Guten Abend,

mittlerweile bin ich verzweifelt. Der 2. BKA-Trojaner den ich auf mir auf meinem letzten PC einfing warderart hartnäckig, dass ich einfach nur noch mit einem von einer CD starbaren Betriebssystem meine Dateien rettete und den PC entsorgte.

Nun habe ich ihn wieder, der Bildschirm kam einfach während des Surfens (auf einer übrigens vertrauenswürdigen Seite).

Ich bitte Sie, mir erneut zu helfen; ich finde die alten Threads nicht bzw. selbst wenn sollte man dieses Problem ja immer individuell nach Ihren Lösungen beheben.

Ich bedanke mich im Vorraus, mit freundlichen Grüßen,

Cooper

hi,
du meinst doch nicht mit entsorgen das du ihn weg geworfen hast, das wäre ja ziemlich übertrieben ...

Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.

• Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
• Lege eine leere CD in Deinen Brenner.
• ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
• Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
• Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan

• Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
• Mache einen Doppelklick auf das OTLPE Icon.
• Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
• Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
• OTLpe sollte nun starten.
• Drücke Run Scan, um den Scan zu starten.
• Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
• Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
• Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

Ok,

ich habe nun die besagte CD gebrannt und von ihr gebootet. Bis dahin ist alles ok, nur: Sobald ich OTLPE starte, heisst es "Browse for Folder", egal ob ich dann "My Computer" wähle oder irgendein bestimmtes Laufwerk, es folgt entweder

"No Windows Installations found"(Bei "My Computer) oder bei jedem beliebigen Laufwerk oder ornder, dass das System nicht windows 2000 oder später entspricht...

Hm, klingt wieder mal nach einem Spezialfall?

Ich möchte mich btw. für die Rechtschreibung entschuldigen, aber ich muss hier auf einem Netbook schreiben, was mir mit meinen großen Händen noch recht schwer fällt

Würde es eventuell auch mit einer anderen Software funktionieren? Denn oben genanntes Problem besteht weiterhin und bringt mich zum Verzweifeln.

ja du musst halt auch mal warten, ich bin ne privat person.
öffne my computer, das laufwerk wo windows instaliert wird und dann klicke auf windows und es geht los.

Okay, entschuldigung.
Jetzt funktioniert der Scan, ich muss nur noch herausfinden wie ich die Log-files irgendwo speichere; bei mir wwerden scheinbar gerade keine USB-Medien erkannt, somit bin ich wegen Fritz-WLAN-Stick nicht online und kann erstmal nix irgendwo speichern. Ich schau jetzt mal.

Danke soweit, Log kommt sobald wie möglich!

OTL Logfile:

OTL logfile created on: 11/9/2011 1:36:35 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 96.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = H: | %SystemRoot% = H:\Windows | %ProgramFiles% = H:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.37 Mb Free Space | 74.37% Space Free | Partition Type: NTFS
Drive H: | 220.95 Gb Total Space | 81.96 Gb Free Space | 37.09% Space Free | Partition Type: NTFS
Drive I: | 221.71 Gb Total Space | 164.69 Gb Free Space | 74.28% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/09/22 11:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- H:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/08/10 09:01:06 | 000,206,880 | ---- | M] () [Auto] -- H:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV:64bit: - [2009/08/10 09:01:04 | 000,626,208 | ---- | M] () [Auto] -- H:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- H:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2011/10/11 07:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- H:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/11 07:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- H:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/10/21 19:00:00 | 000,376,832 | ---- | M] (AVM Berlin) [Auto] -- H:\Program Files (x86)\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2010/10/12 12:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand] -- H:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/09/29 20:06:46 | 000,169,408 | ---- | M] (Adobe Systems Incorporated) [Auto] -- H:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor9.0)
SRV - [2010/06/01 17:31:28 | 002,804,568 | ---- | M] (Symantec Corporation) [Auto] -- H:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe -- (NOBU)
SRV - [2010/05/04 14:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto] -- H:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) @C:\Program Files (x86)
SRV - [2010/03/18 06:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- H:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- H:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/10/11 08:00:01 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System] -- H:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/10/11 08:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto] -- H:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/10/11 08:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- H:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/09/18 13:07:18 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | System] -- H:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2010/11/20 22:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 22:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/10/21 19:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- H:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV:64bit: - [2010/10/21 19:00:00 | 000,014,120 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- H:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2010/03/18 20:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot] -- H:\Windows\System32\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/08/13 15:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009/07/30 04:12:56 | 000,339,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- H:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
 
IE - HKU\NetworkService_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
 
IE - HKU\Simon_Cooper_ON_H\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKU\Simon_Cooper_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=14597
IE - HKU\Simon_Cooper_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page Restore = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\Simon_Cooper_ON_H\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\Simon_Cooper_ON_H\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "Yahoo"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "bwf.weegel.de/index.php"
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7Bfeffd3a0-2656-481d-a3c2-32d9c52f465f%7D&mid=4ae5bae0d42047d1ac8ed15309ac035c-cdff593ce9d28e1406609187ba62c76c4080ad2b&ds=tg028&v=8.0.0.34.1&lang=en&pr=sa&d=2011-09-18%2020%3A15%3A13&sap=ku&q="
 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: H:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: H:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: H:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: H:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: H:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: H:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: H:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: H:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: H:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/10/26 09:21:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/11/05 11:59:11 | 000,000,000 | ---D | M]
 
[2011/08/18 15:52:58 | 000,000,000 | ---D | M] (No name found) -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Extensions
[2011/11/06 06:54:59 | 000,000,000 | ---D | M] (No name found) -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\extensions
[2011/10/09 06:18:39 | 000,002,399 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\askcom.xml
[2011/09/18 13:17:19 | 000,003,851 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\avg-secure-search.xml
[2011/08/26 15:56:57 | 000,002,294 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\babes-boardch.xml
[2011/08/20 07:51:15 | 000,000,930 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\filestubecom.xml
[2011/11/02 11:09:44 | 000,001,047 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\icqplugin.xml
[2011/08/20 07:54:16 | 000,001,330 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\wikipedia-en.xml
[2011/08/27 10:08:02 | 000,001,390 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\yahoo-zugo.xml
[2011/08/20 21:16:04 | 000,002,057 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\searchplugins\youtube-videosuche.xml
[2011/10/16 09:54:30 | 000,000,000 | ---D | M] (No name found) -- H:\Program Files (x86)\Mozilla Firefox\extensions
[2011/10/16 09:54:30 | 000,000,000 | ---D | M] (Java Console) -- H:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/08/21 04:10:47 | 000,000,000 | ---D | M] (Java Console) -- H:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/08/18 15:52:34 | 000,000,000 | ---D | M] (No name found) -- H:\Program Files (x86)\Mozilla Firefox\distribution\extensions
[2011/08/18 15:52:34 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- H:\Program Files (x86)\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File not found (No name found) -- 
() (No name found) -- H:\USERS\SIMON COOPER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\Q7SLW4GD.DEFAULT\EXTENSIONS\{DD05FD3D-18DF-4CE4-AE53-E795339C5F01}.XPI
[2011/10/26 09:21:16 | 000,134,104 | ---- | M] (Mozilla Foundation) -- H:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/08/21 04:10:38 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- H:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/07/11 16:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- H:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2011/10/26 09:21:13 | 000,001,392 | ---- | M] () -- H:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/10/26 09:21:13 | 000,002,252 | ---- | M] () -- H:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/10/26 09:21:13 | 000,001,153 | ---- | M] () -- H:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/08/21 04:08:47 | 000,002,048 | ---- | M] () -- H:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2011/10/26 09:21:13 | 000,006,805 | ---- | M] () -- H:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/10/26 09:21:13 | 000,001,178 | ---- | M] () -- H:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/10/26 09:21:13 | 000,001,105 | ---- | M] () -- H:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - H:\Windows\System32\drivers\etc\hosts
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\Simon_Cooper_ON_H\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] H:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [RtHDVCpl] H:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] H:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] H:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [Hotkey Utility] H:\Program Files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [Norton Online Backup] H:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation)
O4 - HKLM..\Run: [WinampAgent] H:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKU\LocalService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Simon_Cooper_ON_H..\Run: [avupdate] H:\Users\Simon Cooper\AppData\Roaming\mahmud.exe (Fujitsu, Inc.)
O4 - HKU\Simon_Cooper_ON_H..\Run: [DAEMON Tools Lite] H:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\Simon_Cooper_ON_H..\Run: [ICQ] H:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O4 - HKU\Simon_Cooper_ON_H..\Run: [Software Suite SE] H:\Program Files (x86)\Packard Bell\Software Suite SE\SoftSuiteSE.exe (Acer Incorporated)
O4 - HKU\LocalService_ON_H..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_H..\RunOnce: [mctadmin]  File not found
O4 - Startup: H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ()
O4 - Startup: H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\Simon_Cooper_ON_H\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - H:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - H:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - H:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{54a2a87b-e1e1-11e0-a8d5-001a4f48eaaf}\Shell - "" = AutoRun
O33 - MountPoints2\{54a2a87b-e1e1-11e0-a8d5-001a4f48eaaf}\Shell\AutoRun\command - "" = F:\SETUP.EXE /AUTORUN
O33 - MountPoints2\{54a2a87b-e1e1-11e0-a8d5-001a4f48eaaf}\Shell\configure\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{54a2a87b-e1e1-11e0-a8d5-001a4f48eaaf}\Shell\install\command - "" = F:\SETUP.EXE
O33 - MountPoints2\{6b41757a-c90e-11e0-855d-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{6b41757a-c90e-11e0-855d-806e6f6e6963}\Shell\AutoRun\command - "" = L:\pushinst.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Payne.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/11/09 11:46:12 | 000,000,000 | -HSD | C] -- H:\RECYCLER
[2011/11/08 13:13:11 | 000,195,584 | ---- | C] (Fujitsu, Inc.) -- H:\Users\Simon Cooper\AppData\Roaming\mahmud.exe
[2011/11/05 11:59:11 | 000,000,000 | ---D | C] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011/11/05 11:59:00 | 000,000,000 | ---D | C] -- H:\Program Files (x86)\Common Files\DESIGNER
[2011/10/29 07:19:29 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\Desktop\Temporär wichtige Dateien
[2011/10/29 06:54:28 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\Desktop\Fotos
[2011/10/29 06:53:48 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\Desktop\Games
[2011/10/26 10:53:02 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\Documents\ICQ
[2011/10/26 00:11:01 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\AppData\Local\{30242380-A9E4-4299-87A4-C5E8427AC512}
[2011/10/19 05:16:23 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\AppData\Roaming\Avira
[2011/10/19 05:16:06 | 000,000,000 | ---D | C] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011/10/19 05:15:56 | 000,130,760 | ---- | C] (Avira GmbH) -- H:\Windows\System32\drivers\avipbb.sys
[2011/10/19 05:15:56 | 000,097,312 | ---- | C] (Avira GmbH) -- H:\Windows\System32\drivers\avgntflt.sys
[2011/10/19 05:15:56 | 000,027,760 | ---- | C] (Avira GmbH) -- H:\Windows\System32\drivers\avkmgr.sys
[2011/10/19 05:15:56 | 000,000,000 | ---D | C] -- H:\ProgramData\Avira
[2011/10/19 05:15:56 | 000,000,000 | ---D | C] -- H:\Program Files (x86)\Avira
[2011/10/18 14:06:15 | 000,000,000 | ---D | C] -- H:\Program Files (x86)\Veetle
[2011/10/16 10:04:51 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\AppData\Roaming\OpenOffice.org
[2011/10/16 09:55:24 | 000,000,000 | --SD | C] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011/10/16 09:54:57 | 000,000,000 | ---D | C] -- H:\Program Files (x86)\OpenOffice.org 3
[2011/10/15 12:41:18 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SopCast
[2011/10/15 12:41:18 | 000,000,000 | ---D | C] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\SopCast
[2011/10/15 12:41:18 | 000,000,000 | ---D | C] -- H:\Program Files (x86)\SopCast
[2011/10/13 08:05:46 | 000,702,464 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\msfeeds.dll
[2011/10/13 08:05:46 | 000,599,552 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\msfeeds.dll
[2011/10/13 08:05:46 | 000,247,808 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\ieui.dll
[2011/10/13 08:05:46 | 000,176,640 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\ieui.dll
[2011/10/13 08:05:46 | 000,134,144 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\url.dll
[2011/10/13 08:05:46 | 000,132,096 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\url.dll
[2011/10/13 08:05:46 | 000,097,280 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\mshtmled.dll
[2011/10/13 08:05:46 | 000,067,072 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\mshtmled.dll
[2011/10/13 08:05:30 | 000,613,888 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\psisdecd.dll
[2011/10/13 08:05:30 | 000,465,408 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\psisdecd.dll
[2011/10/13 08:05:30 | 000,108,032 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\psisrndr.ax
[2011/10/13 08:05:30 | 000,075,776 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\psisrndr.ax
[2011/10/13 08:05:25 | 000,861,696 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\oleaut32.dll
[2011/10/13 08:05:25 | 000,331,776 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\oleacc.dll
[2011/10/11 07:25:26 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2011/10/11 07:25:08 | 000,000,000 | ---D | C] -- H:\Users\Simon Cooper\AppData\Roaming\Dropbox
 
========== Files - Modified Within 30 Days ==========
 
[2011/11/09 05:35:01 | 000,067,584 | --S- | M] () -- H:\Windows\bootstat.dat
[2011/11/09 05:33:36 | 1945,657,343 | -HS- | M] () -- H:\hiberfil.sys
[2011/11/08 14:23:26 | 000,016,752 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/11/08 14:23:26 | 000,016,752 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/11/08 14:20:15 | 000,653,928 | ---- | M] () -- H:\Windows\System32\perfh007.dat
[2011/11/08 14:20:15 | 000,615,810 | ---- | M] () -- H:\Windows\System32\perfh009.dat
[2011/11/08 14:20:15 | 000,129,800 | ---- | M] () -- H:\Windows\System32\perfc007.dat
[2011/11/08 14:20:15 | 000,106,190 | ---- | M] () -- H:\Windows\System32\perfc009.dat
[2011/11/08 13:13:11 | 000,195,584 | ---- | M] (Fujitsu, Inc.) -- H:\Users\Simon Cooper\AppData\Roaming\mahmud.exe
[2011/11/06 06:46:59 | 000,000,000 | R--D | M] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Packard Bell - Security & Support
[2011/11/06 06:46:26 | 000,000,000 | ---D | M] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2011/11/06 05:33:48 | 000,316,776 | ---- | M] () -- H:\Windows\System32\FNTCACHE.DAT
[2011/11/05 11:59:44 | 000,000,400 | ---- | M] () -- H:\Windows\ODBC.INI
[2011/11/05 11:59:11 | 000,000,000 | ---D | M] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011/10/30 06:53:04 | 000,000,393 | ---- | M] () -- H:\Users\Simon Cooper\Desktop\SERIEN1 298 (L) - Verknüpfung.lnk
[2011/10/29 07:03:31 | 000,000,897 | ---- | M] () -- H:\Users\Simon Cooper\Desktop\Downloads - Verknüpfung.lnk
[2011/10/29 07:01:26 | 000,000,646 | ---- | M] () -- H:\Users\Simon Cooper\Desktop\Musik - Verknüpfung.lnk
[2011/10/29 07:01:02 | 000,000,695 | ---- | M] () -- H:\Users\Simon Cooper\Desktop\Wrestling - Verknüpfung.lnk
[2011/10/29 07:00:35 | 000,000,681 | ---- | M] () -- H:\Users\Simon Cooper\Desktop\TV-Shows - Verknüpfung.lnk
[2011/10/19 05:16:06 | 000,000,000 | ---D | M] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011/10/16 10:05:13 | 000,001,247 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2011/10/16 09:55:47 | 000,000,000 | --SD | M] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011/10/16 09:55:29 | 000,001,124 | ---- | M] () -- H:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2011/10/15 12:41:21 | 000,000,000 | ---D | M] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\SopCast
[2011/10/14 06:14:18 | 000,002,441 | ---- | M] () -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/10/14 06:12:47 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- H:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/10/11 08:00:01 | 000,130,760 | ---- | M] (Avira GmbH) -- H:\Windows\System32\drivers\avipbb.sys
[2011/10/11 08:00:01 | 000,097,312 | ---- | M] (Avira GmbH) -- H:\Windows\System32\drivers\avgntflt.sys
[2011/10/11 08:00:01 | 000,027,760 | ---- | M] (Avira GmbH) -- H:\Windows\System32\drivers\avkmgr.sys
[2011/10/11 07:25:32 | 000,001,000 | ---- | M] () -- H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
 
========== Files Created - No Company Name ==========
 
[2011/11/05 11:59:44 | 000,000,400 | ---- | C] () -- H:\Windows\ODBC.INI
[2011/10/30 06:53:04 | 000,000,393 | ---- | C] () -- H:\Users\Simon Cooper\Desktop\SERIEN1 298 (L) - Verknüpfung.lnk
[2011/10/29 07:03:31 | 000,000,897 | ---- | C] () -- H:\Users\Simon Cooper\Desktop\Downloads - Verknüpfung.lnk
[2011/10/29 07:01:26 | 000,000,646 | ---- | C] () -- H:\Users\Simon Cooper\Desktop\Musik - Verknüpfung.lnk
[2011/10/29 07:01:02 | 000,000,695 | ---- | C] () -- H:\Users\Simon Cooper\Desktop\Wrestling - Verknüpfung.lnk
[2011/10/29 07:00:35 | 000,000,681 | ---- | C] () -- H:\Users\Simon Cooper\Desktop\TV-Shows - Verknüpfung.lnk
[2011/10/16 10:05:12 | 000,001,247 | ---- | C] () -- H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2011/10/16 09:55:28 | 000,001,124 | ---- | C] () -- H:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2011/10/11 07:25:32 | 000,001,000 | ---- | C] () -- H:\Users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/09/26 07:58:34 | 000,032,256 | ---- | C] () -- H:\Windows\SysWow64\AVSredirect.dll
[2011/09/26 07:57:08 | 000,107,520 | RHS- | C] () -- H:\Windows\SysWow64\TAKDSDecoder.dll
[2011/09/08 07:11:35 | 000,069,632 | R--- | C] () -- H:\Windows\SysWow64\xmltok.dll
[2011/09/08 07:11:35 | 000,036,864 | R--- | C] () -- H:\Windows\SysWow64\xmlparse.dll
[2011/08/27 09:36:34 | 000,175,616 | ---- | C] () -- H:\Windows\SysWow64\unrar.dll
[2011/08/27 09:36:33 | 000,000,038 | ---- | C] () -- H:\Windows\avisplitter.ini
[2011/08/27 09:36:32 | 000,650,752 | ---- | C] () -- H:\Windows\SysWow64\xvidcore.dll
[2011/08/27 09:36:32 | 000,243,200 | ---- | C] () -- H:\Windows\SysWow64\xvidvfw.dll
[2011/08/18 15:52:54 | 000,000,000 | ---- | C] () -- H:\Windows\nsreg.dat
[2010/11/20 22:24:49 | 000,252,928 | ---- | C] () -- H:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- H:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- H:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- H:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- H:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- H:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- H:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- H:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- H:\Windows\SysWow64\mlang.dat
[2005/12/21 05:36:46 | 000,009,728 | ---- | C] () -- H:\Windows\SysWow64\ff_vfw.dll
 
========== LOP Check ==========
 
[2011/08/17 16:27:16 | 000,000,000 | -HSD | M] -- H:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Application Data
[2011/10/03 15:20:44 | 000,000,000 | ---D | M] -- H:\ProgramData\clone.AD
[2011/09/18 13:14:59 | 000,000,000 | -H-D | M] -- H:\ProgramData\Common Files
[2011/09/18 13:06:53 | 000,000,000 | ---D | M] -- H:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Documents
[2011/08/17 16:27:16 | 000,000,000 | -HSD | M] -- H:\ProgramData\Dokumente
[2011/08/17 16:27:16 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favorites
[2011/09/12 05:20:42 | 000,000,000 | ---D | M] -- H:\ProgramData\ICQ
[2011/08/17 16:29:16 | 000,000,000 | ---D | M] -- H:\ProgramData\oem
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Start Menu
[2011/08/17 16:27:16 | 000,000,000 | -HSD | M] -- H:\ProgramData\Startmenü
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Templates
[2011/08/17 16:27:16 | 000,000,000 | -HSD | M] -- H:\ProgramData\Vorlagen
[2011/09/08 06:45:22 | 000,000,000 | ---D | M] -- H:\ProgramData\WildTangent
[2011/10/24 08:17:11 | 000,032,618 | ---- | M] () -- H:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
         

--- --- ---

auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

:OTL
O4 - HKU\Simon_Cooper_ON_H..\Run: [avupdate] H:\Users\Simon Cooper\AppData\Roaming\mahmud.exe (Fujitsu, Inc.)
:Files
H:\Users\Simon Cooper\AppData\Roaming\mahmud.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.

wenn du wieder normal starten kannst:

öffne computer, öffne h: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

Ok, ich kann wieder normal starten, scheinbar, ich schreibe diese Zeieln von meinem Problem-PC aus.
Trotzdem: Der PC startete, aber es wurde keine otl.txt geöffnet, als ich mich dann anmeldete; somit kann ich dieses Log auch nicht posten.

Im Upload-Channel habe ich aber die "MovedFiles" hochgeladen.
Danke soweit schon einmal!

na einmal hochladen hätts auch getan :-)
danke aber.
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Combofix Logfile:

ComboFix 11-11-08.02 - Simon Cooper 09.11.2011  16:11:59.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.7935.6326 [GMT 1:00]
ausgeführt von:: c:\users\Simon Cooper\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
G:\Autorun.inf
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-10-09 bis 2011-11-09  ))))))))))))))))))))))))))))))
.
.
2011-11-09 19:19 . 2011-07-13 02:55	2237440	----a-r-	C:\OTLPE.exe
2011-11-09 19:19 . 2011-11-09 13:29	--------	d-----w-	C:\_OTL
2011-11-09 15:15 . 2011-11-09 15:15	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-11-08 13:00 . 2011-10-07 04:16	8570192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{882C613D-2C5B-46DC-9239-4D95FBD4501B}\mpengine.dll
2011-10-26 08:53 . 2011-08-13 05:27	6144	----a-w-	c:\program files\Internet Explorer\iecompat.dll
2011-10-26 08:53 . 2011-08-13 04:18	6144	----a-w-	c:\program files (x86)\Internet Explorer\iecompat.dll
2011-10-21 17:39 . 2011-10-22 17:06	--------	d-sh--r-	c:\users\Simon Cooper\M-1-52-5782-8752-5245
2011-10-19 10:16 . 2011-10-19 10:16	--------	d-----w-	c:\users\Simon Cooper\AppData\Roaming\Avira
2011-10-19 10:15 . 2011-10-19 10:15	--------	d-----w-	c:\programdata\Avira
2011-10-19 10:15 . 2011-10-19 10:15	--------	d-----w-	c:\program files (x86)\Avira
2011-10-19 10:15 . 2011-10-11 13:00	97312	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-10-19 10:15 . 2011-10-11 13:00	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2011-10-19 10:15 . 2011-10-11 13:00	130760	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-10-18 19:06 . 2011-10-18 19:06	--------	d-----w-	c:\program files (x86)\Veetle
2011-10-16 15:04 . 2011-10-16 15:04	--------	d-----w-	c:\users\Simon Cooper\AppData\Roaming\OpenOffice.org
2011-10-16 14:54 . 2011-10-16 14:55	--------	d-----w-	c:\program files (x86)\OpenOffice.org 3
2011-10-16 14:54 . 2011-08-21 09:10	476904	----a-w-	c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-10-15 17:41 . 2011-10-15 17:41	--------	d-----w-	c:\program files (x86)\SopCast
2011-10-11 12:26 . 2011-11-09 13:25	--------	d-----r-	c:\users\Simon Cooper\Dropbox
2011-10-11 12:25 . 2011-11-09 13:25	--------	d-----w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-25 17:44 . 2011-08-31 09:46	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-10-25 17:44 . 2011-08-31 09:45	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-10-25 17:44 . 2011-09-20 16:48	1092400	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-10-14 11:12 . 2011-08-18 21:11	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-06 14:42 . 2011-08-31 09:45	1092400	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-09-20 16:48 . 2011-09-20 16:48	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-09-20 16:48 . 2011-09-20 16:48	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-09-18 18:07 . 2011-09-18 18:07	270912	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2011-08-25 10:58 . 2011-08-25 10:58	98304	----a-w-	c:\windows\SysWow64\CmdLineExt.dll
2011-08-21 09:10 . 2011-08-21 09:10	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2011-08-19 09:05 . 2010-06-24 09:33	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2006-05-03 10:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Software Suite SE"="c:\program files (x86)\Packard Bell\Software Suite SE\SoftSuiteSE.exe" [2009-09-29 2275360]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
"ICQ"="c:\program files (x86)\ICQ7.6\ICQ.exe" [2011-10-10 127040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Hotkey Utility"="c:\program files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe" [2011-01-19 620136]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-07-11 74752]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
c:\users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-9-2 24183152]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-28 497648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://de.ask.com/?l=dis&o=14597
mStart Page = hxxp://packardbell.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files (x86)\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\
FF - prefs.js: browser.search.defaulturl - Yahoo
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - bwf.weegel.de/index.php
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Bfeffd3a0-2656-481d-a3c2-32d9c52f465f%7D&mid=4ae5bae0d42047d1ac8ed15309ac035c-cdff593ce9d28e1406609187ba62c76c4080ad2b&ds=tg028&v=8.0.0.34.1&lang=en&pr=sa&d=2011-09-18%2020%3A15%3A13&sap=ku&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-avupdate - c:\users\Simon Cooper\AppData\Roaming\mahmud.exe
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\avmwlanstick\WlanNetService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-11-09  16:21:59 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-11-09 15:21
.
Vor Suchlauf: 7 Verzeichnis(se), 101.525.905.408 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 101.267.951.616 Bytes frei
.
- - End Of File - - CAFEFFA6334AA940A15229812EF49D94
         

--- --- ---


Ok, das hat auch gut funktioniert. Danke auch soweit!

Ich weiss jetzt nicht ob dies die richtige Log-File ist; konnte die datei nicht auf dem Desktop speichern nach dem Scan, musste dann neustarten und jetzt habe ich keinen Überblick, wo und als was der neue Scan abgespeichert ist. Sorry.

Combofix Logfile:

ComboFix 11-11-08.02 - Simon Cooper 09.11.2011  17:23:39.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.7935.6728 [GMT 1:00]
ausgeführt von:: c:\users\Simon Cooper\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Simon Cooper\Desktop\cfscript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-10-09 bis 2011-11-09  ))))))))))))))))))))))))))))))
.
.
2011-11-09 19:19 . 2011-07-13 02:55	2237440	----a-r-	C:\OTLPE.exe
2011-11-09 19:19 . 2011-11-09 13:29	--------	d-----w-	C:\_OTL
2011-11-09 16:31 . 2011-11-09 16:31	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{882C613D-2C5B-46DC-9239-4D95FBD4501B}\offreg.dll
2011-11-09 16:27 . 2011-11-09 16:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-11-08 13:00 . 2011-10-07 04:16	8570192	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{882C613D-2C5B-46DC-9239-4D95FBD4501B}\mpengine.dll
2011-10-26 08:53 . 2011-08-13 05:27	6144	----a-w-	c:\program files\Internet Explorer\iecompat.dll
2011-10-26 08:53 . 2011-08-13 04:18	6144	----a-w-	c:\program files (x86)\Internet Explorer\iecompat.dll
2011-10-21 17:39 . 2011-10-22 17:06	--------	d-sh--r-	c:\users\Simon Cooper\M-1-52-5782-8752-5245
2011-10-19 10:16 . 2011-10-19 10:16	--------	d-----w-	c:\users\Simon Cooper\AppData\Roaming\Avira
2011-10-19 10:15 . 2011-10-19 10:15	--------	d-----w-	c:\programdata\Avira
2011-10-19 10:15 . 2011-10-19 10:15	--------	d-----w-	c:\program files (x86)\Avira
2011-10-19 10:15 . 2011-10-11 13:00	97312	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-10-19 10:15 . 2011-10-11 13:00	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2011-10-19 10:15 . 2011-10-11 13:00	130760	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-10-18 19:06 . 2011-10-18 19:06	--------	d-----w-	c:\program files (x86)\Veetle
2011-10-16 15:04 . 2011-10-16 15:04	--------	d-----w-	c:\users\Simon Cooper\AppData\Roaming\OpenOffice.org
2011-10-16 14:54 . 2011-10-16 14:55	--------	d-----w-	c:\program files (x86)\OpenOffice.org 3
2011-10-16 14:54 . 2011-08-21 09:10	476904	----a-w-	c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-10-15 17:41 . 2011-10-15 17:41	--------	d-----w-	c:\program files (x86)\SopCast
2011-10-11 12:26 . 2011-11-09 15:25	--------	d-----r-	c:\users\Simon Cooper\Dropbox
2011-10-11 12:25 . 2011-11-09 15:25	--------	d-----w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-25 17:44 . 2011-08-31 09:46	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-10-25 17:44 . 2011-08-31 09:45	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-10-25 17:44 . 2011-09-20 16:48	1092400	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-10-14 11:12 . 2011-08-18 21:11	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-06 14:42 . 2011-08-31 09:45	1092400	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-09-20 16:48 . 2011-09-20 16:48	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-09-20 16:48 . 2011-09-20 16:48	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-09-18 18:07 . 2011-09-18 18:07	270912	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2011-08-25 10:58 . 2011-08-25 10:58	98304	----a-w-	c:\windows\SysWow64\CmdLineExt.dll
2011-08-21 09:10 . 2011-08-21 09:10	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2011-08-19 09:05 . 2010-06-24 09:33	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2006-05-03 10:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-11-09_15.18.24   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-21 03:09 . 2011-11-09 15:26	42568              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-11-09 13:26	43098              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-11-09 15:26	43098              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2011-08-17 21:38 . 2011-11-09 15:05	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-08-17 21:38 . 2011-11-09 16:13	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-08-17 21:38 . 2011-11-09 15:05	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-08-17 21:38 . 2011-11-09 16:13	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-08-17 21:29 . 2011-11-09 15:26	9628              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3866350951-2587707577-199896270-1000_UserData.bin
- 2011-11-09 15:17 . 2011-11-09 15:17	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-11-09 16:28 . 2011-11-09 16:28	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-11-09 15:17 . 2011-11-09 15:17	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-11-09 16:28 . 2011-11-09 16:28	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 02:36 . 2011-11-09 16:33	615810              c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2011-11-09 13:31	615810              c:\windows\system32\perfh009.dat
+ 2011-04-18 18:59 . 2011-11-09 16:33	653928              c:\windows\system32\perfh007.dat
- 2011-04-18 18:59 . 2011-11-09 13:31	653928              c:\windows\system32\perfh007.dat
- 2009-07-14 02:36 . 2011-11-09 13:31	106190              c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2011-11-09 16:33	106190              c:\windows\system32\perfc009.dat
+ 2011-04-18 18:59 . 2011-11-09 16:33	129800              c:\windows\system32\perfc007.dat
- 2011-04-18 18:59 . 2011-11-09 13:31	129800              c:\windows\system32\perfc007.dat
- 2009-07-14 05:01 . 2011-11-09 15:15	303284              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-11-09 16:27	303284              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-08-19 02:30 . 2011-11-09 16:27	7532260              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3866350951-2587707577-199896270-1000-8192.dat
- 2011-08-19 02:30 . 2011-11-09 15:15	7532260              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3866350951-2587707577-199896270-1000-8192.dat
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Software Suite SE"="c:\program files (x86)\Packard Bell\Software Suite SE\SoftSuiteSE.exe" [2009-09-29 2275360]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-08-02 4910912]
"ICQ"="c:\program files (x86)\ICQ7.6\ICQ.exe" [2011-10-10 127040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Hotkey Utility"="c:\program files (x86)\Packard Bell\Hotkey Utility\HotkeyUtility.exe" [2011-01-19 620136]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-07-11 74752]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
c:\users\Simon Cooper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-9-2 24183152]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\Simon Cooper\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-28 497648]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://de.ask.com/?l=dis&o=14597
mStart Page = hxxp://packardbell.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files (x86)\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Simon Cooper\AppData\Roaming\Mozilla\Firefox\Profiles\q7slw4gd.default\
FF - prefs.js: browser.search.defaulturl - Yahoo
FF - prefs.js: browser.search.selectedEngine - FilesTube.com
FF - prefs.js: browser.startup.homepage - bwf.weegel.de/index.php
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Bfeffd3a0-2656-481d-a3c2-32d9c52f465f%7D&mid=4ae5bae0d42047d1ac8ed15309ac035c-cdff593ce9d28e1406609187ba62c76c4080ad2b&ds=tg028&v=8.0.0.34.1&lang=en&pr=sa&d=2011-09-18%2020%3A15%3A13&sap=ku&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\avmwlanstick\WlanNetService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-11-09  17:38:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-11-09 16:38
ComboFix2.txt  2011-11-09 15:22
.
Vor Suchlauf: 11 Verzeichnis(se), 104.559.947.776 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 104.442.683.392 Bytes frei
.
- - End Of File - - EC7B302F54746BC7E734F140BF316923
         

--- --- ---

start programme zubehör editor reinkopieren:

killall::
Rootkit::
Folder::
c:\users\Simon Cooper\M-1-52-5782-8752-5245c:\users\Simon Cooper\M-1-52-5782-8752-5245

datei speichern unter, ort, dort wo sich combofix.exe befindet
dateityp, alle dateien.
name,
cfscript.txt
deaktiviere alle laufenden programme, auch die im systray neben der uhr, mit rechtsklick deaktivieren bzw beenden
ziehe cfscript.txt auf combofix, programm startet log posten

öffne mal computer, c: qoobox, rechtsklick quarantain, mit winrar oder zip oder anderem packer packen und nach anleitung hochladen.
http://www.trojaner-board.de/54791-a...ner-board.html

hi, danke für den upload

lade den CCleaner standard:
CCleaner Download - CCleaner 3.12.1572
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.