Hallo zusammen,
auch mich scheints erwischt zu haben, in windows erscheint dieses lustige "Fenster", dass mein Computer geperrt sei und ich doch bitte 100€ überweisen möge....

Wenn ihr (auch) mir helfen könntet, wäre das grandios (Hut ab vor eurem Engagement!).

Ich hab OTL bereits drüber laufen lassen....

OTL.txt

OTL logfile created on: 13.03.2012 19:20:07 - Run 1
OTL by OldTimer - Version 3.2.36.3     Folder = C:\Users\Sebastian Musli\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 46,12% Memory free
4,23 Gb Paging File | 3,23 Gb Available in Paging File | 76,39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 16,41 Gb Free Space | 23,52% Space Free | Partition Type: NTFS
Drive D: | 149,05 Gb Total Space | 47,25 Gb Free Space | 31,70% Space Free | Partition Type: NTFS
Drive E: | 69,52 Gb Total Space | 11,89 Gb Free Space | 17,10% Space Free | Partition Type: NTFS
 
Computer Name: SEBASTIAN | User Name: Sebastian Musli | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.13 19:19:33 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian Musli\Desktop\OTL.exe
PRC - [2012.02.21 15:54:59 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.02.16 09:33:30 | 000,492,496 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avscan.exe
PRC - [2011.10.11 13:59:36 | 000,306,128 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avcenter.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.31 06:40:21 | 001,079,176 | ---- | M] (PC Tools) -- C:\Programme\Spyware Doctor\pctsSvc.exe
PRC - [2008.06.13 14:29:14 | 000,356,920 | ---- | M] (PC Tools) -- C:\Programme\Spyware Doctor\pctsAuxs.exe
PRC - [2008.01.19 08:38:32 | 000,319,544 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2007.06.26 20:27:46 | 000,312,320 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.03.13 08:39:20 | 008,527,520 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2012.02.21 15:54:59 | 001,911,768 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.10.11 13:59:51 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2007.09.20 17:34:58 | 000,129,024 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand | Stopped] --  -- (KiesAllShare)
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2012.01.16 09:02:30 | 000,198,136 | ---- | M] (Nitro PDF Software) [Auto | Stopped] -- C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService2.exe -- (NitroReaderDriverReadSpool2)
SRV - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.06.04 10:05:44 | 000,217,088 | ---- | M] (Teruten) [Auto | Stopped] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2010.06.04 10:02:32 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Stopped] -- C:\Windows\System32\dgdersvc.exe -- (dgdersvc)
SRV - [2009.11.30 16:34:28 | 000,723,632 | ---- | M] (COMODO) [Auto | Stopped] -- C:\Program Files\COMODO\Firewall\cmdagent.exe -- (cmdAgent)
SRV - [2008.11.11 08:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.10.31 06:40:21 | 001,079,176 | ---- | M] (PC Tools) [Auto | Running] -- C:\Programme\Spyware Doctor\pctsSvc.exe -- (sdCoreService)
SRV - [2008.06.13 14:29:14 | 000,356,920 | ---- | M] (PC Tools) [Auto | Running] -- C:\Programme\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.09.14 14:32:46 | 000,167,936 | ---- | M] (acer) [Auto | Stopped] -- C:\Acer\Empowering Technology\ePower\ePowerSvc.exe -- (WMIService)
SRV - [2007.09.04 10:14:34 | 000,087,344 | ---- | M] (AVM Berlin) [Auto | Stopped] -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)
SRV - [2007.07.24 10:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007.05.22 14:00:02 | 000,135,168 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eNet\eNet Service.exe -- (eNet Service)
SRV - [2007.05.10 13:05:36 | 000,024,576 | ---- | M] () [Auto | Stopped] -- C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe -- (eSettingsService)
SRV - [2007.04.25 15:34:30 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Stopped] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007.03.21 12:00:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007.03.14 09:52:30 | 000,024,576 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe -- (eLockService)
SRV - [2007.02.13 05:26:50 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Stopped] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2007.01.26 13:24:42 | 000,050,688 | ---- | M] () [Auto | Stopped] -- C:\Acer\ALaunch\ALaunchSvc.exe -- (ALaunchService)
SRV - [2006.11.24 11:57:54 | 000,107,008 | ---- | M] () [Auto | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService)
SRV - [2006.01.17 00:05:20 | 001,527,895 | ---- | M] (The Firebird Project) [On_Demand | Stopped] -- C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe -- (FirebirdServerDefaultInstance)
SRV - [2006.01.17 00:05:20 | 000,065,536 | ---- | M] (The Firebird Project) [Auto | Stopped] -- C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (NwlnkFlt)
DRV - File not found [File_System | Boot | Stopped] --  -- (Lbd)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (igfx)
DRV - File not found [Kernel | System | Stopped] --  -- (DritekPortIO)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (axg6j1i9)
DRV - [2012.02.16 09:33:31 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.10.11 14:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 14:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.06.04 10:05:44 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2010.06.04 10:02:32 | 000,018,136 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - [2010.04.27 03:25:20 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscemdm.sys -- (sscemdm)
DRV - [2010.04.27 03:25:20 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscebus.sys -- (sscebus) SAMSUNG USB Composite Device V2 driver (WDM)
DRV - [2010.04.27 03:25:20 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscemdfl.sys -- (sscemdfl)
DRV - [2009.11.30 16:35:12 | 000,074,328 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (Inspect)
DRV - [2009.11.30 16:34:47 | 000,029,520 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2009.11.30 16:34:46 | 000,128,376 | ---- | M] (COMODO) [File_System | System | Stopped] -- C:\Windows\System32\drivers\cmdguard.sys -- (cmdGuard)
DRV - [2008.10.31 06:40:10 | 000,081,288 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksyssec.sys -- (IKSysSec)
DRV - [2008.10.31 06:40:09 | 000,066,952 | ---- | M] (PCTools Research Pty Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\iksysflt.sys -- (IKSysFlt)
DRV - [2008.10.31 06:40:09 | 000,040,840 | ---- | M] (PCTools Research Pty Ltd.) [File_System | Boot | Running] -- C:\Windows\system32\drivers\ikfilesec.sys -- (IKFileSec)
DRV - [2008.08.26 08:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2008.06.22 13:32:38 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2007.08.21 09:13:03 | 000,024,064 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2007.08.08 01:26:06 | 002,226,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007.07.26 17:25:46 | 000,974,248 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonC07.sys -- (Cam5607)
DRV - [2007.03.21 21:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.03.07 09:26:50 | 000,032,256 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2007.02.24 13:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.01.30 06:23:30 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007.01.23 15:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006.12.07 17:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006.11.02 08:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/sm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLA_de
IE - HKCU\..\SearchScopes\{8A669DFB-346E-4DBF-97AF-1671D41B3FE0}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: bettergmail2@ginatrapani.org:1.2
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6
FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:5.0.3
FF - prefs.js..extensions.enabledItems: {64161300-e22b-11db-8314-0800200c9a66}:0.9.5.8
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.5
FF - prefs.js..extensions.enabledItems: {1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}:2.12.21.1
FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.91
FF - prefs.js..extensions.enabledItems: {8a39fe10-f553-11dd-87af-0800200c9a66}:1.3
FF - prefs.js..extensions.enabledItems: {13b4437e-b706-11dc-8314-0800200c9a66}:1.36.20100916
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "10.1.0.0."
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.http: "10.1.0.0."
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "10.1.0.0."
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "10.1.0.0."
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 4
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files\Nitro PDF\Reader\npnitromozilla.dll ( )
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.69: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.03.30 14:02:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.08.13 14:20:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.08.13 14:20:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.21 15:54:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.10 19:37:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.11.10 19:37:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.11.10 19:37:15 | 000,000,000 | ---D | M]
 
[2010.08.21 14:00:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Extensions
[2010.08.21 14:00:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.02.02 21:52:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Firefox\Profiles\lkfrbw62.default\extensions
[2012.01.05 15:24:28 | 000,000,000 | ---D | M] (IE Tab 2 (FF 3.6+)) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Firefox\Profiles\lkfrbw62.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2011.12.28 11:15:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Firefox\Profiles\lkfrbw62.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.04.07 17:05:31 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Firefox\Profiles\lkfrbw62.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(135)
[2011.04.14 07:16:45 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Firefox\Profiles\lkfrbw62.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}(136)
[2011.04.27 09:58:32 | 000,000,000 | ---D | M] (SearchPreview) -- C:\Users\Sebastian Musli\AppData\Roaming\mozilla\Firefox\Profiles\lkfrbw62.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}(137)
[2012.03.11 13:19:53 | 000,000,950 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-1.xml
[2009.11.07 08:46:36 | 000,000,961 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-2.xml
[2009.12.17 07:16:53 | 000,000,961 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-3.xml
[2010.01.07 18:18:55 | 000,000,961 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-4.xml
[2010.02.19 06:28:07 | 000,000,961 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-5.xml
[2010.03.12 22:17:12 | 000,000,950 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-6.xml
[2010.03.24 15:09:02 | 000,000,950 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-7.xml
[2010.04.07 22:39:41 | 000,000,950 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-8.xml
[2010.06.25 05:31:53 | 000,000,950 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin-9.xml
[2010.05.12 17:40:48 | 000,001,042 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\searchplugins\icqplugin.xml
[2011.11.11 19:15:39 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.09.17 17:58:04 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
() (No name found) -- C:\USERS\SEBASTIAN MUSLI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LKFRBW62.DEFAULT\EXTENSIONS\{64161300-E22B-11DB-8314-0800200C9A66}.XPI
() (No name found) -- C:\USERS\SEBASTIAN MUSLI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\LKFRBW62.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2012.02.21 15:54:59 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008.01.23 07:20:30 | 000,491,520 | ---- | M] (BitComet) -- C:\Program Files\mozilla firefox\plugins\npBitCometAgent.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.04 18:27:12 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.04 18:27:12 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.04 18:27:12 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.04 18:27:12 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.04 18:27:12 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.04 18:27:12 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BisonInst0402] C:\Windows\BR040286.exe (Bison Inc.)
O4 - HKLM..\Run: [COMODO Firewall Pro] C:\Program Files\COMODO\Firewall\cfp.exe (COMODO)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\Firewall\cfp.exe (COMODO)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe (HiTRUST)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe File not found
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe File not found
O4 - HKLM..\Run: [ISTray] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd File not found
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [EconNSoft Core Cleaner] C:\Windows\System32\ECS_CoreCleaner.exe (EconNSoft)
O4 - HKCU..\Run: [vasja] C:\Users\Sebastian Musli\AppData\Local\Temp\mor.exe (Hauppauge Computer Works Inc)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1103471 -"Mozilla/5.0 (Windows NT 6.0; rv:9.0.1) Gecko/20100101 Firefox/9.0.1" -"hxxp://www.chemgapedia.de/vsengine/vlu/vsc/de/ch/13/vlu/spektroskopie/anwendung/uvvis.vlu/Page/vsc/de/ch/13/pc/spektroskopie/spektrometer/komponenten/virspek.vscml.html" File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CAF7B27-1CEB-4240-A0F8-5EB0E842DB4F}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) -  File not found
O24 - Desktop WallPaper: C:\Users\Sebastian Musli\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sebastian Musli\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0e0ee906-1e19-11e0-adda-001cbf18cebc}\Shell - "" = AutoRun
O33 - MountPoints2\{0e0ee906-1e19-11e0-adda-001cbf18cebc}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\{222c26c3-f902-11dd-8e2f-001cbf18cebc}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{45f59f97-ea4c-11de-84ef-001cbf18cebc}\Shell\AutoRun\command - "" = H:\
O33 - MountPoints2\{45f59f97-ea4c-11de-84ef-001cbf18cebc}\Shell\open\Command - "" = rundll32.exe .\desktop.dll,InstallM
O33 - MountPoints2\{7ca926b1-fc8f-11de-9af4-d420dc1541e9}\Shell - "" = AutoRun
O33 - MountPoints2\{7ca926b1-fc8f-11de-9af4-d420dc1541e9}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\{83eae06b-3289-11df-8510-001cbf18cebc}\Shell - "" = AutoRun
O33 - MountPoints2\{83eae06b-3289-11df-8510-001cbf18cebc}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O33 - MountPoints2\{9c5ea045-1ea1-11de-91bf-001cbf18cebc}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{cf2a38c8-ada6-11de-b224-001cbf18cebc}\Shell - "" = AutoRun
O33 - MountPoints2\{cf2a38c8-ada6-11de-b224-001cbf18cebc}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.13 19:19:28 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Users\Sebastian Musli\Desktop\OTL.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.13 19:19:33 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian Musli\Desktop\OTL.exe
[2012.03.13 19:01:23 | 000,620,966 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.13 19:01:23 | 000,589,472 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.13 19:01:23 | 000,123,074 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.13 19:01:23 | 000,101,484 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.13 18:55:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.13 18:50:10 | 000,002,032 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Local\d3d9caps.dat
[2012.03.13 18:31:47 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.03.13 09:43:00 | 000,000,474 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2012.03.13 08:39:20 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.03.06 20:58:46 | 000,056,832 | ---- | M] () -- C:\Users\Sebastian Musli\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.03.05 19:52:14 | 013,008,896 | ---- | M] () -- C:\Users\Sebastian Musli\Desktop\Dr. Oetker Werbung - Früher war alles besser!.mpg
[2012.03.01 09:34:00 | 000,416,394 | ---- | M] () -- C:\Users\Sebastian Musli\Desktop\infos chemieolympiade.pdf
[2012.02.29 22:05:39 | 000,000,584 | ---- | M] () -- C:\Users\Sebastian Musli\Documents\grstyles.stl
[2012.02.25 22:17:26 | 000,002,620 | -HS- | M] () -- C:\ProgramData\KGyGaAvL.sys
[2012.02.16 09:33:31 | 000,137,416 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
 
========== Files Created - No Company Name ==========
 
[2012.03.05 19:51:37 | 013,008,896 | ---- | C] () -- C:\Users\Sebastian Musli\Desktop\Dr. Oetker Werbung - Früher war alles besser!.mpg
[2012.03.01 09:34:19 | 000,416,394 | ---- | C] () -- C:\Users\Sebastian Musli\Desktop\infos chemieolympiade.pdf
[2012.02.01 10:48:08 | 000,037,489 | ---- | C] () -- C:\Users\Sebastian Musli\AppData\Roaming\Kommagetrennte Werte (DOS).ADR
[2012.02.01 10:42:11 | 000,037,063 | ---- | C] () -- C:\Users\Sebastian Musli\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2011.07.18 16:43:11 | 000,000,552 | ---- | C] () -- C:\Users\Sebastian Musli\AppData\Local\d3d8caps.dat
[2011.02.26 18:54:36 | 000,000,537 | ---- | C] () -- C:\Windows\wiso.ini
[2011.02.19 12:54:34 | 000,216,209 | ---- | C] () -- C:\Windows\ClipNavigator Uninstaller.exe
[2010.06.14 17:43:33 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2010.06.14 17:43:33 | 000,036,640 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2010.06.04 10:04:18 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2010.06.04 10:04:18 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2010.06.04 10:04:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2010.06.04 10:04:18 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:B203B914
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 102 bytes -> C:\ProgramData\TEMP:30A9E86A

< End of report >
         

extra.txt

OTL Extras logfile created on: 13.03.2012 19:20:07 - Run 1
OTL by OldTimer - Version 3.2.36.3     Folder = C:\Users\Sebastian Musli\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,92 Gb Available Physical Memory | 46,12% Memory free
4,23 Gb Paging File | 3,23 Gb Available in Paging File | 76,39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69,77 Gb Total Space | 16,41 Gb Free Space | 23,52% Space Free | Partition Type: NTFS
Drive D: | 149,05 Gb Total Space | 47,25 Gb Free Space | 31,70% Space Free | Partition Type: NTFS
Drive E: | 69,52 Gb Total Space | 11,89 Gb Free Space | 17,10% Space Free | Partition Type: NTFS
 
Computer Name: SEBASTIAN | User Name: Sebastian Musli | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03984FC5-2732-41B9-B427-A2F1C5A4F3A2}" = lport=445 | protocol=6 | dir=in | app=system | 
"{3B83F40E-EC6C-42E3-B634-7E2D47169234}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{4F8F9FE4-C3E5-406E-A858-53E5D66BE7BA}" = rport=445 | protocol=6 | dir=out | app=system | 
"{650E3E66-6805-43DA-AE14-836F3D5B5D96}" = rport=139 | protocol=6 | dir=out | app=system | 
"{6BEEBC2B-1D36-470B-9CDC-0593F60BE0AD}" = lport=137 | protocol=17 | dir=in | app=system | 
"{9AA54AFB-B573-4CB7-BAAD-DD15D396663E}" = lport=139 | protocol=6 | dir=in | app=system | 
"{C4C6BD7B-E531-4C83-A74D-8A1839047461}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{CDA82AAF-727B-4E05-B6E5-BAD79486893E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{E5866941-8013-4AFD-A94C-46A5C08C33A2}" = rport=137 | protocol=17 | dir=out | app=system | 
"{E96353EB-F63F-463A-AF69-ADEBC8D495CC}" = rport=138 | protocol=17 | dir=out | app=system | 
"{FF897B61-7FEA-4E9A-85D4-28E21CFA8FC4}" = lport=138 | protocol=17 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0F7E8A4B-8FD4-4F6F-BAE1-84241C35AF9B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{12872981-2B6C-42B6-A7E8-EBC4DD2A1DE0}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{3934288E-FB9D-4F29-8622-57454A659E26}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{52FA9CA6-234E-45DF-8EE9-E7465FBD017B}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe | 
"{59097B85-DFB1-4E6C-B01A-D8B0D41F421A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5E971B69-10BC-4673-AE62-F9489DABA843}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{5F8648DE-7782-4CEA-AA0E-DFE6045356D1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{615FC954-DD46-4410-9168-8876C12E93F8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{692EB110-DF40-4182-8427-AF77A220D133}" = protocol=17 | dir=in | app=c:\program files\smartftp client\smartftp.exe | 
"{7170D9F5-4EF0-4FD7-BF6D-16630621BB8B}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe | 
"{717B5FA9-53C3-41A5-B7CE-B2078F5E3C78}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{789378D8-128A-43A8-93AC-FF68C62DE914}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{7CC94BD2-409C-487C-B9A8-55531D71B458}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe | 
"{7DAEBBC9-37C6-4031-B524-76A3964B3D2D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{871696A5-32C3-440D-8E3E-6885902DF7ED}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{888BC280-2BFE-43F2-A65F-55DF2582F316}" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\devicesetup.exe | 
"{8D1006FF-8679-4ADB-AA7D-E3EEADBA6764}" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe | 
"{8DF7F60C-2AF0-429F-A3AA-32B58F116E71}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{908F56B3-540A-4AE4-9333-D220BBA44946}" = protocol=6 | dir=in | app=c:\users\sebastian musli\appdata\roaming\dropbox\bin\dropbox.exe | 
"{92AD9A8C-C502-4E7D-93E5-33EF472211E2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{A43D6BEE-2EF8-453C-BECA-2E79C62829FD}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | 
"{AABE1EEB-BE11-46CE-BC3A-23AD34D594FC}" = protocol=17 | dir=in | app=c:\users\sebastian musli\appdata\roaming\dropbox\bin\dropbox.exe | 
"{AC5E1C91-8D65-437C-9CAF-28ED2D213DC6}" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{AC7CACED-2068-4D86-9E86-EEC361171613}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{ADA66B41-2100-4196-B4D4-375985BD8FAF}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe | 
"{B3941C97-1BD8-405D-AF0C-7FAD01A45186}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe | 
"{BE6267D2-6D17-46D5-8340-B7A8C167F020}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"{C3892F26-04CE-4C07-8E2B-0697ED76E563}" = protocol=6 | dir=in | app=c:\program files\smartftp client\smartftp.exe | 
"{CCDF639F-A07E-47C4-B3E6-F6F7D455CF8A}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | 
"{D5BB9CC0-8254-43A4-83E9-0A6A77A8E54D}" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"{DBABD4BF-457D-4398-9DC9-5C5AAA6BF128}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{DF888AB6-131B-41DC-8C33-49BA949870B6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{DFB92D98-4679-46B6-9C87-500DA34C1E1B}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe | 
"{FEDF86F8-1C9F-4D1D-9B14-B8BB1D0B3433}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"TCP Query User{02835294-833A-46A4-9330-1E99E1BECBA9}C:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe" = protocol=6 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe | 
"TCP Query User{175F40E8-E726-4338-A82F-4E6E21B73F46}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | 
"TCP Query User{1E02810F-447C-4C13-9BCF-E8EE1FCFEEE3}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{2A294CFB-1358-4E21-9143-C0D1C31E06DB}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe | 
"TCP Query User{2EC969AA-C6ED-4647-B684-1386236631FF}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{313E310C-74D9-4AD2-845E-F3A17809BB6F}C:\program files\einstruction\device manager\launch.exe" = protocol=6 | dir=in | app=c:\program files\einstruction\device manager\launch.exe | 
"TCP Query User{33553B75-89F3-46DE-B754-5CC235D7E743}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{4CFE1B70-579D-4080-B52D-F53A21DC2FA2}C:\program files\ihmc cmaptools\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\ihmc cmaptools\jre\bin\javaw.exe | 
"TCP Query User{66FDFAB9-497A-4E54-B55D-A9F9247E8108}C:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe" = protocol=6 | dir=in | app=c:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe | 
"TCP Query User{76F64A82-9527-4432-9A00-23A088D075EF}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
"TCP Query User{7D15BE82-A81F-4776-83FC-8F521AA6888F}C:\program files\real\realplayer\recordingmanager.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe | 
"TCP Query User{8276D837-88B0-4990-A13D-B8534A700CE4}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"TCP Query User{8EEBCC57-68FE-4D8D-85EC-B49BFDD5B30C}C:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe" = protocol=6 | dir=in | app=c:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe | 
"TCP Query User{A6AA6E45-47E0-490A-B1A5-3C2EDA917880}C:\program files\quicktime\quicktimeplayer.exe" = protocol=6 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe | 
"TCP Query User{AA58E981-E999-4CE3-BD28-7E59902AC44F}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"TCP Query User{AAB0DF80-6B55-414C-A29C-2823439166CB}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{B70A7B4B-8F44-4B97-80F6-4C8D83AE6A0F}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"TCP Query User{C6FE38E4-7A4A-496D-BB5D-1F2D00D3E373}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
"TCP Query User{DB48E361-B479-486A-BB31-1E5D3DA55B1B}C:\program files\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe | 
"TCP Query User{EF0D7595-80C6-4C03-9171-A0D727F9C5FE}C:\program files\einstruction\device manager\launch.exe" = protocol=6 | dir=in | app=c:\program files\einstruction\device manager\launch.exe | 
"UDP Query User{02E577CF-4E1A-4333-8791-81A1F1FA182A}C:\program files\ihmc cmaptools\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\ihmc cmaptools\jre\bin\javaw.exe | 
"UDP Query User{0307256F-AC19-4660-B286-4354ACDA6B53}C:\program files\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe | 
"UDP Query User{092A19DC-62C6-4DA3-8E77-0523984244B1}C:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe" = protocol=17 | dir=in | app=c:\program files\hp\hp officejet pro 8500 a910\bin\hpnetworkcommunicator.exe | 
"UDP Query User{0D923362-D41A-49DA-882D-7BE7F446E5E6}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"UDP Query User{0ECF3DD2-EF78-4022-A88B-0A44F75C7805}C:\program files\einstruction\device manager\launch.exe" = protocol=17 | dir=in | app=c:\program files\einstruction\device manager\launch.exe | 
"UDP Query User{10767EE4-A731-46D4-BFA1-391C22A607E9}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
"UDP Query User{118A2280-8514-414F-A7D7-96F917939CC1}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{124F839C-B59B-4B94-BB83-CDC30BD63F63}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{13B3C713-1130-423C-986F-D6403DA8BBF3}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{25163852-29A9-44C5-8E2F-B8A06FDD509F}C:\program files\real\realplayer\recordingmanager.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe | 
"UDP Query User{289EAE50-13FD-417D-AF06-ABD270EF2544}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe | 
"UDP Query User{473FF73C-AF09-43F3-9760-0C57442AFAAA}C:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe" = protocol=17 | dir=in | app=c:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe | 
"UDP Query User{495A3ED9-3459-4397-9082-D12D2BB4C21C}C:\program files\quicktime\quicktimeplayer.exe" = protocol=17 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe | 
"UDP Query User{4AD0CD48-5CE3-4103-9505-06711A574DB8}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | 
"UDP Query User{793DDF0E-4A66-44E5-A6C0-A7FD3F5E3F37}C:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe" = protocol=17 | dir=in | app=c:\program files\chemie\ak kappenberg\ak winchemie.net\akwc_starter.exe | 
"UDP Query User{9F5AF21C-3190-4E6E-8CEF-8F766157338C}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{DDAE9193-085F-4279-B887-F8AE928DAE57}C:\program files\einstruction\device manager\launch.exe" = protocol=17 | dir=in | app=c:\program files\einstruction\device manager\launch.exe | 
"UDP Query User{DEC39C82-B7A6-4272-BB41-1AF4581B439E}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{E5D6C557-DD41-4712-8387-6F5BCC32C29B}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 
"UDP Query User{E790C455-6E34-4C14-BF6E-220012AC2109}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW(R) Graphics Suite X4
"_{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{084EB034-BB42-4457-9536-2706915B95D0}_is1" = Spekwin32 v1.71.6 (deutsche Version)
"{0ACD2002-E0FF-4B65-8E8B-EEE7527B35C4}" = AK Wandlertreiber - ALL-CHEM-MISST
"{0C9D0858-4CFD-4AA4-8863-EC6CD8EDFBDD}" = Elemente Chemie Arbeitsblätter 1
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{1A39EA92-E934-4839-B079-0B4277153EC2}" = Rund um (2.0) ... Chemie heute SI - Kontext
"{1CAC7A41-583B-4483-9FA5-3E5465AFF8C2}" = Microsoft Default Manager
"{1E0DFD76-7952-4930-8965-1C4C8FA8AC81}" = AK Wandlertreiber - AK LowCost Fotometer 04
"{1E1F9A26-5EFF-40F1-9393-61C520821939}" = AK Wandlertreiber - CECIL CE1000
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2457326B-C110-40C3-89B0-889CC913871A}" = AVM FRITZ!DSL
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.1
"{2FDF4573-5D35-4250-85F5-1F3B53391AE9}" = AK Wandlertreiber - Steiber ADW 16
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}" = PC Connectivity Solution
"{3C2500EB-9E42-43AB-A1DF-DC56E0FE7FA1}" = ArgusLab4
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4
"{4929F4BB-124B-4659-AE9E-D379BA4FE07B}" = EconNSoft Core Components - Runtime
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = Acer Crystal Eye
"{4DCCD847-693C-4147-A302-9380E657CD5F}" = Nitro PDF Reader 2
"{52271A46-33D8-469E-9427-99F06BECA667}" = Chemie heute SII Materialien
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{623B8278-8CAD-45C1-B844-58B687C07805}" = Bing Bar Platform
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{707B7A26-CFBF-466C-AE74-F7F464F97155}" = AK Wandlertreiber - Digitek DT4000
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{74095C05-03AF-4A9A-B12E-269163EE14AA}" = AK Wandlertreiber - ALL-CHEM-MISST II   
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B63B2922B174135AFC0E1377DD81EC2}" = 
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7EC19307-7C22-47A8-922B-3FA965291260}" = OpenOffice.org 3.0
"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA
"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture
"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw
"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP
"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content
"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters
"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{838A1BC9-95CA-4880-9BE3-2A7D23600A2B}" = Macromedia Shockwave Player
"{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}" = HP Officejet Pro 8500 A910 Hilfe
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A77D615-A320-41E8-A8EB-8DC10FA34056}" = AK Wandlertreiber - Digitek DT80000
"{8C5FAD77-F678-4758-A296-C12F08D179E0}" = Microsoft IntelliPoint 6.2
"{8DA426C7-82FE-4867-BB6D-0F2825D554E4}" = AK WinChemie.NET Standard
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{90AB0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint 2003 Template Pack 1
"{928B06E4-DDAA-476A-926A-641620326327}" = Microsoft Search Enhancement Pack
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{989112B0-74DB-4A40-932F-580049CD0B97}" = Visual Basic for Applications (R) Core - German
"{99DBFE8E-8143-4311-816B-AC3FE200B933}" = Rund um ... Chemie heute SI (Teil 1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM
"{9D5CF727-56E3-4D9D-AF12-0E2B39227FA7}" = AK Wandlertreiber - Campsec M 330
"{A3401EBE-5D46-477A-802E-02D1BFF8BDF4}" = AK Wandlertreiber - AK GC USB           
"{A505EBCB-C827-433F-B5A1-D242F20A4B23}" = Elemente Chemie Multimedial 1
"{A81FB222-A7A2-4139-8AB5-2EC2F7C7EFFE}" = AK Wandlertreiber - BMS Spec 5000       
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AB73197B-8623-4247-9864-4EB3DAE7CAFA}" = AK Wandlertreiber - Digitek DT 9062
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}" = CorelDRAW Graphics Suite X4 - Lang DE
"{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}" = HP Update
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications (R) Core - English
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer 3.72
"{B8591E60-8A0E-43F9-A82D-7EAE368A8BBC}" = Politik transparent
"{BA833BEB-5D9C-4CCD-B070-382F24BD624D}" = Chemie heute SII interaktiv
"{BB91071A-F029-4B98-B6EE-EBA3AB14D530}" = Elemente Chemie Multimedial 2
"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C19BE821-89B1-4A96-AC7C-873810C0CB5F}" = ContentSAFER for Wizmax
"{C1A5B568-E862-4D88-944D-D8B26C4F16DC}" = AK Analytik 32.NET
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{C45EB9E5-7165-4FB0-8C31-77FC4743362F}" = Manual CanoScan LiDE 25
"{C658104F-C2DC-4E76-BDC4-A0D492ACEE63}" = AK Wandlertreiber - Zelle               
"{C9A519F3-661E-4599-9445-B29B11616315}" = AK DeviceToolkit
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = CanoScan Toolbox Ver4.9
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"{D92B1ECA-4F55-4B14-A4D5-D8FDFFD26FF9}" = Interwrite Workspace
"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications (R) Core
"{DD1DED37-2486-4F56-8F89-56AA814003F5}" = Acer Crystal Eye webcam
"{E2E25F53-EB64-4BC1-8A9E-B970BBEF8C1C}" = HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät
"{E6738F45-D704-4D83-9E51-24695E717D09}" = ODF Add-in für Microsoft Word
"{EBFEEB3F-3E3B-4725-A4E0-376144CE4F76}" = Citrix XenApp Web Plugin
"{F0AF5265-0E76-4AC0-AE45-ACA6428D5EDA}" = Pfadfinder 2.0
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes
"{FEC34C88-2E0E-4D43-A9AB-3F0A49A19B50}" = AK Wandlertreiber - AK LowCost GC 04
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"ACDLabs in C__Program_Files_ACDFREE12_" = ACD/Labs Software in C:\Program Files\ACDFREE12\
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"Analytik Professional" = Analytik Professional
"AoA Audio Extractor_is1" = AoA Audio Extractor 1.0
"Audacity 1.3 Beta_is1" = Audacity 1.3.4
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"CDex" = CDex extraction audio
"ClipNavigator" = ClipNavigator
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"COMODO Firewall Pro" = COMODO Firewall Pro
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FBDBServer_1_5_is1" = Firebird 1.5.3.4870
"Folienviewer2" = Folienviewer2
"Free FLV Converter_is1" = Free FLV Converter V 6.96.0
"FreePDF_XP" = FreePDF XP (Remove only)
"GridVista" = Acer GridVista
"hotpot_is1" = HotPotatoes v 6.2.5.2
"IHMC CmapTools v5.03" = IHMC CmapTools v5.03
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}" = Kies
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"Mozilla Thunderbird 9.0.1 (x86 de)" = Mozilla Thunderbird 9.0.1 (x86 de)
"MyFreeCodec" = MyFreeCodec
"Picasa 3" = Picasa 3
"RealPlayer 6.0" = RealPlayer
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Revo Uninstaller" = Revo Uninstaller 1.92
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Spyware Doctor" = Spyware Doctor 6.0
"SumatraPDF" = SumatraPDF
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TuxGuitar 1.0" = TuxGuitar
"V3.2_is1" = File Scavenger 3.2
"WEKA WIRTSCHAFT_RECHT_POLITIK UNTERRICHTEN _" = Wirtschaft-Recht-Politik unterrichten .
"Winamp" = Winamp
"WinRAR archiver" = WinRAR
"XMind" = XMind
"XMPEG" = XMPEG 5.0
"xp-AntiSpy" = xp-AntiSpy 3.96-8
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MyFreeCodec" = MyFreeCodec
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 09.07.2009 04:18:11 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 16.07.2009 03:34:01 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3006
Description = 
 
Error - 16.07.2009 03:34:02 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3007
Description = 
 
Error - 20.07.2009 04:43:52 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 20.07.2009 04:43:52 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 23.07.2009 04:00:42 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 23.07.2009 04:00:48 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 04.08.2009 04:59:09 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 06.08.2009 02:49:54 | Computer Name = Sebastian | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung Tablet.exe, Version 5.0.3.3, Zeitstempel 0x460db379,
 fehlerhaftes Modul Tablet.exe, Version 5.0.3.3, Zeitstempel 0x460db379, Ausnahmecode
 0xc0000005, Fehleroffset 0x0007b3a0,  Prozess-ID 0xcf8, Anwendungsstartzeit 01ca1662188bee09.
 
Error - 08.08.2009 04:49:54 | Computer Name = Sebastian | Source = Windows Search Service | ID = 3013
Description = 
 
[ OSession Events ]
Error - 23.03.2010 04:25:13 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 87116
 seconds with 4020 seconds of active time.  This session ended with a crash.
 
Error - 13.06.2010 12:59:24 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 90835
 seconds with 3000 seconds of active time.  This session ended with a crash.
 
Error - 21.06.2010 16:12:03 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7315
 seconds with 4080 seconds of active time.  This session ended with a crash.
 
Error - 27.08.2010 16:37:54 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 50495
 seconds with 2820 seconds of active time.  This session ended with a crash.
 
Error - 05.12.2010 13:29:17 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 193166
 seconds with 1920 seconds of active time.  This session ended with a crash.
 
Error - 17.12.2010 12:33:47 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8248
 seconds with 6180 seconds of active time.  This session ended with a crash.
 
Error - 27.01.2011 15:55:41 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
 12.0.6504.5001, Microsoft Office Version: 12.0.6425.1000. This session lasted 2028
 seconds with 420 seconds of active time.  This session ended with a crash.
 
Error - 17.07.2011 14:56:50 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5550
 seconds with 3420 seconds of active time.  This session ended with a crash.
 
Error - 18.07.2011 15:01:58 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7116
 seconds with 3720 seconds of active time.  This session ended with a crash.
 
Error - 04.03.2012 16:27:26 | Computer Name = Sebastian | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 21394
 seconds with 6960 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 13.03.2012 13:49:45 | Computer Name = Sebastian | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 13.03.2012 um 18:47:26 unerwartet heruntergefahren.
 
Error - 13.03.2012 13:50:12 | Computer Name = Sebastian | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 13.03.2012 13:50:33 | Computer Name = Sebastian | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 13.03.2012 13:55:20 | Computer Name = Sebastian | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 13.03.2012 um 18:53:30 unerwartet heruntergefahren.
 
Error - 13.03.2012 13:55:48 | Computer Name = Sebastian | Source = DCOM | ID = 10005
Description = 
 
Error - 13.03.2012 13:55:56 | Computer Name = Sebastian | Source = DCOM | ID = 10005
Description = 
 
Error - 13.03.2012 13:55:58 | Computer Name = Sebastian | Source = DCOM | ID = 10005
Description = 
 
Error - 13.03.2012 13:56:09 | Computer Name = Sebastian | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 13.03.2012 13:56:09 | Computer Name = Sebastian | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 13.03.2012 14:19:55 | Computer Name = Sebastian | Source = DCOM | ID = 10005
Description = 
 
 
< End of report >
         

Vielen Dank schon mal!

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [vasja] C:\Users\Sebastian Musli\AppData\Local\Temp\mor.exe (Hauppauge Computer Works Inc)
 :Files
C:\Users\Sebastian Musli\AppData\Local\Temp\mor.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Datei ist hochgeladen, hier der Berichtstext:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\vasja deleted successfully.
C:\Users\Sebastian Musli\AppData\Local\Temp\mor.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Gast
->Flash cache emptied: 75 bytes
 
User: Nicht Sebastian
->Flash cache emptied: 1957886 bytes
 
User: Public
 
User: Sebastian Musli
->Flash cache emptied: 495871 bytes
 
Total Flash Files Cleaned = 2,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 282017 bytes
->Temporary Internet Files folder emptied: 249276 bytes
->FireFox cache emptied: 3053598 bytes
->Flash cache emptied: 0 bytes
 
User: Nicht Sebastian
->Temp folder emptied: 245505 bytes
->Temporary Internet Files folder emptied: 5835746 bytes
->FireFox cache emptied: 6791368 bytes
->Google Chrome cache emptied: 594288 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Sebastian Musli
->Temp folder emptied: 1605809163 bytes
->Temporary Internet Files folder emptied: 132447507 bytes
->Java cache emptied: 14531719 bytes
->FireFox cache emptied: 705958094 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 204732710 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 279409 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 12875919 bytes
RecycleBin emptied: 5094580 bytes
 
Total Files Cleaned = 2.574,00 mb
 
 
OTL by OldTimer - Version 3.2.36.3 log created on 03132012_194848

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\MpCmdRun-80-421CFC91-A93E-42AB-A35C-F06F127FCC44.lock not found!
C:\Windows\temp\MpCmdRun.log moved successfully.
File\Folder C:\Windows\temp\TMP000000016A3C5F4CB51FA238 not found!

Registry entries deleted on Reboot...
         

danke für den upload

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Es hat etwas gedauert, aber hier der logfile

ComboFix 12-03-13.01 - Sebastian Musli 13.03.2012  21:27:02.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2045.977 [GMT 1:00]
ausgeführt von:: c:\users\Sebastian Musli\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
FW: COMODO Firewall *Enabled* {9F6B8402-CD67-6410-5B6A-D652628C89DE}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: COMODO Defense+ *Disabled/Updated* {1C31E4C3-A132-6AC6-4A85-4415E7D88418}
SP: Spyware Doctor *Disabled/Updated* {F008AB3A-52B9-2B13-3681-4ED4FDA86549}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\drv\Tuner\Yuan\Resources\_desktop.ini
c:\program files\xp-AntiSpy
c:\program files\xp-AntiSpy\sponsoring\ebay.ico
c:\program files\xp-AntiSpy\sponsoring\ebay_desktop.ico
c:\program files\xp-AntiSpy\sponsoring\ebay_hover.ico
c:\program files\xp-AntiSpy\sponsoring\sponsor.html
c:\program files\xp-AntiSpy\sponsoring\sponsor.url
c:\program files\xp-AntiSpy\Uninstall.exe
c:\program files\xp-AntiSpy\xp-AntiSpy.chm
c:\program files\xp-AntiSpy\xp-AntiSpy.exe
c:\program files\xp-AntiSpy\xp-AntiSpy.url
c:\windows\IsUn0407.exe
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-02-13 bis 2012-03-13  ))))))))))))))))))))))))))))))
.
.
2012-03-13 20:41 . 2012-03-13 20:42	--------	d-----w-	c:\users\Sebastian Musli\AppData\Local\temp
2012-03-13 20:41 . 2012-03-13 20:41	--------	d-----w-	c:\users\Nicht Sebastian\AppData\Local\temp
2012-03-13 20:41 . 2012-03-13 20:41	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2012-03-13 20:41 . 2012-03-13 20:41	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-03-13 18:48 . 2012-03-13 18:58	--------	d-----w-	C:\_OTL
2012-03-08 19:43 . 2012-03-08 19:43	--------	d-----w-	c:\users\Nicht Sebastian\AppData\Roaming\Avira
2012-03-08 19:37 . 2012-03-08 19:37	--------	d-----w-	c:\users\Nicht Sebastian\AppData\Roaming\Apple Computer
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-13 07:39 . 2011-07-04 17:44	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-25 21:17 . 2008-05-16 21:20	2620	--sha-w-	c:\programdata\KGyGaAvL.sys
2012-02-16 08:33 . 2011-10-16 15:35	137416	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-01-16 08:01 . 2011-07-28 12:27	18936	----a-w-	c:\windows\system32\nitrolocalui2.dll
2012-01-16 08:01 . 2011-07-28 12:27	27640	----a-w-	c:\windows\system32\nitrolocalmon2.dll
2003-03-21 12:45 . 2008-11-23 18:34	250544	----a-w-	c:\program files\Common Files\keyhelp.ocx
2012-02-21 14:54 . 2011-05-07 12:55	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"EconNSoft Core Cleaner"="c:\windows\system32\ECS_CoreCleaner.exe" [2007-10-04 40960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"BisonInst0402"="c:\windows\BR040286.exe" [2007-05-08 53248]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-09 845360]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2009-11-30 1800464]
"Skytel"="Skytel.exe" [2007-06-15 1826816]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2009-11-30 1800464]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=    c:\windows\system32\guard32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FSUSBEXDISK
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
.
Inhalt des "geplante Tasks" Ordners
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/sm
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://de.intl.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\ICQ7.4\ICQ.exe
LSP: c:\windows\system32\wpclsp.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Sebastian Musli\AppData\Roaming\Mozilla\Firefox\Profiles\lkfrbw62.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - prefs.js: network.proxy.ftp - 10.1.0.0.
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.http - 10.1.0.0.
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - 10.1.0.0.
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - 10.1.0.0.
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 4
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-HotKeysCmds - c:\windows\system32\hkcmd.exe
HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd
HKLM-Run-IgfxTray - c:\windows\system32\igfxtray.exe
HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe
AddRemove-Analytik Professional - c:\windows\unin0407.exe
AddRemove-GridVista - c:\windows\UnInst32.exe
AddRemove-InstallShield_{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47} - c:\program files\InstallShield Installation Information\{D6CD26FD-CD7F-4C86-96A3-EEBFABE5FE47}\setup.exe
AddRemove-WEKA WIRTSCHAFT_RECHT_POLITIK UNTERRICHTEN _ - c:\program files\InstallShield Installation Information\Setup.exe
AddRemove-xp-AntiSpy - c:\program files\xp-AntiSpy\Uninstall.exe
AddRemove-{02F0B8AE-7501-4333-AFBE-6BAABFEC7637} - c:\program files\InstallShield Installation Information\{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}\Setup.exe
AddRemove-{4BB1DCED-84D3-47F9-B718-5947E904593E} - c:\program files\InstallShield Installation Information\{4BB1DCED-84D3-47F9-B718-5947E904593E}\setup.exe
AddRemove-{67ADE9AF-5CD9-4089-8825-55DE4B366799} - c:\program files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe
AddRemove-{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files\InstallShield Installation Information\{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}\ICQ7.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\Samsung\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-{DD1DED37-2486-4F56-8F89-56AA814003F5} - c:\program files\InstallShield Installation Information\{DD1DED37-2486-4F56-8F89-56AA814003F5}\setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-03-13 21:42
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1827547742-2391406808-3908904950-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Q%`*r*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1827547742-2391406808-3908904950-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*Q%`*r*\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1827547742-2391406808-3908904950-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*`%
*f%]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1827547742-2391406808-3908904950-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*`%
*f%\OpenWithList]
@Class="Shell"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\guard32.dll
.
- - - - - - - > 'Explorer.exe'(5280)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
.
Zeit der Fertigstellung: 2012-03-13  21:47:39
ComboFix-quarantined-files.txt  2012-03-13 20:47
.
Vor Suchlauf: 14 Verzeichnis(se), 19.514.552.320 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 19.333.492.736 Bytes frei
.
- - End Of File - - D0ACF52293B667005342B384BAFE3B98
         

malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

 Malwarebytes Anti-Malware  (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.14.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18828
Sebastian Musli :: SEBASTIAN [Administrator]

Schutz: Aktiviert

14.03.2012 20:32:36
mbam-log-2012-03-14 (20-32-36).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 479893
Laufzeit: 3 Stunde(n), 17 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Program Files\Corel\CorelDRAW Graphics Suite X4\coreldraw.graphics.suite.x4.14.0.0.567-nope.exe (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Sebastian Musli\Downloads\ADLSoft_UnCompressor.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\03132012_194848\C_Users\Sebastian Musli\AppData\Local\Temp\mor.exe (Spyware.Zbot.ES) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
         

lade den CCleaner standard:
CCleaner Download - CCleaner 3.16.1666
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Hiwer die Liste )

ACD/Labs Software in C:\Program Files\ACDFREE12\	ACD/Labs	07.04.2009	82,1MB	v12.00, FREE	notwendig
Acer eAudio Management				2.5.4012						notwendig
Acer eDataSecurity Management	HiTRUST Inc.	14.08.2007	30,0MB	2.5.4241			notwendig
Acer eLock Management	Acer Inc.	14.08.2007		2.5.4005					notwendig
Acer Empowering Technology	Acer Inc.	14.08.2007		2.5.4006					notwendig
Acer eNet Management	Acer Inc.	14.08.2007		2.6.4007					notwendig
Acer ePower Management	Acer Inc.	27.03.2008		2.5.4021					notwendig
Acer ePresentation Management	Acer Inc.	14.08.2007		2.5.4002				notwendig
Acer eSettings Management	Acer Inc.	14.08.2007		2.5.4008					notwendig
Acer Mobility Center Plug-In	Acer Inc.	14.08.2007		1.0.3003					notwendig
Adobe Flash Player 11 Plugin	Adobe Systems Incorporated	12.03.2012		11.1.102.63		notwendig
Adobe Flash Player 9 ActiveX	Adobe Systems Incorporated	22.10.2007		9			unnötig
Adobe Shockwave Player	Adobe Systems, Inc.	24.02.2009	11,1MB	11				notwendig
AFPL Ghostscript 8.54		27.03.2008	28,4MB						notwendig
AFPL Ghostscript Fonts		27.03.2008	4,81MB						notwendig
AK Analytik 32.NET	AK Kappenberg - Dr. Franz Kappenberg	05.12.2010	73,6MB	6.0.154			notwendig
AK DeviceToolkit	AK Kappenberg - Dr. Franz Kappenberg	05.12.2010	1,12MB	4.0.62			notwendig
AK Wandlertreiber - AK GC USB           	AK Kappenberg	05.12.2010	68,00KB	1.00.0004			notwendig
AK Wandlertreiber - AK LowCost Fotometer 04	AK Kappenberg	05.12.2010	84,00KB	1.00.0016		notwendig
AK Wandlertreiber - AK LowCost GC 04	AK Kappenberg	05.12.2010	0,11MB	1.00.0009			notwendig
AK Wandlertreiber - ALL-CHEM-MISST	AK Kappenberg	05.12.2010	0,25MB	1.00.0042			notwendig
AK Wandlertreiber - ALL-CHEM-MISST II   	AK Kappenberg	05.12.2010	0,29MB	1.00.0062			notwendig
AK Wandlertreiber - BMS Spec 5000       	AK Kappenberg	05.12.2010	72,00KB	1.00.0005			unnötig
AK Wandlertreiber - Campsec M 330	AK Kappenberg	05.12.2010	84,00KB	1.00.0011			unnötig
AK Wandlertreiber - CECIL CE1000	AK Kappenberg	05.12.2010	80,00KB	1.00.0028			unnötig
AK Wandlertreiber - Digitek DT 9062	AK Kappenberg	05.12.2010	84,00KB	1.00.0004			unnötig
AK Wandlertreiber - Digitek DT4000	AK Kappenberg	05.12.2010	84,00KB	1.00.0006			unnötig
AK Wandlertreiber - Digitek DT80000	AK Kappenberg	05.12.2010	72,00KB	1.00.0009			unnötig
AK Wandlertreiber - Steiber ADW 16	AK Kappenberg	05.12.2010	72,00KB	1.00.0006			unnötig
AK Wandlertreiber - Zelle               	AK Kappenberg	05.12.2010	64,00KB	1.00.0001			unnötig
AK WinChemie.NET Standard	AK Kappenberg	22.12.2010	53,0MB	3.3.107				notwendig
AoA Audio Extractor 1.0	AoAMedia.Com	17.01.2009	5,89MB					notwendig
Apple Application Support	Apple Inc.	05.02.2012	61,1MB	2.1.6					notwendig
Apple Mobile Device Support	Apple Inc.	05.02.2012	24,1MB	4.0.0.97					notwendig
Apple Software Update	Apple Inc.	03.08.2011	2,38MB	2.1.3.127					notwendig
ArgusLab4	Planaria Software LLC	07.11.2010	19,1MB	4.0.0				unnötig
Audacity 1.3.4	Audacity Team	27.04.2008	12,6MB						unnötig
Avira Free Antivirus	Avira	15.02.2012	61,6MB	12.0.0.898					notwendig
AVM FRITZ!Box Dokumentation	AVM Berlin	09.03.2010	4,32MB					notwendig
AVM FRITZ!Box Druckeranschluss	AVM Berlin	09.03.2010					notwendig
AVM FRITZ!DSL	AVM Berlin	10.03.2010	14,1MB	2.04.02					notwendig
Bing Bar	Microsoft Corporation			6.3.2291.0					unnötig
Bonjour	Apple Inc.	10.11.2011	1,08MB	3.0.0.10							unbekannt
Canon ScanGear Starter										unnötig
CanoScan Toolbox Ver4.9										unnötig
CCleaner	Piriform	14.03.2012	4,45MB	3.16							notwendig
CDex extraction audio		30.06.2008	3,67MB						notwendig
Chemie heute SII interaktiv	Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH			27754			notwendig
Chemie heute SII Materialien	Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH	21.05.2010	64,6MB	1.00.0000		notwendig
Citrix XenApp Web Plugin	Citrix Systems, Inc.	29.07.2011	24,5MB	11.0.0.5357			unbekannt
ClipNavigator	Schroedel Verlag	18.02.2011	2,04MB						notwendig
COMODO Firewall Pro	COMODO	21.05.2008	51,7MB	3.0.22.349				notwendig
ContentSAFER for Wizmax										unbekannt
ConvertHelper 2.1	DownloadHelper	26.06.2008							notwendig
CorelDRAW(R) Graphics Suite X4	Corel Corporation	19.05.2008	721MB				notwendig
CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension	Corel Corporation	19.05.2008	1,56MB		notwendig
DivX Plus DirectShow Filters	DivX, Inc.	29.06.2010	1,22MB						notwendig
DivX-Setup	DivX, Inc. 	06.12.2010	2,21MB	2.1.2.2						notwendig
EconNSoft Core Components - Runtime	EconNSoft - Dominik Scherlebeck	05.12.2010	21,1MB	4.7.364	notwendig
Elemente Chemie Arbeitsblätter 1				1.00					notwendig
Elemente Chemie Multimedial 1	Ernst Klett Verlag	27.02.2011	575MB	1.00.0000			notwendig
Elemente Chemie Multimedial 2	Ernst Klett Verlag	10.05.2009	584MB	1.00.0000			notwendig
File Scavenger 3.2	QueTek™ Consulting Corporation	11.07.2011	1,50MB	3.2			unbekannt
Firebird 1.5.3.4870	Firebird Project	20.06.2009	9,74MB						notwendig
Folienviewer2	Imagon GmbH	06.04.2009	1,82MB	1.01					notwendig
Free FLV Converter V 6.96.0	Koyote Soft	05.04.2011	10,6MB	6.96.0.0				notwendig
FreePDF XP (Remove only)		27.03.2008	2,94MB						notwendig
HDAUDIO Soft Data Fax Modem with SmartCP		13.08.2007	1,02MB				unnötig
HotPotatoes v 6.2.5.2	HalfBaked	22.11.2008	25,8MB					notwendig
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät	Hewlett-Packard Co.	13.08.2011	154,7MB	22.50.231.0	notwendig
HP Officejet Pro 8500 A910 Hilfe	Hewlett Packard	13.08.2011	24,2MB	140.0.2.2					unnötig
HP Update	Hewlett-Packard	13.08.2011	2,97MB	5.002.006.003						unnötig
I.R.I.S. OCR	HP	13.08.2011	69,0MB	12.3.4.0								notwendig
IHMC CmapTools v5.03	Institute for Human & Machine Cognition	07.09.2009	110,7MB	5.0.0.3			notwendig
Intel(R) Matrix Storage Manager											notwendig
Interwrite Workspace	Interwrite Learning	12.09.2009	821MB	8.01.0042				unnötig
IrfanView (remove only)		27.03.2008	1,38MB						notwendig
iTunes	Apple Inc.	05.02.2012	169,7MB	10.5.3.3							notwendig
Java(TM) 6 Update 29	Oracle	28.04.2011	97,1MB	6.0.290					notwendig
Java(TM) 6 Update 4	Sun Microsystems, Inc.	29.03.2008	140,8MB	1.6.0.40				notwendig
Java(TM) 6 Update 5	Sun Microsystems, Inc.	29.03.2008	136,2MB	1.6.0.50				notwendig
Java(TM) 6 Update 7	Sun Microsystems, Inc.	03.08.2008	136,2MB	1.6.0.70				notwendig
Macromedia Shockwave Player	Macromedia, Inc.	06.04.2008	9,17MB	10.1.1.016		notwendig
Malwarebytes Anti-Malware Version 1.60.1.1000	Malwarebytes Corporation	12.03.2012	11,5MB	1.60.1.1000	notwendig
Manual CanoScan LiDE 25											unnötig
Microsoft .NET Framework 3.5 SP1	Microsoft Corporation	16.04.2009	27,8MB			^	notwendig
Microsoft IntelliPoint 6.2	Microsoft	17.04.2008	16,8MB	6.20.182.0					unbekannt
Microsoft Office Enterprise 2007	Microsoft Corporation	09.07.2009	614MB	12.0.6425.1000		notwendig
Microsoft Office PowerPoint 2003 Template Pack 1	Microsoft Corporation	19.09.2009	12,3MB	11.0.5614.0	notwendig
Microsoft Silverlight	Microsoft Corporation	03.07.2011	116,2MB	4.0.60531.0			notwendig
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053	Microsoft Corporation	30.07.2009	0,25MB	8.0.50727.4053	unbekannt
Microsoft Visual C++ 2005 Redistributable	Microsoft Corporation	14.08.2007	0,41MB	8.0.56336				unbekannt
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148	Microsoft Corporation	30.07.2009	0,19MB	9.0.30729.4148	unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729	Microsoft Corporation	15.01.2010	0,58MB	9.0.30729			unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	Microsoft Corporation	18.03.2009	0,58MB	9.0.30729		unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	Microsoft Corporation	25.03.2010	0,58MB	9.0.30729.4148	unbekannt
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219	Microsoft Corporation	16.10.2011	11,1MB	10.0.40219		unbekannt
Mozilla Firefox 10.0.2 (x86 de)	Mozilla	20.02.2012	41,3MB	10.0.2								unbekannt
Mozilla Thunderbird 9.0.1 (x86 de)	Mozilla	17.01.2012	43,6MB	9.0.1							unnötig
MSXML 4.0 SP2 (KB936181)	Microsoft Corporation	27.03.2008	1,27MB	4.20.9848.0			Notwendig
MSXML 4.0 SP2 (KB954430)	Microsoft Corporation	12.11.2008	1,28MB	4.20.9870.0			Notwendig
MyFreeCodec		21.12.2010	12,2MB								Notwendig
Nitro PDF Reader 2	Nitro PDF Software	02.02.2012	85,9MB	2.1.1.4						Notwendig
NTI CD & DVD-Maker	NewTech Infosystems	13.08.2007	40,2MB	7				Notwendig
ODF Add-in für Microsoft Word	Clever Age	18.08.2008	3,39MB	1.0.0				Notwendig
OpenOffice.org 3.0	OpenOffice.org	07.09.2009	708MB	3.0.9379						Notwendig
PC Connectivity Solution	Nokia	14.06.2010	11,0MB	8.47.7.0						unnötig
Pfadfinder 2.0	Bildungshaus Schulbuchverlage GmbH, Braunschweig	04.12.2011	6,52MB	1.0.11		Notwendig
Picasa 3	Google, Inc.	28.09.2011	96,6MB	3.8							unnötig
Politik transparent	Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH	07.04.2009	77,8MB	1.00.0000		Notwendig
PowerProducer 3.72	CyberLink Corporation			074324(3.7)_Vista_Acer								Notwendig
QuickTime	Apple Inc.	10.11.2011	73,3MB	7.71.80.42										Notwendig
RealPlayer	RealNetworks	29.03.2009	45,0MB											Notwendig
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	14.08.2007		6.0.1.5443						Notwendig
RedMon - Redirection Port Monitor		27.03.2008											Notwendig
Revo Uninstaller 1.92	VS Revo Group	24.07.2011	4,05MB	1.92									Notwendig
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01				3.51.01								unbekannt
Rund um (2.0) ... Chemie heute SI - Kontext	Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH	04.12.2011	337MB	1.00.0000		Notwendig
Rund um ... Chemie heute SI (Teil 1)	Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH	29.03.2008	211MB	1.00.0000			Notwendig
SAMSUNG USB Driver for Mobile Phones	SAMSUNG Electronics Co., Ltd.			1.3.350.0				unnötig
ScanSoft OmniPage SE 4.0	Nuance Communications, Inc.	29.03.2008	154,2MB	15.00.0020			Notwendig
Spekwin32 v1.71.6 (deutsche Version)	Friedrich Menges	11.01.2012						Notwendig
Spyware Doctor 6.0	PC Tools	02.10.2008	45,3MB	6.0							Notwendig
SumatraPDF	Krzysztof Kowalczyk	13.02.2011	4,77MB	1.3						Notwendig
Synaptics Pointing Device Driver	Synaptics	22.10.2007	13,1MB	9.1.16.0					unbekannt
TuxGuitar		11.10.2008		1.0								Notwendig
Winamp	Nullsoft, Inc	27.03.2008	20,1MB	5.53 							unnötig
Windows Media Player Firefox Plugin	Microsoft Corp	07.07.2008	0,29MB	1.0.0.8				Notwendig
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)	Nokia	13.06.2010		08/22/2008 7.0.0.0	unnötig
WinRAR		29.03.2008	3,66MB									Notwendig
XMind	XMind Ltd.	16.08.2009	36,1MB	3.0.3							Notwendig
XMPEG 5.0	Eric CHAUVET	21.06.2008	3,14MB	5.0						unnötig
         

deinstaliere:
Adobe Flash Player 9
Bing
Canon
CanoScan
COMODO : welche version nutzt du? gehe auf die homepage und gucke ob du kostenlos upgraden kannst, ag mir bescheid obs geklappt hatt
deinstaliere:
Java alle
Download der kostenlosen Java-Software
downloade java jre, instalieren

deinstaliere:
Manual
PC Connectivity
Picasa
SAMSUNG
Spyware Doctor nutze lieber Malwarebytes von zeit zu zeit

öffne otl bereinigen neustart.
öffne CCleaner analysieren bereinigen neustart, testen wie der pc läuft

War jetzt ein paar tage nicht da, aber jetzt, da ich wieder da bin läuft der Rechner wieder gut. Vielen Dank noch einmal für die tolle Hilfe!!

dafür sind wir hier.
pc absichern:
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
http://www.trojaner-board.de/103809-...i-malware.html
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut wäre avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html
sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
Installation von Google Chrome für mehrere Nutzerkonten - Google Chrome-Hilfe
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung


Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
Run updateChecker
when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
Windows 7 Systemabbild erstellen (Backup)
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird Sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser