacSV)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMNDIS.SYS -- (SYMNDIS)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMIDS.SYS -- (SYMIDS)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMFW.SYS -- (SYMFW)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\o2sdg.sys -- (O2SDGRDR)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\o2mdg.sys -- (O2MDGRDR)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\gearaspiwdm.sys -- (GearAspiWDM)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\MediaCoder\SysInfo.sys -- (CrystalSysInfo)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | Boot | Stopped] --  -- (cerc6)
DRV - [2012.09.28 19:24:09 | 001,601,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.0.9\Definitions\VirusDefs\20121003.032\NAVEX15.SYS -- (NAVEX15)
DRV - [2012.09.28 19:24:09 | 000,092,704 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.0.9\Definitions\VirusDefs\20121003.032\NAVENG.SYS -- (NAVENG)
DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.09.06 04:54:30 | 000,373,728 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.0.9\Definitions\IPSDefs\20121003.001\IDSXpx86.sys -- (IDSxpx86)
DRV - [2012.09.01 00:09:14 | 000,995,488 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.0.9\Definitions\BASHDefs\20120928.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012.08.09 07:42:22 | 000,376,480 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012.08.09 07:42:22 | 000,106,656 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2012.07.06 04:17:57 | 000,574,112 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NIS\1308000.00E\srtsp.sys -- (SRTSP)
DRV - [2012.07.06 04:17:57 | 000,032,928 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1308000.00E\srtspx.sys -- (SRTSPX)
DRV - [2012.06.07 06:43:43 | 000,132,768 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1308000.00E\ccsetx86.sys -- (ccSet_NIS)
DRV - [2012.05.22 03:37:12 | 000,924,320 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\NIS\1308000.00E\symefa.sys -- (SymEFA)
DRV - [2012.05.19 10:05:44 | 000,141,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2012.04.18 04:13:32 | 000,388,216 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1308000.00E\symtdi.sys -- (SYMTDI)
DRV - [2012.04.18 03:42:14 | 000,149,624 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1308000.00E\ironx86.sys -- (SymIRON)
DRV - [2012.03.29 00:28:26 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\NIS\1308000.00E\symds.sys -- (SymDS)
DRV - [2012.02.24 11:14:42 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssudmdm.sys -- (ssudmdm)
DRV - [2012.02.24 11:14:42 | 000,080,824 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ssudbus.sys -- (dg_ssudbus)
DRV - [2012.01.09 11:09:22 | 000,033,536 | R--- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL2832UUSB.sys -- (RTL2832UUSB)
DRV - [2012.01.09 11:09:21 | 000,189,184 | R--- | M] (REALTEK SEMICONDUCTOR Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL2832UBDA.sys -- (RTL2832UBDA)
DRV - [2011.06.02 11:08:34 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
DRV - [2011.02.16 16:52:46 | 000,011,520 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\wdcsam.sys -- (WDC_SAM)
DRV - [2010.07.29 01:25:42 | 000,025,112 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ivusb.sys -- (ivusb)
DRV - [2009.12.12 01:48:04 | 000,025,984 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tap0901.sys -- (tap0901)
DRV - [2009.09.29 08:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtport.sys -- (LgBttPort)
DRV - [2009.09.29 08:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgvmodem.sys -- (LGVMODEM)
DRV - [2009.09.29 08:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lgbtbus.sys -- (lgbusenum)
DRV - [2009.06.22 19:38:16 | 000,102,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.06.22 19:24:46 | 000,100,480 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2009.02.20 18:36:00 | 001,548,339 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2009.02.20 18:35:00 | 000,112,512 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2009.02.02 15:54:00 | 000,120,064 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.11.19 17:09:10 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbmodem.sys -- (USBModem)
DRV - [2008.11.19 17:09:08 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbdiag.sys -- (UsbDiag)
DRV - [2008.11.19 17:09:08 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lgusbbus.sys -- (usbbus)
DRV - [2008.10.24 13:00:30 | 001,287,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2008.10.24 13:00:28 | 000,033,664 | ---- | M] (CACE Technologies) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\BCMWLNPF.SYS -- (BCMWLNPF)
DRV - [2008.04.14 00:16:24 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2006.11.16 08:39:28 | 000,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MarvinBus.sys -- (MarvinBus)
DRV - [2005.03.18 09:23:00 | 000,131,267 | ---- | M] (ULi Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\M9205.sys -- (ULiM9205)
DRV - [2005.01.10 11:45:56 | 000,011,264 | ---- | M] (VOB Computersysteme GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\asapiW2k.sys -- (ASAPIW2K)
DRV - [2003.09.19 01:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.chatzum.com/?q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\SearchScopes,DefaultScope = {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=17164
IE - HKCU\..\SearchScopes\{54D2B65E-C070-48BB-8FFC-E51FD083D25F}: "URL" = hxxp://search.chatzum.com/?q={searchTerms}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={sear
IE - HKCU\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = hxxp://search.chatzum.com/?q={SearchTerms}
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = hxxp://int.search-results.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=NIS&chn=retail&geo=DE&ver=18
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/|hxxp://news.google.de/|hxxp://de.yahoo.com/"
FF - prefs.js..extensions.enabledAddons: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.15
FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.10
FF - prefs.js..keyword.URL: "hxxp://utils.chatzum.com/?url="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Programme\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.3: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.0.9\IPSFFPlgn\ [2012.05.19 10:10:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.7.0.9\coFFPlgn\ [2012.10.04 17:57:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.09.07 19:44:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.09.07 19:43:50 | 000,000,000 | ---D | M]
 
[2012.07.02 15:32:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\Mozilla\Extensions
[2010.06.13 11:05:02 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\Mozilla\Extensions\MediaCoder
[2010.06.13 11:14:04 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\Mozilla\Extensions\MediaCoder-Setup-Wizard
[2012.10.02 21:40:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\j56dntdy.default\extensions
[2012.09.17 21:28:06 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\j56dntdy.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.09.14 07:24:05 | 000,698,867 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\j56dntdy.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2012.06.23 14:24:54 | 000,002,519 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\j56dntdy.default\searchplugins\Search_Results.xml
[2012.09.07 19:43:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.07 19:43:43 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.09.07 19:44:02 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.06.17 08:34:36 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.02.09 21:17:48 | 000,002,226 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\babylon.xml
[2012.08.31 01:30:39 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.17 08:34:35 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.17 08:34:35 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.01 06:04:29 | 000,002,520 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\SearchResults.xml
[2012.06.23 14:24:54 | 000,002,519 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml
[2012.06.17 08:34:35 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.17 08:34:35 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider:  ()
CHR - default_search_provider: search_url = 
CHR - default_search_provider: suggest_url = 
CHR - homepage: hxxp://www.searchnu.com/406
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\cmgnmcnlncejehjlnhaglpnoolgbflbd\1.2.5_0\
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\dnpmlnedpdikbgdghljdepnljfpkhccn\1.0.0_0\
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\jbpcjmidkkgldeplajgnbpjkfpmpeepb\1.0.6_0\
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.0.0.10297_0\
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2012.5.5.11_0\
CHR - Extension: No name found = C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2008.04.14 01:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Engine\19.8.0.14\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Engine\19.8.0.14\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\19.8.0.14\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\19.8.0.14\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [DELL Webcam Manager] C:\Programme\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NVHotkey] C:\WINDOWS\System32\nvhotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\\PSDrvCheck.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [HP Photosmart 5510 series (NET)] C:\Programme\HP\HP Photosmart 5510 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab (Launcher Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FCD44364-5A55-40D5-8DBE-017C6FB9919A}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.05.24 00:31:46 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{0248ea24-69f5-11e1-9321-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{0248ea24-69f5-11e1-9321-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0248ea25-69f5-11e1-9321-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{0248ea25-69f5-11e1-9321-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{81b4e22a-2ff8-11e0-8f32-00225fd37a73}\Shell\AutoRun\command - "" = H:\PMBP_Win.exe
O33 - MountPoints2\{84278cbc-904e-11df-8d41-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{84278cbc-904e-11df-8d41-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9fe48866-d227-11e1-94a8-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{9fe48866-d227-11e1-94a8-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9fe48866-d227-11e1-94a8-00225fd37a73}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b0e220e0-7466-11df-8cdb-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{b0e220e0-7466-11df-8cdb-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b0e220e4-7466-11df-8cdb-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{b0e220e4-7466-11df-8cdb-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{d05793e9-6f48-11e0-9018-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{d05793e9-6f48-11e0-9018-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{fc94b24a-5ac1-11e0-8fd6-00225fd37a73}\Shell - "" = AutoRun
O33 - MountPoints2\{fc94b24a-5ac1-11e0-8fd6-00225fd37a73}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.04 17:49:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.10.04 17:49:14 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.10.04 17:10:29 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\YYY XXXX\Recent
[2012.10.02 12:05:05 | 000,000,000 | ---D | C] -- C:\Programme\DiskInternals
[2012.10.02 12:05:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\YYY XXXX\Startmenü\Programme\DiskInternals
[2012.10.02 11:56:55 | 000,000,000 | ---D | C] -- C:\Programme\Rar Repair Tool
[2012.10.02 11:56:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Rar Repair Tool
[2012.10.02 11:55:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\rarrepair
[2012.10.02 11:55:26 | 000,000,000 | ---D | C] -- C:\Programme\ChatZum Toolbar
[2012.09.25 11:19:58 | 000,000,000 | ---D | C] -- C:\AAAAAAA2012_SEPT_2012_RTL_HESSEN 197A0186
[2012.09.25 11:14:50 | 000,000,000 | ---D | C] -- C:\22VBLOG 205C01F6
[2012.09.22 19:38:44 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\WinRAR
[2012.09.22 19:38:33 | 000,000,000 | ---D | C] -- C:\Programme\WinRAR
[2012.09.12 16:26:41 | 000,000,000 | ---D | C] -- C:\21LEUTE CADE021C
[2012.09.07 19:43:39 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2012.09.05 21:40:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\Hewlett-Packard
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.04 18:01:00 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\HP Photo Creations Messager.job
[2012.10.04 17:59:23 | 000,032,346 | ---- | M] () -- C:\WINDOWS\System32\nvModes.001
[2012.10.04 17:59:20 | 000,200,610 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.10.04 17:58:50 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.10.04 17:57:21 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.04 17:57:20 | 000,000,280 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1343024091-606747145-682003330-1003.job
[2012.10.04 17:57:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.10.04 17:50:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.10.04 17:49:17 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.04 17:28:50 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.04 07:49:18 | 000,000,349 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI
[2012.10.03 04:15:40 | 000,009,103 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1308000.00E\VT20121002.018
[2012.10.03 00:13:43 | 000,027,648 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.10.02 22:10:30 | 000,001,910 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012.10.02 22:10:30 | 000,001,839 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\Avira DE-Cleaner.lnk
[2012.10.02 14:02:05 | 000,001,730 | -H-- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\Default.rdp
[2012.10.02 11:56:55 | 000,000,650 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\RAR Repair Tool.lnk
[2012.10.02 11:55:07 | 001,492,701 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\rarrepair.zip
[2012.10.02 10:45:21 | 000,473,709 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FLT_8M91KD10546_0.pdf
[2012.10.01 01:49:00 | 000,000,288 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1343024091-606747145-682003330-1003.job
[2012.09.30 11:31:49 | 000,473,660 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FLT_233V6Z20233_0.pdf
[2012.09.29 14:30:44 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2012.09.28 13:19:55 | 000,473,709 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FLT_K3UBCR18977_0.pdf
[2012.09.26 12:34:14 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1309000.009\isolate.ini
[2012.09.26 09:41:58 | 000,000,514 | ---- | M] () -- C:\WINDOWS\VFO.INI
[2012.09.26 09:21:44 | 000,000,089 | ---- | M] () -- C:\WINDOWS\ULead32.ini
[2012.09.23 21:54:48 | 000,056,250 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\21VBlog_XXXX.txp4
[2012.09.23 15:52:50 | 000,077,888 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\21Pre_FB.txp4
[2012.09.22 14:39:26 | 000,606,983 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1308000.00E\Cat.DB
[2012.09.20 16:54:49 | 000,139,498 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\SCHWESTA EWA - SCHWÄTZA (Official Video HD).txp4
[2012.09.14 19:46:05 | 000,507,588 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\metro.pdf
[2012.09.14 10:29:21 | 000,845,100 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\U1CRQ3.pdf
[2012.09.12 20:14:38 | 000,062,138 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\JustinBieber_40sec_Final_1080.txp4
[2012.09.11 20:22:56 | 000,287,181 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\Bieber_XXXX_Digi (1).txp4
[2012.09.11 09:06:08 | 000,057,104 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FB_20VBlog_XXXX.txp4
[2012.09.10 22:22:15 | 000,057,074 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\20VBlog_XXXX.txp4
[2012.09.10 18:33:51 | 000,207,541 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\Auto_Google (1).txp4
[2012.09.10 06:20:33 | 001,217,235 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\20Prwo (1).txp4
[2012.09.09 09:57:46 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\CCleaner.lnk
[2012.09.09 01:33:25 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012.09.09 01:33:25 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.09.07 07:19:22 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2012.09.05 08:09:08 | 000,218,997 | ---- | M] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\bookmarks-2012-09-05.json
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.10.04 17:49:17 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.02 22:10:30 | 000,001,910 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012.10.02 22:10:30 | 000,001,839 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\Avira DE-Cleaner.lnk
[2012.10.02 11:56:55 | 000,000,650 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\RAR Repair Tool.lnk
[2012.10.02 11:55:05 | 001,492,701 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Desktop\rarrepair.zip
[2012.10.02 10:45:21 | 000,473,709 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FLT_8M91KD10546_0.pdf
[2012.09.30 11:31:49 | 000,473,660 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FLT_233V6Z20233_0.pdf
[2012.09.28 13:19:55 | 000,473,709 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FLT_K3UBCR18977_0.pdf
[2012.09.23 21:54:48 | 000,056,250 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\21VBlog_XXXX.txp4
[2012.09.23 15:52:50 | 000,077,888 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\21Pre_FB.txp4
[2012.09.20 16:54:49 | 000,139,498 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\SCHWESTA EWA - SCHWÄTZA (Official Video HD).txp4
[2012.09.14 19:46:05 | 000,507,588 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\metro.pdf
[2012.09.14 10:29:21 | 000,845,100 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\U1CRQ3.pdf
[2012.09.12 20:14:38 | 000,062,138 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\JustinBieber_40sec_Final_1080.txp4
[2012.09.11 20:22:56 | 000,287,181 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\Bieber_XXXX_Digi (1).txp4
[2012.09.11 09:06:08 | 000,057,104 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\FB_20VBlog_XXXX.txp4
[2012.09.10 22:22:15 | 000,057,074 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\20VBlog_XXXX.txp4
[2012.09.10 18:33:51 | 000,207,541 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\Auto_Google (1).txp4
[2012.09.09 23:32:45 | 001,217,235 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\20Prwo (1).txp4
[2012.09.05 08:09:08 | 000,218,997 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Eigene Dateien\bookmarks-2012-09-05.json
[2012.08.28 14:14:04 | 000,000,057 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ament.ini
[2012.07.09 20:05:46 | 005,992,448 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\NTUSER.rhk
[2012.07.08 21:33:24 | 000,134,072 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.30 08:54:26 | 000,000,439 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\.swfinfo
[2012.06.06 10:28:10 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\PsisDecd.dll
[2012.05.14 09:50:50 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2012.05.11 04:39:31 | 000,677,176 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2012.03.28 22:11:08 | 000,030,568 | ---- | C] () -- C:\WINDOWS\MusiccityDownload.exe
[2012.03.28 22:11:06 | 000,974,848 | ---- | C] () -- C:\WINDOWS\System32\cis-2.4.dll
[2012.03.28 22:11:06 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2012.03.28 22:11:06 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2012.03.28 22:11:06 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\issacapi_se-2.3.dll
[2012.02.16 08:46:02 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.08.11 19:45:31 | 000,000,109 | ---- | C] () -- C:\WINDOWS\TSNV_I2C.INI
[2011.08.11 19:43:12 | 000,000,061 | ---- | C] () -- C:\WINDOWS\CYVC7UL.INI
[2011.08.11 19:38:44 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2011.08.11 19:38:44 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2011.08.11 19:38:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2011.08.11 19:38:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2011.08.11 19:38:44 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2011.08.11 19:38:44 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2011.08.11 15:19:19 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\unM9205.exe
[2011.04.28 23:55:02 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.04.25 17:03:36 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\CommonDL.dll
[2011.04.25 17:03:36 | 000,002,413 | ---- | C] () -- C:\WINDOWS\System32\lgAxconfig.ini
[2010.06.06 17:09:49 | 000,000,161 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Anwendungsdaten\default.rss
[2010.05.24 02:48:47 | 000,027,648 | ---- | C] () -- C:\Dokumente und Einstellungen\YYY XXXX\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2010.06.03 12:25:19 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2010.03.10 06:33:52 | 001,509,888 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 01:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 104 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:D1B5B4F1

< End of report >
         

Hi,


Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Suche.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Löschen.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Und ein frisches OTL log bitte.

Vielen Dank für die Nachricht.

Mein Rechner ist jetzt aber komplett abgeschmiert. Ich setze ihn neu auf.

Wie komplett abgeschmiert?