Win 7 nach Update teilw Englisch u. Explorer fehlerhaft

poldy-tec

Hallo!

Auf dem Rechner meines Vaters gibt es ein Problem. Ich bin nicht ganz sicher ob es sich überhaupt um einen Schädling handelt, aber ich möchte es gerne ausschließen.

Folgendes ist passiert: nach einem automatischen Windows Update am Freitag fiel zunächst auf, dass anstelle von "Papierkorb" auf dem Desktop "Recycle Bin" stand. Bei weiterer Kontrolle dann, dass der komplette Explorer Englisch ist. (alle anderen OS-Teile aber nicht!) Außerdem funktioniert nirgendwo mehr ein Kontextmenü, und man kann keine Dateinen mehr verschieben, kopieren, löschen etc.

Ein Rücksetzen auf einen Systemwiederherstellungspunkt vor dem Update brachte zunächst Abhilfe (alles war wieder völlig okay), aber als dann die Updates erneut gezogen wurden war der Fehler wieder da.
Da die Updates ausschließlich automatisch ausgeführt werden, denke ich nicht das es zweimal hintereinander an den Updates liegt.

Deswegen habe ich wie von euch gewünscht OTL und GMER laufen lassen (vorher natürlich auch defogger)

OTL.txt:
OTL logfile created on: 18.06.2012 17:24:53 - Run 1
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Users\MaDiSO\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,50 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 69,05% Memory free
7,00 Gb Paging File | 5,90 Gb Available in Paging File | 84,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 71,46 Gb Total Space | 27,03 Gb Free Space | 37,82% Space Free | Partition Type: NTFS
Drive D: | 14,65 Gb Total Space | 9,95 Gb Free Space | 67,96% Space Free | Partition Type: NTFS
Drive E: | 36,67 Gb Total Space | 34,00 Gb Free Space | 92,71% Space Free | Partition Type: NTFS
Drive F: | 5,17 Gb Total Space | 0,88 Gb Free Space | 17,04% Space Free | Partition Type: NTFS
Drive G: | 12,21 Gb Total Space | 7,32 Gb Free Space | 59,93% Space Free | Partition Type: NTFS
Drive H: | 36,57 Gb Total Space | 15,06 Gb Free Space | 41,19% Space Free | Partition Type: NTFS
Drive I: | 19,53 Gb Total Space | 9,24 Gb Free Space | 47,33% Space Free | Partition Type: NTFS
Drive J: | 14,65 Gb Total Space | 4,62 Gb Free Space | 31,55% Space Free | Partition Type: NTFS
Drive L: | 14,65 Gb Total Space | 10,99 Gb Free Space | 75,02% Space Free | Partition Type: NTFS
Drive Q: | 4,88 Gb Total Space | 4,05 Gb Free Space | 82,92% Space Free | Partition Type: NTFS
Drive T: | 2,44 Gb Total Space | 2,33 Gb Free Space | 95,41% Space Free | Partition Type: NTFS

Computer Name: *** | User Name: DiSo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.06.18 17:22:47 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\MaDiSO\Desktop\OTL.exe
PRC - [2012.05.08 17:23:22 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 17:23:21 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 17:23:21 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 17:23:21 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.12 16:21:40 | 000,802,816 | ---- | M] (Sphinx Software) -- C:\Programme\Windows7FirewallControl\Windows7FirewallControl.exe
PRC - [2012.04.12 16:09:42 | 000,495,616 | ---- | M] (Sphinx Software) -- C:\Programme\Windows7FirewallControl\Windows7FirewallService.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.06.26 15:25:24 | 000,356,352 | ---- | M] () -- C:\Programme\ScanWizard 5\ScannerFinder.exe


========== Modules (No Company Name) ==========

MOD - [2012.05.26 12:06:12 | 000,008,704 | ---- | M] () -- C:\Users\MaDiSO\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V3.5-1.gadget\GetCoreTempInfoNET.dll
MOD - [2012.05.26 12:06:12 | 000,007,680 | ---- | M] () -- C:\Users\MaDiSO\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V3.5-1.gadget\SystemInfo.dll
MOD - [2012.05.26 12:06:12 | 000,006,144 | ---- | M] () -- C:\Users\MaDiSO\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V3.5-1.gadget\CoreTempReader.dll
MOD - [2012.05.09 17:09:55 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2010.11.13 01:19:04 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.22 17:22:20 | 000,249,856 | ---- | M] () -- C:\Programme\ScanWizard 5\SFRes.dll
MOD - [2009.06.26 15:25:24 | 000,356,352 | ---- | M] () -- C:\Programme\ScanWizard 5\ScannerFinder.exe


========== Win32 Services (SafeList) ==========

SRV - [2012.05.08 17:23:22 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 17:23:21 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.05 18:27:40 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.21 03:16:42 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.12 16:09:42 | 000,495,616 | ---- | M] (Sphinx Software) [Auto | Running] -- C:\Programme\Windows7FirewallControl\Windows7FirewallService.exe -- (Windows7FirewallService)
SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Programme\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [File_System | On_Demand | Stopped] -- -- (StarOpen)
DRV - File not found [Kernel | Auto | Stopped] -- -- (ASPI32)
DRV - [2012.05.08 17:23:22 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 17:23:22 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.19 17:56:15 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.07.10 05:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.06.17 16:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.14 00:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2008.10.21 10:22:48 | 000,114,600 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0017mdm.sys -- (s0017mdm)
DRV - [2008.10.21 10:22:48 | 000,109,736 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0017unic.sys -- (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM)
DRV - [2008.10.21 10:22:48 | 000,108,328 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0017mgmt.sys -- (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM)
DRV - [2008.10.21 10:22:48 | 000,104,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0017obex.sys -- (s0017obex)
DRV - [2008.10.21 10:22:48 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0017bus.sys -- (s0017bus) Sony Ericsson Device 0017 driver (WDM)
DRV - [2008.10.21 10:22:48 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0017nd5.sys -- (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS)
DRV - [2008.10.21 10:22:48 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0017mdfl.sys -- (s0017mdfl)
DRV - [2008.05.16 12:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM)
DRV - [2008.05.16 12:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS)
DRV - [2008.05.16 12:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdfl.sys -- (s0016mdfl)
DRV - [2008.05.16 12:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdm.sys -- (s0016mdm)
DRV - [2008.05.16 12:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM)
DRV - [2008.05.16 12:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016obex.sys -- (s0016obex)
DRV - [2008.05.16 12:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM)
DRV - [2007.10.26 18:51:24 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Programme\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
IE - HKCU\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm-Sicherheit Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.265.2
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: E:\Freeware\PDFXChange\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: E:\Freeware\PDFXChange\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: E:\Freeware\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: E:\Freeware\PDFXChange\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.24 13:13:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.27 17:46:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.04.26 11:05:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2011.03.02 11:08:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DiSo\AppData\Roaming\mozilla\Extensions
[2011.03.02 11:08:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DiSo\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.03.06 18:45:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DiSo\AppData\Roaming\mozilla\Firefox\Profiles\iu2kwitn.default\extensions
[2012.03.06 18:45:42 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\DiSo\AppData\Roaming\mozilla\Firefox\Profiles\iu2kwitn.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.06.22 10:46:12 | 000,000,000 | ---D | M] (Cookies Manager+) -- C:\Users\DiSo\AppData\Roaming\mozilla\Firefox\Profiles\iu2kwitn.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25d}
[2011.01.17 15:41:40 | 000,000,943 | ---- | M] () -- C:\Users\DiSo\AppData\Roaming\Mozilla\Firefox\Profiles\iu2kwitn.default\searchplugins\conduit.xml
[2012.04.24 13:13:16 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.04.21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[1999.12.31 17:00:00 | 000,170,080 | ---- | M] (Tracker Software Products (Canada) Ltd.) -- C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2012.04.21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.04.21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Windows7FirewallControl] C:\Programme\Windows7FirewallControl\Windows7FirewallControl.exe (Sphinx Software)
O4 - HKLM..\RunOnce: [*Restore] C:\Windows\System32\rstrui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\Windows\is-GT4TU.exe ()
O4 - HKCU..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [SPReview] C:\Windows\System32\SPReview\SPReview.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube Download - C:\Users\DiSo\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77E99E3A-2B0F-4703-A7AA-89187DA29ACB}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2012.06.12 15:15:29 | 000,000,000 | ---D | M] - D:\Auto -- [ NTFS ]
O32 - AutoRun File - [2012.02.03 13:02:38 | 000,000,000 | ---D | M] - Q:\Auto -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012.06.14 16:01:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
[2012.06.14 16:01:04 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler
[2012.06.02 17:45:27 | 000,000,000 | ---D | C] -- C:\Users\DiSo\AppData\Local\Sony
[2012.06.02 17:43:43 | 000,000,000 | ---D | C] -- C:\Users\DiSo\Documents\Sony
[2012.06.02 17:39:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2012.06.02 17:39:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
[2012.06.02 17:39:51 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2012.06.02 17:38:01 | 000,000,000 | ---D | C] -- C:\Users\DiSo\AppData\Roaming\MyPhoneExplorer
[2012.05.30 21:33:43 | 000,000,000 | ---D | C] -- C:\Users\DiSo\AppData\Roaming\7-PDFSplitMerge
[2012.05.30 21:27:59 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.05.27 11:59:52 | 000,000,000 | ---D | C] -- C:\Users\DiSo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012.05.19 21:36:55 | 000,000,000 | -HSD | C] -- C:\found.011

========== Files - Modified Within 30 Days ==========

[2012.06.18 17:27:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.18 17:26:43 | 000,022,368 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.18 17:26:43 | 000,022,368 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.18 17:22:03 | 000,000,000 | ---- | M] () -- C:\Users\DiSo\defogger_reenable
[2012.06.18 17:19:15 | 000,696,354 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.18 17:19:15 | 000,651,672 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.18 17:19:15 | 000,147,650 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.18 17:19:15 | 000,120,604 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.18 17:13:25 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.06.18 17:13:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.18 17:13:05 | 2817,433,600 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.14 22:52:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.06.12 15:23:11 | 001,544,704 | ---- | M] () -- C:\Windows\is-GT4TU.exe
[2012.06.12 15:23:11 | 000,025,599 | ---- | M] () -- C:\Windows\is-GT4TU.msg
[2012.06.12 15:23:11 | 000,000,329 | ---- | M] () -- C:\Windows\is-GT4TU.lst
[2012.05.31 18:23:04 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2012.05.27 12:03:39 | 000,001,722 | ---- | M] () -- C:\Users\DiSo\Desktop\Free Video to MP3 Converter.lnk
[2012.05.27 11:59:53 | 000,000,727 | ---- | M] () -- C:\Users\DiSo\Desktop\Revo Uninstaller.lnk

========== Files Created - No Company Name ==========

[2012.06.18 17:22:03 | 000,000,000 | ---- | C] () -- C:\Users\DiSo\defogger_reenable
[2012.06.12 15:23:11 | 001,544,704 | ---- | C] () -- C:\Windows\is-GT4TU.exe
[2012.06.12 15:23:11 | 000,025,599 | ---- | C] () -- C:\Windows\is-GT4TU.msg
[2012.06.12 15:23:11 | 000,000,329 | ---- | C] () -- C:\Windows\is-GT4TU.lst
[2012.05.27 12:03:39 | 000,001,722 | ---- | C] () -- C:\Users\DiSo\Desktop\Free Video to MP3 Converter.lnk
[2012.01.24 11:20:49 | 000,786,504 | ---- | C] () -- C:\Windows\System32\CNQ9602N.DAT
[2012.01.24 11:20:49 | 000,296,064 | ---- | C] () -- C:\Windows\System32\CNQ9602W.DAT
[2012.01.15 12:19:35 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll
[2011.07.19 13:52:32 | 001,556,992 | ---- | C] () -- C:\Windows\is-Q5R9O.exe
[2011.06.16 16:55:05 | 000,007,600 | ---- | C] () -- C:\Users\DiSo\AppData\Local\resmon.resmoncfg
[2011.04.27 19:09:06 | 000,000,000 | ---- | C] () -- C:\Windows\System32\prncache.dll
[2010.07.05 11:34:46 | 000,285,216 | ---- | C] () -- C:\Windows\System32\drivers\Onsio.sys
[2010.07.05 11:34:46 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\Onsreged.sys
[2010.06.27 14:11:05 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.06.27 14:11:04 | 000,000,034 | ---- | C] () -- C:\Windows\System32\BD2030.DAT

========== LOP Check ==========

[2012.05.30 21:33:43 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\7-PDFSplitMerge
[2011.11.04 17:33:40 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\Ahnenblatt
[2011.08.16 13:48:42 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\Ashampoo
[2011.03.02 14:21:05 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\Canneverbe Limited
[2012.01.24 11:21:49 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\Canon
[2011.03.22 22:46:30 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\CheckPoint
[2012.05.27 12:03:37 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\DVDVideoSoft
[2011.08.12 11:52:17 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.05.21 15:35:13 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\elsterformular
[2011.12.22 13:17:30 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\IObit
[2012.06.02 17:38:01 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\MyPhoneExplorer
[2012.02.29 16:10:29 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\PhotoScape
[2011.04.06 23:28:10 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\Softland
[2011.03.02 11:08:26 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\Thunderbird
[2011.10.20 14:56:55 | 000,000,000 | ---D | M] -- C:\Users\DiSo\AppData\Roaming\Zoner
[2012.04.18 11:57:49 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

Extras.txt:
OTL Extras logfile created on: 18.06.2012 17:24:53 - Run 1
OTL by OldTimer - Version 3.2.49.0 Folder = C:\Users\MaDiSO\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,50 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 69,05% Memory free
7,00 Gb Paging File | 5,90 Gb Available in Paging File | 84,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 71,46 Gb Total Space | 27,03 Gb Free Space | 37,82% Space Free | Partition Type: NTFS
Drive D: | 14,65 Gb Total Space | 9,95 Gb Free Space | 67,96% Space Free | Partition Type: NTFS
Drive E: | 36,67 Gb Total Space | 34,00 Gb Free Space | 92,71% Space Free | Partition Type: NTFS
Drive F: | 5,17 Gb Total Space | 0,88 Gb Free Space | 17,04% Space Free | Partition Type: NTFS
Drive G: | 12,21 Gb Total Space | 7,32 Gb Free Space | 59,93% Space Free | Partition Type: NTFS
Drive H: | 36,57 Gb Total Space | 15,06 Gb Free Space | 41,19% Space Free | Partition Type: NTFS
Drive I: | 19,53 Gb Total Space | 9,24 Gb Free Space | 47,33% Space Free | Partition Type: NTFS
Drive J: | 14,65 Gb Total Space | 4,62 Gb Free Space | 31,55% Space Free | Partition Type: NTFS
Drive L: | 14,65 Gb Total Space | 10,99 Gb Free Space | 75,02% Space Free | Partition Type: NTFS
Drive Q: | 4,88 Gb Total Space | 4,05 Gb Free Space | 82,92% Space Free | Partition Type: NTFS
Drive T: | 2,44 Gb Total Space | 2,33 Gb Free Space | 95,41% Space Free | Partition Type: NTFS

Computer Name: *** | User Name: DiSo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "E:\Freeware\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "E:\Freeware\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0322B697-073E-4D59-995C-A63030FFAECE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{046181B2-F8F1-44AD-A3C2-8D1CFB2574E0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{314D0ACE-B776-4348-B626-699C7EC5ECC3}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{553150EF-746E-48B2-89B2-2EDE50F1860E}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6F7C3010-9C5A-495F-ADE1-7B0782EDAFBE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8CA87BFD-58F8-447A-AE3B-5EB8250E5E59}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AC5B90C0-69E0-4792-B8DB-E07782854A1D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BC90499E-D819-4EF3-BC69-80B92912610A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CD257601-E7F5-458F-8B24-53FD6FD0B28C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D07A2DE9-1E1B-4A7D-BE9D-F229A880702A}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0BB02BF9-91D6-4B7A-9D54-D1BFA413B738}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1E492B56-AA1A-430D-A54B-178396837ED7}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{329BD158-463B-4820-A59E-1A1DFFB52496}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3758285C-2538-4C97-A627-0FB8E950EE46}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{3937DBF9-73A5-4028-AB08-08C5C0678F3A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{50516816-1D19-451B-90BE-3CF40525EF92}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6D276917-7A85-477C-A783-1C942B9971AB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7C1A54E3-D501-4207-8AEC-26236EE3F5A1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{96BB6B5D-F2A8-4F42-9C7A-066AC65E0E55}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C84CECF6-EB01-4FA4-B6EA-DAAC3FF46EBC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D8DF41FF-D777-4B81-BE09-946F0F9B6FF8}" = protocol=6 | dir=out | app=system |
"{DBDD9AEE-390E-4DD2-8D1E-A87FD5E2C8F0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F169631A-27D0-43EB-8F90-1421A48DF7DA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{23E896CC-AAF5-4B24-8DFF-8A8E5FE5990D}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{8E8E240E-BE2E-4236-8B44-78C9B0D742B4}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ9602" = CanoScan 9000F Scanner Driver
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 30
"{26CA1B07-BC53-4196-B9C2-A11C6F6F3E08}_is1" = EXIF Date Changer v2.22
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{92E2CA49-B6B9-4FE2-A39B-F6EA18AC5405}_is1" = Auslogics Task Manager
"{95120000-003F-0407-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2011.09.16
"{B08D262E-D902-11D5-9C28-0080C85A0C2D}" = ScanWizard 5
"{B834524D-C302-F626-87D6-5E7352FBE502}" = simfy
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CE2121C6-C94D-4A73-8EA4-6943F33EE335}" = Picture Package Music Transfer
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.065
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F804CEB4-747E-46D5-B8AB-C56E3BAF27D9}_is1" = Das Fussball Studio 8.5.1
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"7-PDF Split & Merge_is1" = 7-PDF Split & Merge Version 2.0.3 (Build 264)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Ahnenblatt_is1" = Ahnenblatt 2.70
"Ant Movie Catalog_is1" = Ant Movie Catalog
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced
"Ashampoo ClipFinder HD_is1" = Ashampoo ClipFinder HD v.2.2.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.60
"Daub Units!" = Daub Units!
"Defraggler" = Defraggler
"doPDF 7 printer_is1" = doPDF 7.2 printer
"ElsterFormular 11.1.3.3887" = ElsterFormular-Update
"Free FLV Converter_is1" = Free FLV Converter V 6.93.0
"Free Video Dub_is1" = Free Video Dub version 2.0.8.508
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 5.0.11.508
"Free YouTube Download_is1" = Free YouTube Download version 3.0.22.221
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"Mozilla Thunderbird 12.0.1 (x86 de)" = Mozilla Thunderbird 12.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 3.1" = Canon MP Navigator EX 3.1
"MPE" = MyPhoneExplorer
"MyAshampoo Toolbar" = MyAshampoo Toolbar
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Personal Backup 5_is1" = Personal Backup 5.3
"PhotoScape" = PhotoScape
"Recuva" = Recuva
"Revo Uninstaller" = Revo Uninstaller 1.94
"Simfy" = simfy
"Sweet Home 3D_is1" = Sweet Home 3D version 3.0
"TechPowerUp GPU-Z" = TechPowerUp GPU-Z
"VLC media player" = VLC media player 2.0.1
"Winamp" = Winamp
"Windows7FirewallControl_is1" = Windows7FirewallControl (i386) 5.0.0.15
"XnView_is1" = XnView 1.98.8
"ZonerPhotoStudio13_DE_is1" = Zoner Photo Studio 13 FREE

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Gnumeric" = Gnumeric Spreadsheet 1.10.16-20110616

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 21.09.2011 08:33:03 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 21.09.2011 09:46:47 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 21.09.2011 12:42:11 | Computer Name = *** | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "e:\Freeware\freecommander\DelZip179.dll".
Fehler in Manifest- oder Richtliniendatei "e:\Freeware\freecommander\DelZip179.dll"
in Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist
ungültig.

Error - 21.09.2011 12:43:06 | Computer Name = *** | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
ericsson\sony ericsson pc companion\Drivers\DPInst64.exe". Die abhängige Assemblierung
"Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".

Error - 22.09.2011 03:24:23 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 22.09.2011 03:24:23 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 22.09.2011 03:24:24 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 22.09.2011 03:24:25 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 22.09.2011 03:24:25 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 22.09.2011 03:24:30 | Computer Name = *** | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

[ Media Center Events ]
Error - 30.10.2010 03:12:15 | Computer Name = *** | Source = MCUpdate | ID = 0
Description = 09:12:15 - Fehler beim Herstellen der Internetverbindung. 09:12:15
- Serververbindung konnte nicht hergestellt werden..

Error - 30.10.2010 03:12:24 | Computer Name = *** | Source = MCUpdate | ID = 0
Description = 09:12:20 - Fehler beim Herstellen der Internetverbindung. 09:12:20
- Serververbindung konnte nicht hergestellt werden..

[ System Events ]
Error - 16.06.2012 11:20:45 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 16.06.2012 12:39:11 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 16.06.2012 12:59:23 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 16.06.2012 13:05:23 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 16.06.2012 13:06:47 | Computer Name = *** | Source = WMPNetworkSvc | ID = 866300
Description =

Error - 17.06.2012 02:52:54 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2012 11:11:32 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 17.06.2012 11:24:44 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 18.06.2012 11:04:38 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 18.06.2012 11:13:15 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "ASPI32" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2


< End of report >

Die Dateien DDS.txt und attach.txt wurden leider nicht erstellt!?

Gmer.txt:

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-18 18:14:22
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\00000057 SAMSUNG_ rev.VT10
Running: 4cnv97sd.exe; Driver: C:\Users\DiSo\AppData\Local\Temp\ugldypow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 82C473C9 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C80D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\volmgr \Device\HarddiskVolume12 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume13 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume14 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume15 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\00000042 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume7 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume8 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume9 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume10 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume11 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

Ich hoffe ich habe soweit alles richtig gemacht und ihr könnt mir helfen.

Vielen Dank schonmal

Gruß poldy-tec