Windows 7 Recovery Trojaner

Cordoba1984 · 23.05.2011, 19:42

Hallo,

zunächst mal Hut ab, dass sich manche Leute zu Hause hinsetzen und freiwillig anderen bei PC Problemen helfen. Ist heutzutage nicht selbstverständlich, dass man geholfen bekommt.

Nun zu meinem Problem.
Ich bin bei weitem nicht der erste und auch nicht der Letzte der sich das "Windows 7 Recovery Fake" eingefangen hat.

Ich versuche nun schon seit 3 Tagen mit Hilfe dieses Forums (ohne aktiv zu posten) das ganze Problem zu lösen.
Ich bin genau nach den Anleitungen vorgegangen, nur leider bisher ohne Erfolg.

Immer wenn ich meinen PC starte ist der Kram wieder drauf und zeigt mir irgendwelche Critical Errors an.

"Malewarebytes" läuft nun schon seit über einer Stunde und zeigt mir an, dass es bisher 1 infiziertes Objekt gefunden hat. Die Log werde ich gleich hinzufügen. Tdsskill startet nicht. Auch nicht wenn ich es als Admin ausführe.

Wer kann mir helfen???

DANKE schon mal!

Grüße

PS: Hier die Log

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6654

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

23.05.2011 20:44:14
mbam-log-2011-05-23 (20-44-05).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|H:\|)
Durchsuchte Objekte: 410060
Laufzeit: 1 Stunde(n), 26 Minute(n), 50 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\programdata\27057912.exe (Rogue.FakeHDD) -> No action taken.

Cordoba1984 · 23.05.2011, 19:47

Und hier noch die Log von rkill:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 23.05.2011 at 20:46:19.
Operating System: Windows 7 Home Premium

Processes terminated by Rkill or while it was running:

C:\ProgramData\IgTnUqhuSJ.exe
C:\Windows\system32\attrib.exe
C:\Windows\system32\attrib.exe
C:\ProgramData\25353976.exe
C:\Users\Mazza und Naddl\Downloads\IExplorer.com

Rkill completed on 23.05.2011 at 20:46:26.

Cordoba1984 · 23.05.2011, 20:27

Hier noch die Malewarebytes Log nach dem erneuten Quick Scan:

Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6654

Windows 6.1.7600
Internet Explorer 9.0.8112.16421

23.05.2011 21:03:49
mbam-log-2011-05-23 (21-03-49).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 176706
Laufzeit: 3 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Cordoba1984 · 23.05.2011, 21:00

Und hier noch die OTL LogOTL Logfile:

Code:

ATTFilter

OTL logfile created on: 23.05.2011 21:58:34 - Run 1
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Mazza und Naddl\Downloads
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 52,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 74,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 453,76 Gb Total Space | 352,86 Gb Free Space | 77,77% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 354,83 Gb Free Space | 76,18% Space Free | Partition Type: NTFS
 
Computer Name: MAZZAUNDNADD-PC | User Name: Mazza und Naddl | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Mazza und Naddl\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\ANIWConnService.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV)
PRC - C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ()
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\Packard Bell\FIJI\AOSD.exe (Packard Bell BV)
PRC - C:\Program Files\Packard Bell\FIJI\ABoard.exe (Packard Bell BV)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Mazza und Naddl\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (ANIWConnService) -- C:\Windows\System32\ANIWConnService.exe ()
SRV - (IJPLMSVC) -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ()
SRV - (UPnPService) -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (anodlwf) -- C:\Windows\System32\drivers\anodlwf.sys ()
DRV - (RxFilter) -- C:\Windows\System32\drivers\RxFilter.sys (Sonic Solutions)
DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Deutschland - die andere Suchmaschine
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.1
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC2&o=15000&locale=de_DE&apn_uid=BB0ED432-C6BD-473C-B548-FB844347D4F3&apn_ptnrs=PV&apn_sauid=131BF6A3-45F1-4408-975B-0705623BD6C6&apn_dtid=YYYYYYYYDE&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.03 16:51:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.15 21:36:14 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.03.20 04:34:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.05.15 21:36:15 | 000,000,000 | ---D | M]
 
[2010.06.03 00:57:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Extensions
[2010.01.03 19:39:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.01.14 19:34:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2011.05.12 17:34:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions
[2010.06.03 00:57:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.11 10:27:34 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.06.03 00:57:35 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.11 10:27:36 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.04.08 18:05:08 | 000,000,000 | ---D | M] (Sopcast Ask Toolbar) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\toolbar@ask.com
[2010.06.03 00:57:33 | 000,000,000 | ---D | M] (YouTube to MP3) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\youtube2mp3@mondayx.de
[2011.05.23 18:17:53 | 000,002,333 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\askcom-1.xml
[2011.05.21 09:57:51 | 000,002,396 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\askcom.xml
[2011.05.15 20:17:38 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-1.xml
[2009.07.26 13:19:00 | 000,000,961 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-10.xml
[2009.08.13 23:29:56 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-11.xml
[2010.02.26 22:00:43 | 000,000,961 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-12.xml
[2010.03.11 15:06:12 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-13.xml
[2010.03.28 20:01:52 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-14.xml
[2010.04.03 22:00:01 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-15.xml
[2010.05.14 20:13:27 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-16.xml
[2010.06.28 06:34:01 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-17.xml
[2010.08.10 09:14:19 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-18.xml
[2010.10.02 10:58:04 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-19.xml
[2008.09.28 10:28:35 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-2.xml
[2010.10.21 07:09:56 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-20.xml
[2010.11.06 13:48:29 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-21.xml
[2010.12.15 19:59:31 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-22.xml
[2011.02.06 21:03:48 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-23.xml
[2011.03.07 08:10:04 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-24.xml
[2011.03.27 20:27:39 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-25.xml
[2011.04.12 17:18:26 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-26.xml
[2011.05.04 23:30:56 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-27.xml
[2008.11.15 13:26:00 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-3.xml
[2009.03.15 12:50:37 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-4.xml
[2009.03.29 13:02:40 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-5.xml
[2009.03.31 06:39:39 | 000,000,656 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-6.xml
[2009.04.28 15:13:27 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-7.xml
[2009.05.18 18:30:28 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-8.xml
[2009.06.16 06:36:29 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-9.xml
[2008.07.10 14:07:28 | 000,000,944 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin.xml
[2010.12.19 21:50:48 | 000,001,583 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\web-search.xml
[2011.04.09 22:50:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010.06.03 00:45:51 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.06.03 00:45:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.11.21 21:54:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.03.19 23:40:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) -- 
() (No name found) -- C:\USERS\MAZZA UND NADDL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ISNR1YDQ.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
[2011.05.03 16:51:42 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.04.10 14:34:43 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.04.10 14:34:43 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.04.10 14:34:43 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.04.10 14:34:43 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.04.10 14:34:43 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.04.10 14:34:43 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.06.07 19:46:53 | 000,000,741 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll (Packard Bell)
O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ACTIVBOARD] C:\Program Files\Packard Bell\FIJI\aboard.exe (Packard Bell BV)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKCU..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV)
O4 - HKCU..\RunOnce: [SPReview] C:\Windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22 - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - C:\Program Files\Stardock\ObjectDockFree\ODMenu.dll (Stardock)
O24 - Desktop WallPaper: C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\Shell - "" = AutoRun
O33 - MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\Shell - "" = AutoRun
O33 - MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -a
O33 - MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\Shell - "" = AutoRun
O33 - MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.23 21:51:05 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Local\Diagnostics
[2011.05.23 21:43:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.05.23 21:43:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.05.23 21:38:16 | 001,407,280 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Mazza und Naddl\Desktop\TDSSKiller.exe
[2011.05.23 18:13:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2011.05.21 09:37:53 | 001,407,280 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Mazza und Naddl\Desktop\1234.com
[2011.05.21 07:28:22 | 001,407,280 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Mazza und Naddl\Desktop\herbert.com
[2011.05.20 12:43:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Loaris Trojan Remover
[2011.05.20 12:43:18 | 000,000,000 | ---D | C] -- C:\Program Files\Loaris
[2011.05.20 10:15:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\scheiss trojaner
[2011.05.20 10:15:52 | 000,000,000 | ---D | C] -- C:\Program Files\Christian anmachen
[2011.05.20 09:50:58 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Roaming\Malwarebytes
[2011.05.20 09:50:52 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.20 09:50:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.20 09:50:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.05.20 09:12:22 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Recovery
[2011.05.17 11:37:08 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\poqexec.exe
[2011.05.15 21:37:50 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Roaming\Apple Computer
[2011.05.15 21:37:50 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Local\Apple Computer
[2011.05.15 21:37:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.05.15 21:37:46 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\Windows\System32\GEARAspi.dll
[2011.05.15 21:37:46 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.05.15 21:37:08 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.05.15 21:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.05.15 21:37:07 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.05.15 21:36:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.05.15 21:35:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.05.15 21:35:06 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011.05.15 21:35:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2011.05.10 23:46:49 | 000,284,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbport.sys
[2011.05.10 23:46:48 | 000,005,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\usbd.sys
[2011.05.10 23:46:43 | 003,957,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011.05.10 23:46:43 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011.04.27 06:32:02 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe
[2011.04.27 06:31:56 | 001,686,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\esent.dll
[2011.04.27 06:31:56 | 000,146,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\storport.sys
[2011.04.27 06:31:56 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fsutil.exe
[2011.04.27 06:31:51 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011.04.27 06:31:49 | 002,614,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2011.04.26 06:31:45 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2011.04.26 06:31:45 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011.04.26 06:31:45 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.04.26 06:31:45 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.26 06:31:45 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2011.04.26 06:31:45 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.04.26 06:31:45 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2011.04.26 06:31:45 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2011.04.26 06:31:45 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.04.26 06:31:45 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2011.04.26 06:31:45 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2011.04.26 06:31:45 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2011.04.26 06:31:45 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2011.04.26 06:31:45 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011.04.26 06:31:45 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2011.04.26 06:31:45 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2011.04.26 06:31:45 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2011.04.26 06:31:45 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011.04.26 06:31:45 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011.04.26 06:31:45 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.04.26 06:31:45 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2011.04.26 06:31:45 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.04.26 06:31:45 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011.04.26 06:31:45 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.04.26 06:31:45 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.04.26 06:31:44 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.04.26 06:31:44 | 001,797,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2011.04.26 06:31:44 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.26 06:31:44 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.26 06:31:44 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.26 06:31:44 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2011.04.26 06:31:44 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2011.04.26 06:31:44 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2011.04.26 06:31:44 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2011.04.26 06:31:44 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011.04.26 06:31:44 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.26 06:31:44 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2011.04.26 06:31:44 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2011.04.26 06:31:44 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2009.02.01 04:05:50 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Mazza und Naddl\AppData\Roaming\pcouffin.sys
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.23 21:56:00 | 000,001,160 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-270643404-1195899547-1505473874-1000UA.job
[2011.05.23 21:44:37 | 000,186,178 | ---- | M] () -- C:\Users\Mazza und Naddl\Documents\cc_20110523_214429.reg
[2011.05.23 21:43:17 | 000,000,968 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.23 21:30:01 | 000,000,360 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie-Mazza und Naddl.job
[2011.05.23 21:00:07 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\qhxh.sys
[2011.05.23 18:56:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-270643404-1195899547-1505473874-1000Core.job
[2011.05.23 18:11:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.21 10:05:31 | 000,009,504 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.21 10:05:31 | 000,009,504 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.21 09:56:14 | 000,000,120 | ---- | M] () -- C:\ProgramData\~27057912
[2011.05.21 09:56:08 | 000,000,144 | ---- | M] () -- C:\ProgramData\~27057912r
[2011.05.21 09:55:18 | 2615,808,000 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.21 09:42:02 | 001,280,208 | ---- | M] () -- C:\Users\Mazza und Naddl\Desktop\tdsskiller.zip
[2011.05.21 09:37:53 | 001,407,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Mazza und Naddl\Desktop\1234.com
[2011.05.21 09:31:12 | 000,000,336 | ---- | M] () -- C:\ProgramData\27057912
[2011.05.21 09:04:15 | 000,000,144 | ---- | M] () -- C:\ProgramData\~25353976r
[2011.05.21 09:04:15 | 000,000,120 | ---- | M] () -- C:\ProgramData\~25353976
[2011.05.21 09:04:09 | 000,000,328 | ---- | M] () -- C:\ProgramData\25353976
[2011.05.21 07:28:22 | 001,407,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Mazza und Naddl\Desktop\herbert.com
[2011.05.21 03:24:15 | 000,000,120 | ---- | M] () -- C:\ProgramData\~26468088
[2011.05.21 03:24:14 | 000,000,144 | ---- | M] () -- C:\ProgramData\~26468088r
[2011.05.20 12:14:02 | 000,000,136 | ---- | M] () -- C:\ProgramData\~26402552r
[2011.05.20 12:14:02 | 000,000,112 | ---- | M] () -- C:\ProgramData\~26402552
[2011.05.20 12:13:29 | 000,000,336 | ---- | M] () -- C:\ProgramData\26402552
[2011.05.20 10:03:22 | 000,000,136 | ---- | M] () -- C:\ProgramData\~25550584r
[2011.05.20 10:03:22 | 000,000,112 | ---- | M] () -- C:\ProgramData\~25550584
[2011.05.20 10:03:13 | 000,000,336 | ---- | M] () -- C:\ProgramData\25550584
[2011.05.20 09:50:52 | 000,001,070 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.20 09:28:50 | 000,606,104 | ---- | M] () -- C:\Users\Mazza und Naddl\Desktop\unhide.exe
[2011.05.20 09:27:52 | 000,000,392 | ---- | M] () -- C:\ProgramData\26205944
[2011.05.20 09:25:24 | 000,000,136 | ---- | M] () -- C:\ProgramData\~26205944r
[2011.05.20 09:25:24 | 000,000,112 | ---- | M] () -- C:\ProgramData\~26205944
[2011.05.19 23:03:16 | 000,000,597 | ---- | M] () -- C:\Windows\wiso.ini
[2011.05.18 23:31:17 | 000,016,811 | ---- | M] () -- C:\Users\Mazza und Naddl\Desktop\7513465-teufel-emoticon.jpg
[2011.05.16 22:40:07 | 000,657,438 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.16 22:40:07 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.16 22:40:07 | 000,130,810 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.16 22:40:07 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.15 21:37:48 | 000,001,756 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.05.15 21:36:10 | 000,001,818 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.05.13 13:21:28 | 001,407,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Mazza und Naddl\Desktop\TDSSKiller.exe
[2011.04.26 06:31:45 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2011.04.26 06:31:45 | 001,427,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2011.04.26 06:31:45 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.04.26 06:31:45 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.26 06:31:45 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2011.04.26 06:31:45 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.04.26 06:31:45 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2011.04.26 06:31:45 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2011.04.26 06:31:45 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.04.26 06:31:45 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2011.04.26 06:31:45 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2011.04.26 06:31:45 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2011.04.26 06:31:45 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2011.04.26 06:31:45 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2011.04.26 06:31:45 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2011.04.26 06:31:45 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2011.04.26 06:31:45 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2011.04.26 06:31:45 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2011.04.26 06:31:45 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2011.04.26 06:31:45 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011.04.26 06:31:45 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.04.26 06:31:45 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2011.04.26 06:31:45 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.04.26 06:31:45 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2011.04.26 06:31:45 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.04.26 06:31:45 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.04.26 06:31:44 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.04.26 06:31:44 | 001,797,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2011.04.26 06:31:44 | 000,716,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.26 06:31:44 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.26 06:31:44 | 000,420,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.26 06:31:44 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2011.04.26 06:31:44 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2011.04.26 06:31:44 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2011.04.26 06:31:44 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2011.04.26 06:31:44 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2011.04.26 06:31:44 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.26 06:31:44 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2011.04.26 06:31:44 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2011.04.26 06:31:44 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
 
========== Files Created - No Company Name ==========
 
[2011.05.23 21:44:34 | 000,186,178 | ---- | C] () -- C:\Users\Mazza und Naddl\Documents\cc_20110523_214429.reg
[2011.05.23 21:43:17 | 000,000,968 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.23 21:00:06 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\qhxh.sys
[2011.05.21 09:42:02 | 001,280,208 | ---- | C] () -- C:\Users\Mazza und Naddl\Desktop\tdsskiller.zip
[2011.05.21 09:31:57 | 000,000,144 | ---- | C] () -- C:\ProgramData\~27057912r
[2011.05.21 09:31:57 | 000,000,120 | ---- | C] () -- C:\ProgramData\~27057912
[2011.05.21 09:31:12 | 000,000,336 | ---- | C] () -- C:\ProgramData\27057912
[2011.05.21 09:04:15 | 000,000,144 | ---- | C] () -- C:\ProgramData\~25353976r
[2011.05.21 09:04:15 | 000,000,120 | ---- | C] () -- C:\ProgramData\~25353976
[2011.05.21 09:04:09 | 000,000,328 | ---- | C] () -- C:\ProgramData\25353976
[2011.05.21 03:24:14 | 000,000,144 | ---- | C] () -- C:\ProgramData\~26468088r
[2011.05.21 03:24:13 | 000,000,120 | ---- | C] () -- C:\ProgramData\~26468088
[2011.05.20 18:32:47 | 000,001,070 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.20 12:14:02 | 000,000,136 | ---- | C] () -- C:\ProgramData\~26402552r
[2011.05.20 12:14:01 | 000,000,112 | ---- | C] () -- C:\ProgramData\~26402552
[2011.05.20 12:13:29 | 000,000,336 | ---- | C] () -- C:\ProgramData\26402552
[2011.05.20 12:06:18 | 000,002,163 | ---- | C] () -- C:\Users\Public\Desktop\t@x 2011.lnk
[2011.05.20 12:06:18 | 000,002,015 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011.05.20 12:06:18 | 000,001,818 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2011.05.20 12:06:18 | 000,001,756 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.05.20 12:06:18 | 000,001,112 | ---- | C] () -- C:\Users\Public\Desktop\ALDI Bestellsoftware.lnk
[2011.05.20 12:06:18 | 000,000,915 | ---- | C] () -- C:\Users\Public\Desktop\Sony MP3 Player.lnk
[2011.05.20 12:06:18 | 000,000,897 | ---- | C] () -- C:\Users\Public\Desktop\AnyDVD.lnk
[2011.05.20 10:03:22 | 000,000,136 | ---- | C] () -- C:\ProgramData\~25550584r
[2011.05.20 10:03:22 | 000,000,112 | ---- | C] () -- C:\ProgramData\~25550584
[2011.05.20 10:03:12 | 000,000,336 | ---- | C] () -- C:\ProgramData\25550584
[2011.05.20 09:28:48 | 000,606,104 | ---- | C] () -- C:\Users\Mazza und Naddl\Desktop\unhide.exe
[2011.05.20 09:12:45 | 000,000,136 | ---- | C] () -- C:\ProgramData\~26205944r
[2011.05.20 09:12:44 | 000,000,112 | ---- | C] () -- C:\ProgramData\~26205944
[2011.05.20 09:12:04 | 000,000,392 | ---- | C] () -- C:\ProgramData\26205944
[2011.05.18 23:31:16 | 000,016,811 | ---- | C] () -- C:\Users\Mazza und Naddl\Desktop\7513465-teufel-emoticon.jpg
[2011.04.26 06:31:45 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.01.31 00:18:28 | 000,000,597 | ---- | C] () -- C:\Windows\wiso.ini
[2010.10.20 20:22:52 | 000,086,758 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\mdbu.bin
[2010.07.27 07:05:39 | 000,003,584 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.03 01:23:49 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.06.03 01:07:35 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2009.12.14 13:57:11 | 000,000,118 | ---- | C] () -- C:\Windows\Podcasts.INI
[2009.10.20 19:18:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.10.18 11:10:29 | 000,003,284 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\ANIWZCS{DAE5A23F-3BA7-41A4-B7C6-D62E7E4CE9FF}
[2009.10.18 11:10:20 | 000,147,456 | ---- | C] () -- C:\Windows\System32\ANIWConnService.exe
[2009.10.18 11:08:15 | 000,013,931 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2009.10.18 11:07:59 | 000,012,800 | ---- | C] () -- C:\Windows\System32\drivers\anodlwf.sys
[2009.07.14 10:47:43 | 000,657,438 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,130,810 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,475,552 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,618,714 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,107,034 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009.03.02 12:33:32 | 000,067,584 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.02.01 04:05:59 | 000,000,014 | ---- | C] () -- C:\Windows\System32\systeminfo3.dll
[2009.02.01 04:05:50 | 000,081,920 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\ezpinst.exe
[2009.02.01 04:05:50 | 000,007,176 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\pcouffin.cat
[2009.02.01 04:05:50 | 000,001,144 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\pcouffin.inf
[2008.09.06 23:46:20 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2008.08.14 17:10:54 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008.08.14 16:59:26 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.08.14 16:58:47 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2008.08.14 16:58:46 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2008.08.14 16:58:35 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.08.14 16:58:35 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008.08.14 14:24:33 | 000,000,412 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2008.08.14 01:03:14 | 000,146,480 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\mdb.bin
[2008.05.26 09:19:45 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.05.26 09:19:45 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini

< End of report >

--- --- ---

Cordoba1984 · 23.05.2011, 21:34

Wird noch eine Log benötigt???

Cordoba1984 · 24.05.2011, 05:52

Es würde mich echt freuen, wenn mir jemand helfen würde...

Cordoba1984 · 24.05.2011, 09:41

Hat denn wirklich keiner einen rat für mich??

Cordoba1984 · 24.05.2011, 12:56

@cosinus:
Würdest du mir bitte helfen.
Ich veruweifel bald...

Grüße

Cordoba1984 · 24.05.2011, 17:44

Wenn ich irgendwas falsch gemacht habe, dann sagt mir doch wenigstens bitte Bescheid...

Ich habe weder Keygens, noch Cracks, noch illegale Software installiert. Mein Windows 7 ist regulär bei Amazon gekauft. Office genauso...
Spiele habe ich kein einziges installiert...

Cordoba1984 · 24.05.2011, 18:51

Also so langsam versteh ich echt nicht mehr, wieso keiner antwortet... andere haben das selbe Problem wie ich und bekommen gleich eine Antwort... Und bei mir tut sich gar nichts. WARUM?

cosinus · 25.05.2011, 11:16

Zitat:

[2011.04.11 10:27:34 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.04.08 18:05:08 | 000,000,000 | ---D | M] (Sopcast Ask Toolbar) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\toolbar@ask.com

Hm, was willst du mit diesen komischen Toolbars auf dem Rechner? Am besten alles entfernen wo Toolbar steht, was in der Systemsteuerung unter Software bzw. Programme und Funktionen zu sehen ist und bei zukünftigen Programminstallation immer die benutzerdefinierte Methode anklicken, damit man bei der Installation mögliche Toolbars abwählen kann.
Deinstalliere bei der Gelegenheit auch alle anderen unnötigen Programme über die Systemsteuerung.

Danach ein frisches OTL-Log erstellen:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Cordoba1984 · 25.05.2011, 17:17

Hier der Text aus OTL.txtOTL Logfile:

Code:

ATTFilter

OTL logfile created on: 25.05.2011 18:08:22 - Run 2
OTL by OldTimer - Version 3.2.22.3     Folder = C:\Users\Mazza und Naddl\Downloads
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 72,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 79,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 453,76 Gb Total Space | 346,15 Gb Free Space | 76,29% Space Free | Partition Type: NTFS
Drive D: | 465,76 Gb Total Space | 354,83 Gb Free Space | 76,18% Space Free | Partition Type: NTFS
 
Computer Name: MAZZAUNDNADD-PC | User Name: Mazza und Naddl | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Mazza und Naddl\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\program files\avira\antivir desktop\avcenter.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\ANIWConnService.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV)
PRC - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ()
PRC - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.)
PRC - C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\Packard Bell\FIJI\AOSD.exe (Packard Bell BV)
PRC - C:\Program Files\Packard Bell\FIJI\ABoard.exe (Packard Bell BV)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Mazza und Naddl\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (TomTomHOMEService) -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (ANIWConnService) -- C:\Windows\System32\ANIWConnService.exe ()
SRV - (IJPLMSVC) -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ()
SRV - (UPnPService) -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (tbhsd) -- C:\Windows\System32\drivers\tbhsd.sys (RapidSolution Software AG)
DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (anodlwf) -- C:\Windows\System32\drivers\anodlwf.sys ()
DRV - (RxFilter) -- C:\Windows\System32\drivers\RxFilter.sys (Sonic Solutions)
DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Ask.com Deutschland - die andere Suchmaschine
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = local;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.1
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.0.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.03 16:51:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.24 20:15:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.03.20 04:34:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.05.24 20:15:54 | 000,000,000 | ---D | M]
 
[2010.06.03 00:57:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Extensions
[2010.01.03 19:39:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.01.14 19:34:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2011.05.25 18:03:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions
[2010.06.03 00:57:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.11 10:27:34 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.06.03 00:57:35 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.11 10:27:36 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.06.03 00:57:33 | 000,000,000 | ---D | M] (YouTube to MP3) -- C:\Users\Mazza und Naddl\AppData\Roaming\mozilla\Firefox\Profiles\isnr1ydq.default\extensions\youtube2mp3@mondayx.de
[2011.05.23 18:17:53 | 000,002,333 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\askcom-1.xml
[2011.05.24 18:36:22 | 000,002,396 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\askcom.xml
[2011.05.24 06:36:33 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-1.xml
[2009.07.26 13:19:00 | 000,000,961 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-10.xml
[2009.08.13 23:29:56 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-11.xml
[2010.02.26 22:00:43 | 000,000,961 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-12.xml
[2010.03.11 15:06:12 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-13.xml
[2010.03.28 20:01:52 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-14.xml
[2010.04.03 22:00:01 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-15.xml
[2010.05.14 20:13:27 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-16.xml
[2010.06.28 06:34:01 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-17.xml
[2010.08.10 09:14:19 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-18.xml
[2010.10.02 10:58:04 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-19.xml
[2008.09.28 10:28:35 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-2.xml
[2010.10.21 07:09:56 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-20.xml
[2010.11.06 13:48:29 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-21.xml
[2010.12.15 19:59:31 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-22.xml
[2011.02.06 21:03:48 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-23.xml
[2011.03.07 08:10:04 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-24.xml
[2011.03.27 20:27:39 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-25.xml
[2011.04.12 17:18:26 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-26.xml
[2011.05.04 23:30:56 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-27.xml
[2008.11.15 13:26:00 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-3.xml
[2009.03.15 12:50:37 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-4.xml
[2009.03.29 13:02:40 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-5.xml
[2009.03.31 06:39:39 | 000,000,656 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-6.xml
[2009.04.28 15:13:27 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-7.xml
[2009.05.18 18:30:28 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-8.xml
[2009.06.16 06:36:29 | 000,000,950 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin-9.xml
[2008.07.10 14:07:28 | 000,000,944 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\icqplugin.xml
[2010.12.19 21:50:48 | 000,001,583 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\searchplugins\web-search.xml
[2011.04.09 22:50:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2010.06.03 00:45:51 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.06.03 00:45:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.11.21 21:54:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.03.19 23:40:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) -- 
() (No name found) -- C:\USERS\MAZZA UND NADDL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ISNR1YDQ.DEFAULT\EXTENSIONS\{19503E42-CA3C-4C27-B1E2-9CDB2170EE34}.XPI
[2011.05.03 16:51:42 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.04.10 14:34:43 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.04.10 14:34:43 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.04.10 14:34:43 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.04.10 14:34:43 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.04.10 14:34:43 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.04.10 14:34:43 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.06.07 19:46:53 | 000,000,741 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1            localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll (Packard Bell)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [ACTIVBOARD] C:\Program Files\Packard Bell\FIJI\aboard.exe (Packard Bell BV)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKCU..\Run: [SmpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe (Packard Bell BV)
O4 - Startup: C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22 - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - C:\Program Files\Stardock\ObjectDockFree\ODMenu.dll (Stardock)
O24 - Desktop WallPaper: C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\Shell - "" = AutoRun
O33 - MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\Shell - "" = AutoRun
O33 - MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -a
O33 - MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\Shell - "" = AutoRun
O33 - MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= -  File not found
MsConfig - StartUpReg: CarboniteSetupLite - hkey= - key= - C:\Program Files\Packard Bell\Carbonite\CarboniteSetupLitePBPreInstaller.exe (Carbonite, Inc.)
MsConfig - StartUpReg: D-Link D-Link Wireless N DWA-140 - hkey= - key= -  File not found
MsConfig - StartUpReg: GMX SMS-Manager - hkey= - key= - C:\Program Files\GMX\GMX SMS-Manager\SMSMngr.exe (1&1 Internet AG)
MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Program Files\ICQ7.0\ICQ.exe (ICQ, LLC.)
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig - StartUpReg: Orb - hkey= - key= - C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks)
MsConfig - StartUpReg: SSBkgdUpdate - hkey= - key= - C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
MsConfig - StartUpReg: TomTomHOME.exe - hkey= - key= - C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
MsConfig - StartUpReg: toolbar_eula_launcher - hkey= - key= - C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe ( )
MsConfig - StartUpReg: WinampAgent - hkey= - key= -  File not found
MsConfig - State: "bootini" - 2
MsConfig - State: "startup" - 2
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (www)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)

 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.24 20:15:27 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2011.05.23 22:38:21 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\Desktop\anti
[2011.05.23 21:51:05 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Local\Diagnostics
[2011.05.23 21:43:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.05.23 21:43:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.05.23 18:13:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview
[2011.05.20 12:43:18 | 000,000,000 | ---D | C] -- C:\Program Files\Loaris
[2011.05.20 10:15:52 | 000,000,000 | ---D | C] -- C:\Program Files\Christian anmachen
[2011.05.20 09:50:58 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Roaming\Malwarebytes
[2011.05.20 09:50:52 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.20 09:50:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.20 09:50:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.05.20 09:12:22 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 7 Recovery
[2011.05.15 21:37:50 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Roaming\Apple Computer
[2011.05.15 21:37:50 | 000,000,000 | ---D | C] -- C:\Users\Mazza und Naddl\AppData\Local\Apple Computer
[2011.05.15 21:37:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.05.15 21:37:46 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2011.05.15 21:37:08 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.05.15 21:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.05.15 21:37:07 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.05.15 21:36:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.05.15 21:35:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2011.05.15 21:35:06 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011.05.15 21:35:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2009.02.01 04:05:50 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Mazza und Naddl\AppData\Roaming\pcouffin.sys
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.25 18:00:00 | 000,000,360 | ---- | M] () -- C:\Windows\tasks\Erweiterte Garantie-Mazza und Naddl.job
[2011.05.25 17:56:00 | 000,001,160 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-270643404-1195899547-1505473874-1000UA.job
[2011.05.25 17:54:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.25 07:24:58 | 000,009,504 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.25 07:24:58 | 000,009,504 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.25 07:21:09 | 000,657,438 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.25 07:21:09 | 000,618,714 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.25 07:21:09 | 000,130,810 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.25 07:21:09 | 000,107,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.24 20:15:54 | 000,001,992 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.05.24 19:11:22 | 2615,808,000 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.24 18:56:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-270643404-1195899547-1505473874-1000Core.job
[2011.05.23 23:00:16 | 000,000,062 | ---- | M] () -- C:\Users\Mazza und Naddl\Desktop\BigFM Webradio online Webradio hören.URL
[2011.05.23 21:44:37 | 000,186,178 | ---- | M] () -- C:\Users\Mazza und Naddl\Documents\cc_20110523_214429.reg
[2011.05.23 21:43:17 | 000,000,968 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.21 09:56:14 | 000,000,120 | ---- | M] () -- C:\ProgramData\~27057912
[2011.05.21 09:56:08 | 000,000,144 | ---- | M] () -- C:\ProgramData\~27057912r
[2011.05.21 09:31:12 | 000,000,336 | ---- | M] () -- C:\ProgramData\27057912
[2011.05.21 09:04:15 | 000,000,144 | ---- | M] () -- C:\ProgramData\~25353976r
[2011.05.21 09:04:15 | 000,000,120 | ---- | M] () -- C:\ProgramData\~25353976
[2011.05.21 09:04:09 | 000,000,328 | ---- | M] () -- C:\ProgramData\25353976
[2011.05.21 03:24:15 | 000,000,120 | ---- | M] () -- C:\ProgramData\~26468088
[2011.05.21 03:24:14 | 000,000,144 | ---- | M] () -- C:\ProgramData\~26468088r
[2011.05.20 12:14:02 | 000,000,136 | ---- | M] () -- C:\ProgramData\~26402552r
[2011.05.20 12:14:02 | 000,000,112 | ---- | M] () -- C:\ProgramData\~26402552
[2011.05.20 12:13:29 | 000,000,336 | ---- | M] () -- C:\ProgramData\26402552
[2011.05.20 10:03:22 | 000,000,136 | ---- | M] () -- C:\ProgramData\~25550584r
[2011.05.20 10:03:22 | 000,000,112 | ---- | M] () -- C:\ProgramData\~25550584
[2011.05.20 10:03:13 | 000,000,336 | ---- | M] () -- C:\ProgramData\25550584
[2011.05.20 09:50:52 | 000,001,070 | ---- | M] () -- C:\Users\Mazza und Naddl\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.20 09:27:52 | 000,000,392 | ---- | M] () -- C:\ProgramData\26205944
[2011.05.20 09:25:24 | 000,000,136 | ---- | M] () -- C:\ProgramData\~26205944r
[2011.05.20 09:25:24 | 000,000,112 | ---- | M] () -- C:\ProgramData\~26205944
[2011.05.19 23:03:16 | 000,000,597 | ---- | M] () -- C:\Windows\wiso.ini
[2011.05.15 21:37:48 | 000,001,756 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.04.26 06:31:45 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
 
========== Files Created - No Company Name ==========
 
[2011.05.24 20:15:54 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011.05.24 20:15:54 | 000,001,992 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011.05.23 23:00:16 | 000,000,062 | ---- | C] () -- C:\Users\Mazza und Naddl\Desktop\BigFM Webradio online Webradio hören.URL
[2011.05.23 21:44:34 | 000,186,178 | ---- | C] () -- C:\Users\Mazza und Naddl\Documents\cc_20110523_214429.reg
[2011.05.23 21:43:17 | 000,000,968 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.21 09:31:57 | 000,000,144 | ---- | C] () -- C:\ProgramData\~27057912r
[2011.05.21 09:31:57 | 000,000,120 | ---- | C] () -- C:\ProgramData\~27057912
[2011.05.21 09:31:12 | 000,000,336 | ---- | C] () -- C:\ProgramData\27057912
[2011.05.21 09:04:15 | 000,000,144 | ---- | C] () -- C:\ProgramData\~25353976r
[2011.05.21 09:04:15 | 000,000,120 | ---- | C] () -- C:\ProgramData\~25353976
[2011.05.21 09:04:09 | 000,000,328 | ---- | C] () -- C:\ProgramData\25353976
[2011.05.21 03:24:14 | 000,000,144 | ---- | C] () -- C:\ProgramData\~26468088r
[2011.05.21 03:24:13 | 000,000,120 | ---- | C] () -- C:\ProgramData\~26468088
[2011.05.20 18:32:47 | 000,001,070 | ---- | C] () -- C:\Users\Mazza und Naddl\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.20 12:14:02 | 000,000,136 | ---- | C] () -- C:\ProgramData\~26402552r
[2011.05.20 12:14:01 | 000,000,112 | ---- | C] () -- C:\ProgramData\~26402552
[2011.05.20 12:13:29 | 000,000,336 | ---- | C] () -- C:\ProgramData\26402552
[2011.05.20 12:06:18 | 000,002,163 | ---- | C] () -- C:\Users\Public\Desktop\t@x 2011.lnk
[2011.05.20 12:06:18 | 000,001,756 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.05.20 12:06:18 | 000,001,112 | ---- | C] () -- C:\Users\Public\Desktop\ALDI Bestellsoftware.lnk
[2011.05.20 12:06:18 | 000,000,915 | ---- | C] () -- C:\Users\Public\Desktop\Sony MP3 Player.lnk
[2011.05.20 12:06:18 | 000,000,897 | ---- | C] () -- C:\Users\Public\Desktop\AnyDVD.lnk
[2011.05.20 10:03:22 | 000,000,136 | ---- | C] () -- C:\ProgramData\~25550584r
[2011.05.20 10:03:22 | 000,000,112 | ---- | C] () -- C:\ProgramData\~25550584
[2011.05.20 10:03:12 | 000,000,336 | ---- | C] () -- C:\ProgramData\25550584
[2011.05.20 09:12:45 | 000,000,136 | ---- | C] () -- C:\ProgramData\~26205944r
[2011.05.20 09:12:44 | 000,000,112 | ---- | C] () -- C:\ProgramData\~26205944
[2011.05.20 09:12:04 | 000,000,392 | ---- | C] () -- C:\ProgramData\26205944
[2011.04.26 06:31:45 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.01.31 00:18:28 | 000,000,597 | ---- | C] () -- C:\Windows\wiso.ini
[2010.10.20 20:22:52 | 000,086,758 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\mdbu.bin
[2010.07.27 07:05:39 | 000,003,584 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.03 01:23:49 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.06.03 01:07:35 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2009.12.14 13:57:11 | 000,000,118 | ---- | C] () -- C:\Windows\Podcasts.INI
[2009.10.20 19:18:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.10.18 11:10:29 | 000,003,284 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\ANIWZCS{DAE5A23F-3BA7-41A4-B7C6-D62E7E4CE9FF}
[2009.10.18 11:10:20 | 000,147,456 | ---- | C] () -- C:\Windows\System32\ANIWConnService.exe
[2009.10.18 11:08:15 | 000,013,931 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2009.10.18 11:07:59 | 000,012,800 | ---- | C] () -- C:\Windows\System32\drivers\anodlwf.sys
[2009.07.14 10:47:43 | 000,657,438 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,130,810 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,475,552 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,618,714 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,107,034 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009.03.02 12:33:32 | 000,067,584 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.02.01 04:05:59 | 000,000,014 | ---- | C] () -- C:\Windows\System32\systeminfo3.dll
[2009.02.01 04:05:50 | 000,081,920 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\ezpinst.exe
[2009.02.01 04:05:50 | 000,007,176 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\pcouffin.cat
[2009.02.01 04:05:50 | 000,001,144 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\pcouffin.inf
[2008.09.06 23:46:20 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2008.08.14 17:10:54 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008.08.14 16:59:26 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.08.14 16:58:47 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2008.08.14 16:58:46 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2008.08.14 16:58:35 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008.08.14 16:58:35 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008.08.14 14:24:33 | 000,000,412 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2008.08.14 01:03:14 | 000,146,480 | ---- | C] () -- C:\Users\Mazza und Naddl\AppData\Roaming\mdb.bin
[2008.05.26 09:19:45 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.05.26 09:19:45 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
 
========== LOP Check ==========
 
[2010.06.03 00:57:06 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Auslogics
[2011.01.31 00:18:56 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Buhl Data Service
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Canon
[2009.04.10 23:01:57 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DAEMON Tools
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DAEMON Tools Lite
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DAEMON Tools Pro
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.25 21:18:28 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\GMX
[2011.05.25 18:08:17 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\ICQ
[2008.08.14 16:59:10 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\ICQ Toolbar
[2010.06.03 00:57:14 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Leadertech
[2010.06.03 00:57:29 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\MAGIX
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Packard Bell
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Pogo Games
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\ScanSoft
[2010.12.29 14:26:07 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Stardock
[2010.06.07 19:40:35 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\TeamViewer
[2009.08.11 08:38:52 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\temp
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Thunderbird
[2010.06.03 00:57:37 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\TomTom
[2009.02.01 11:44:07 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Vso
[2010.12.29 14:20:33 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\XWindows Dock
[2011.05.25 18:00:00 | 000,000,360 | ---- | M] () -- C:\Windows\Tasks\Erweiterte Garantie-Mazza und Naddl.job
[2011.04.02 09:41:10 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.05.25 07:26:09 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Adobe
[2011.05.15 23:50:48 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Apple Computer
[2010.06.03 00:57:06 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Auslogics
[2010.10.24 12:15:56 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Avira
[2011.01.31 00:18:56 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Buhl Data Service
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Canon
[2009.04.10 23:01:57 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DAEMON Tools
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DAEMON Tools Lite
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DAEMON Tools Pro
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.25 21:18:28 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\GMX
[2010.06.03 00:57:08 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Google
[2011.05.25 18:08:17 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\ICQ
[2008.08.14 16:59:10 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\ICQ Toolbar
[2010.06.15 23:45:16 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Identities
[2010.06.03 00:57:14 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Leadertech
[2010.06.03 00:57:14 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Macromedia
[2010.06.03 00:57:29 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\MAGIX
[2011.05.20 09:50:58 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Malwarebytes
[2010.06.03 00:57:29 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Media Center Programs
[2010.06.03 00:57:29 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Media Player Classic
[2011.05.25 07:26:09 | 000,000,000 | --SD | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Microsoft
[2010.06.03 00:57:32 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Packard Bell
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Pogo Games
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Roxio
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\ScanSoft
[2010.06.03 00:57:36 | 000,000,000 | R--D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\SecuROM
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Sony Corporation
[2010.12.29 14:26:07 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Stardock
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\SunODFPluginforMicrosoftOffice
[2010.06.07 19:40:35 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\TeamViewer
[2009.08.11 08:38:52 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\temp
[2010.06.03 00:57:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Thunderbird
[2010.06.03 00:57:37 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\TomTom
[2010.06.03 00:57:37 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\TVU networks
[2010.06.03 00:57:38 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\U3
[2009.02.01 11:44:07 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\Vso
[2008.08.17 16:47:36 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\WinRAR
[2010.12.29 14:20:33 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\XWindows Dock
 
< %APPDATA%\*.exe /s >
[2009.02.01 11:44:06 | 000,081,920 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\ezpinst.exe
[2008.10.19 20:46:17 | 001,887,176 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Mazza und Naddl\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
[2011.04.11 10:39:05 | 000,188,152 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\Mozilla\Firefox\Profiles\isnr1ydq.default\FlashGot.exe
[2010.03.09 19:11:14 | 005,514,304 | ---- | M] (TVU networks) -- C:\Users\Mazza und Naddl\AppData\Roaming\TVU networks\AutoUpgrade\TVUPlayer2.5.2.2.exe
[2009.10.24 20:56:33 | 005,519,752 | ---- | M] (TVU networks) -- C:\Users\Mazza und Naddl\AppData\Roaming\TVU networks\TVU AutoUpgrade\TVUPlayer2.4.7.2.exe
[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\U3\432022139501B32D\cleanup.exe
[2008.02.25 13:47:34 | 003,489,792 | ---- | M] (SanDisk Corporation) -- C:\Users\Mazza und Naddl\AppData\Roaming\U3\432022139501B32D\Launchpad Removal.exe
[2007.10.23 10:17:36 | 004,628,480 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\U3\432022139501B32D\LaunchPad.exe
[2007.10.23 09:44:48 | 000,054,584 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\U3\432022139501B32D\U3AccessGrant.exe
[2007.10.23 10:27:20 | 000,110,592 | ---- | M] () -- C:\Users\Mazza und Naddl\AppData\Roaming\U3\temp\cleanup.exe
[2008.02.25 13:47:34 | 003,489,792 | ---- | M] (SanDisk Corporation) -- C:\Users\Mazza und Naddl\AppData\Roaming\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2007.09.11 15:19:16 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=8FFB327669B980549BD318D939A34F9B -- C:\$WINDOWS.~Q\DATA\Windows\System32\drivers\nvstor32.sys
[2007.09.11 15:19:16 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=8FFB327669B980549BD318D939A34F9B -- C:\drivers\MOBO\CHIPSET\IDE\WinVista\sata_ide\nvstor32.sys
[2007.09.11 15:19:16 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=8FFB327669B980549BD318D939A34F9B -- C:\Windows\System32\drivers\nvstor32.sys
[2007.09.11 15:19:16 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=8FFB327669B980549BD318D939A34F9B -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_x86_neutral_e4a16a8d34338dc7\nvstor32.sys
[2007.09.11 15:19:18 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=AFD01721DC3297E6715C5F472DD8BCCD -- C:\drivers\MOBO\CHIPSET\IDE\WinVista\sataraid\nvstor32.sys
[2007.09.11 15:19:18 | 000,114,208 | ---- | M] (NVIDIA Corporation) MD5=AFD01721DC3297E6715C5F472DD8BCCD -- C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_x86_neutral_6f524783196f6eb5\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Mazza und Naddl\AppData\Local\Temp\RarSFX0\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
[2009.05.26 19:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Mazza und Naddl\AppData\Local\Temp\RarSFX0\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >

--- --- ---

cosinus · 25.05.2011, 20:51

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\Shell - "" = AutoRun
O33 - MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\Shell - "" = AutoRun
O33 - MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\Shell\AutoRun\command - "" = L:\LaunchU3.exe -a
O33 - MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\Shell - "" = AutoRun
O33 - MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
[2009.10.18 11:08:15 | 000,013,931 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2009.10.18 11:07:59 | 000,012,800 | ---- | C] () -- C:\Windows\System32\drivers\anodlwf.sys
[2008.08.14 16:59:10 | 000,000,000 | ---D | M] -- C:\Users\Mazza und Naddl\AppData\Roaming\ICQ Toolbar
:Files
C:\ProgramData\~*
C:\ProgramData\2*
:Commands
[purity]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Cordoba1984 · 25.05.2011, 21:07

========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0282226e-9d84-11de-8a76-001c4af831e7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0282226e-9d84-11de-8a76-001c4af831e7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0282226e-9d84-11de-8a76-001c4af831e7}\ not found.
File F:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb6bd967-d19e-11dd-a566-001c4af831e7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bb6bd967-d19e-11dd-a566-001c4af831e7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bb6bd967-d19e-11dd-a566-001c4af831e7}\ not found.
File L:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f9541a31-2364-11df-850b-001c25e8e1f8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f9541a31-2364-11df-850b-001c25e8e1f8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f9541a31-2364-11df-850b-001c25e8e1f8}\ not found.
File F:\LaunchU3.exe -a not found.
C:\Windows\System32\RaCoInst.dat moved successfully.
C:\Windows\System32\drivers\anodlwf.sys moved successfully.
C:\Users\Mazza und Naddl\AppData\Roaming\ICQ Toolbar folder moved successfully.
========== FILES ==========
C:\ProgramData\~25353976 moved successfully.
C:\ProgramData\~25353976r moved successfully.
C:\ProgramData\~25550584 moved successfully.
C:\ProgramData\~25550584r moved successfully.
C:\ProgramData\~26205944 moved successfully.
C:\ProgramData\~26205944r moved successfully.
C:\ProgramData\~26402552 moved successfully.
C:\ProgramData\~26402552r moved successfully.
C:\ProgramData\~26468088 moved successfully.
C:\ProgramData\~26468088r moved successfully.
C:\ProgramData\~27057912 moved successfully.
C:\ProgramData\~27057912r moved successfully.
C:\ProgramData\25353976 moved successfully.
C:\ProgramData\25550584 moved successfully.
C:\ProgramData\26205944 moved successfully.
C:\ProgramData\26402552 moved successfully.
C:\ProgramData\27057912 moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.22.3 log created on 05252011_220631

cosinus · 25.05.2011, 21:46

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - also beide Haken setzen, auf Start scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!

Windows 7 Recovery Trojaner

Log-Analyse und Auswertung: Windows 7 Recovery Trojaner