Bildschirm weiß nach Hochfahren

Max1988 · 28.08.2012, 16:44

Hallo,
habe folgendes Problem, heute bei Surven im Internet ist mein Bildschirm auf einmal weiß geworden und nach jedem Hochfahren (auch im abgesicherten Modus) bleibt der Bildschirm weiß.
Habe mir jetzt schon REATOGO_X_PE runtergeladen und meinen PC über die CD gebootet.
Brauch nun aber hilfe beim weitern vorgehen!!??
Danke im vorraus.
grüße

t'john · 28.08.2012, 17:15

Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

Max1988 · 28.08.2012, 17:43

hier is der bericht, hab die extras.TxT datei nich gefunden er hat mir nur diese hier angezeigt.OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 8/28/2012 9:37:23 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.76 Gb Total Space | 186.62 Gb Free Space | 40.07% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/08/25 04:10:01 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/08/14 16:24:08 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/07/18 12:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/07/18 12:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/01/28 13:22:51 | 000,076,888 | ---- | M] () [Auto] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011/10/21 10:23:42 | 000,196,176 | ---- | M] (Microsoft Corporation.) [Auto] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/10/15 04:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/10/14 19:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011/10/13 12:21:52 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (BBUpdate)
SRV - [2011/10/01 03:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 03:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/06/06 06:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/07/18 12:04:42 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/07/18 12:04:42 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012/07/18 12:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/10/01 03:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 03:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 03:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 03:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/07/07 19:21:28 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011/05/10 02:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009/08/05 18:24:16 | 000,061,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2009/07/10 05:07:02 | 001,222,144 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2005/03/28 04:30:36 | 000,008,192 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\ASACPI.sys -- (MTsensor)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 08 D6 AB 65 AC 3F CB 01  [binary data]
IE - HKU\MaxMarter_ON_C\..\URLSearchHook: {213c8ed6-1d78-4d8f-8729-25006aa86a76} - Reg Error: Key error. File not found
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF64_11_3_300_271.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\MaxMarter\AppData\Roaming\5064 [2011/12/25 12:08:19 | 000,000,000 | ---D | M]
 
[2010/09/05 08:05:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaxMarter\AppData\Roaming\Mozilla\Extensions
[2010/09/05 08:05:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MaxMarter\AppData\Roaming\Mozilla\Extensions\mozswing@mozswing.org
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (SplitButtonBHO Class) - {C0C86BBE-9509-4296-8459-FDBFDAF4B673} - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
O2 - BHO: (WiseConvert 1.3 Toolbar) - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (WiseConvert 1.3 Toolbar) - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKU\MaxMarter_ON_C\..\Toolbar\WebBrowser: (WiseConvert 1.3 Toolbar) - {213C8ED6-1D78-4D8F-8729-25006AA86A76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.)
O3:64bit: - HKU\MaxMarter_ON_C\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\MaxMarter_ON_C..\Run: [EA Core]  File not found
O4 - HKU\MaxMarter_ON_C..\Run: [fsm]  File not found
O4 - HKU\MaxMarter_ON_C..\Run: [Software Informer] C:\Program Files (x86)\Software Informer\softinfo.exe (Informer Technologies, Inc.)
O4 - HKU\MaxMarter_ON_C..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_C..\RunOnce: [mctadmin]  File not found
O4 - Startup: C:\Users\MaxMarter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: FRITZ!Box Dial - C:\Program Files\FRITZ!Box\AddOn (IE)\fb_addon_dial_ie.htm ()
O8 - Extra context menu item: FRITZ!Box Dial - C:\Program Files\FRITZ!Box\AddOn (IE)\fb_addon_dial_ie.htm ()
O9:64bit: - Extra Button: FRITZ!Box AddOn - {328ECD19-C167-40eb-A0C7-16FE7634105F} - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15:64bit: - MaxMarter_ON_C\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15:64bit: - MaxMarter_ON_C\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\MaxMarter_ON_C Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\MaxMarter_ON_C Winlogon: Shell - (C:\Users\MaxMarter\AppData\Roaming\msconfig.dat) - C:\Users\MaxMarter\AppData\Roaming\msconfig.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\RunGame.exe
O33 - MountPoints2\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe
O33 - MountPoints2\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\Shell - "" = AutoRun
O33 - MountPoints2\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\Shell\AutoRun\command - "" = E:\preinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/08/28 20:02:00 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2012/08/28 19:58:26 | 000,000,000 | ---D | C] -- C:\_OTL
[2012/08/15 16:51:05 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2012/08/15 16:51:05 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/08/15 16:51:04 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/08/15 16:51:04 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/08/15 16:51:04 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/08/15 16:51:04 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/08/15 16:51:04 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/08/15 16:51:04 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/08/15 16:51:03 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/08/15 16:51:03 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2012/08/15 16:51:03 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/08/15 16:51:03 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/08/15 16:51:03 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/08/15 16:51:03 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/08/15 13:52:57 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2012/08/15 13:52:55 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netapi32.dll
[2012/08/15 13:52:55 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll
[2012/08/15 13:52:55 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2012/08/15 13:52:54 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32spl.dll
[2012/08/15 13:52:54 | 000,492,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2012/08/15 13:52:54 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2012/08/15 13:52:53 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\localspl.dll
[2012/08/14 10:38:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Conduit
[2012/08/14 10:38:03 | 000,000,000 | ---D | C] -- C:\Users\MaxMarter\AppData\Local\Conduit
[2012/08/14 10:38:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WiseConvert_1.3
[2012/08/11 14:15:42 | 000,000,000 | ---D | C] -- C:\Users\MaxMarter\Documents\Yu-Gi-Oh! ONLINE 3
[2012/08/11 14:13:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\konami
[2012/08/11 14:13:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Konami
[2012/07/31 03:36:34 | 000,000,000 | ---D | C] -- C:\Users\MaxMarter\AppData\Roaming\Avira
[2012/07/31 03:30:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012/07/31 03:30:22 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2012/07/31 03:30:22 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2012/07/31 03:30:22 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2012/07/31 03:29:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012/07/31 03:29:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[1 C:\Users\MaxMarter\AppData\Roaming\*.tmp files -> C:\Users\MaxMarter\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/08/28 14:19:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/28 14:19:01 | 000,000,045 | ---- | M] () -- C:\Users\MaxMarter\AppData\Roaming\msconfig.ini
[2012/08/28 14:18:35 | 2145,951,743 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/28 14:17:11 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/28 09:36:44 | 000,018,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/28 09:36:44 | 000,018,928 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/28 09:34:11 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/28 07:58:46 | 000,654,594 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/08/28 07:58:46 | 000,616,476 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/08/28 07:58:46 | 000,130,208 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/08/28 07:58:46 | 000,106,598 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/08/28 06:24:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/24 08:16:00 | 000,000,721 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft.lnk
[2012/08/16 04:43:57 | 000,419,184 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/08/14 16:24:08 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/08/14 16:24:08 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/08/11 14:13:54 | 000,002,099 | ---- | M] () -- C:\Users\Public\Desktop\Yu-Gi-Oh! ONLINE 3.lnk
[2012/08/11 14:13:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\konami
[2012/07/31 03:30:45 | 000,001,994 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/07/31 03:30:45 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[1 C:\Users\MaxMarter\AppData\Roaming\*.tmp files -> C:\Users\MaxMarter\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/08/28 06:30:52 | 000,000,045 | ---- | C] () -- C:\Users\MaxMarter\AppData\Roaming\msconfig.ini
[2012/08/11 14:13:54 | 000,002,099 | ---- | C] () -- C:\Users\Public\Desktop\Yu-Gi-Oh! ONLINE 3.lnk
[2012/07/31 03:30:45 | 000,001,994 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/01/12 21:06:44 | 000,000,000 | ---- | C] () -- C:\Users\MaxMarter\AppData\Local\{475776A9-B354-4635-946F-0B0D7BB70643}
[2012/01/11 09:46:22 | 000,084,480 | ---- | C] () -- C:\Users\MaxMarter\AppData\Roaming\msconfig.dat
[2011/11/21 18:45:28 | 000,000,068 | ---- | C] () -- C:\Users\MaxMarter\AppData\Roaming\blckdom.res
[2011/11/14 09:59:14 | 001,526,060 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/10/31 04:43:03 | 000,000,000 | ---- | C] () -- C:\Users\MaxMarter\AppData\Local\{67891D3D-FBE2-4780-8CD7-F044B7174008}
[2011/10/28 04:31:50 | 000,282,864 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011/10/14 19:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011/09/15 03:12:17 | 000,000,000 | ---- | C] () -- C:\Users\MaxMarter\AppData\Local\{47F4494E-959B-4F5E-8C0C-19F032F2A28E}
[2011/07/10 07:05:48 | 000,021,840 | ---- | C] () -- C:\Windows\SysWow64\SIntfNT.dll
[2011/07/10 07:05:48 | 000,017,212 | ---- | C] () -- C:\Windows\SysWow64\SIntf32.dll
[2011/07/10 07:05:48 | 000,012,067 | ---- | C] () -- C:\Windows\SysWow64\SIntf16.dll
[2011/07/02 12:21:39 | 000,000,000 | ---- | C] () -- C:\Users\MaxMarter\AppData\Roaming\FileOut.cns
[2011/07/02 12:21:39 | 000,000,000 | ---- | C] () -- C:\Users\MaxMarter\AppData\Roaming\FileIn.cns
[2011/06/23 12:59:49 | 000,140,164 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011/03/30 17:31:30 | 000,252,928 | ---- | C] () -- C:\Windows\SysWow64\DShowRdpFilter.dll
[2011/01/16 03:55:26 | 000,000,532 | ---- | C] () -- C:\Windows\eReg.dat
[2010/08/19 14:50:36 | 000,007,602 | ---- | C] () -- C:\Users\MaxMarter\AppData\Local\Resmon.ResmonCfg
[2010/08/19 13:57:05 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2010/08/19 13:57:05 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010/08/19 13:32:39 | 000,000,032 | ---- | C] () -- C:\Program Files\pbuser.htm
[2010/08/19 13:32:15 | 000,012,800 | ---- | C] () -- C:\Program Files\pbgame.htm
[2010/08/19 13:20:37 | 000,846,336 | ---- | C] () -- C:\Program Files\pbsetup.exe
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2012/07/14 13:39:47 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\.minecraft
[2011/11/21 18:45:33 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5045
[2011/11/22 19:55:12 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5047
[2011/11/23 05:55:23 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5048
[2011/11/24 05:40:02 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5049
[2011/11/25 12:36:34 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5050
[2011/11/28 13:41:46 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5051
[2011/12/01 10:47:28 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5052
[2011/12/04 08:56:39 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5053
[2011/12/09 05:45:03 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5054
[2011/12/10 14:28:03 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5055
[2011/12/13 10:02:27 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5056
[2011/12/13 10:55:34 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5058
[2011/12/14 10:48:46 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5059
[2011/12/16 14:14:43 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5060
[2011/12/19 09:22:15 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5061
[2011/12/20 07:04:08 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5062
[2011/12/21 06:12:30 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5063
[2011/12/25 12:08:19 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5064
[2011/10/16 07:26:53 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Cornelsen
[2010/12/15 11:39:59 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Ixbo
[2011/12/30 11:52:46 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Kalypso Media
[2011/11/21 18:44:38 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\kock
[2011/11/24 13:18:57 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Omoppia
[2012/08/21 08:26:21 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Origin
[2011/11/24 13:11:49 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Rae
[2012/08/02 05:57:05 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\SoftGrid Client
[2012/08/28 02:37:17 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Software Informer
[2012/03/23 11:51:57 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\The Creative Assembly
[2011/11/14 10:00:01 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\TP
[2012/01/13 11:17:13 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Tropico 4
[2012/08/27 12:20:34 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\TS3Client
[2011/12/18 11:00:35 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\UAs
[2011/12/18 11:01:02 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\xmldm
[2010/12/15 11:43:09 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\Ykmihe
[2009/08/21 02:43:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/04/03 11:00:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Battle.net
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/08/21 02:43:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2011/10/26 19:02:26 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Core
[2011/10/26 19:02:50 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2009/08/21 02:43:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/08/21 08:26:25 | 000,000,000 | ---D | M] -- C:\ProgramData\Origin
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/08/21 02:43:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/11/14 12:21:07 | 000,000,000 | ---D | M] -- C:\ProgramData\VirtualizedApplications
[2009/08/21 02:43:24 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2011/01/05 11:09:00 | 000,000,000 | ---D | M] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/08/28 09:23:29 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

--- --- ---

t'john · 29.08.2012, 01:24

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

Code:

ATTFilter

:OTL
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\MaxMarter_ON_C\..\URLSearchHook: {213c8ed6-1d78-4d8f-8729-25006aa86a76} - Reg Error: Key error. File not found 
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) 
O2 - BHO: (WiseConvert 1.3 Toolbar) - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.) 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. 
O3 - HKLM\..\Toolbar: (WiseConvert 1.3 Toolbar) - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.) 
O3 - HKU\MaxMarter_ON_C\..\Toolbar\WebBrowser: (WiseConvert 1.3 Toolbar) - {213C8ED6-1D78-4D8F-8729-25006AA86A76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll (Conduit Ltd.) 
O3:64bit: - HKU\MaxMarter_ON_C\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) 
O4 - HKU\MaxMarter_ON_C..\Run: [EA Core] File not found 
O4 - HKU\MaxMarter_ON_C..\Run: [fsm] File not found 
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] File not found 
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] File not found 
O4 - HKU\UpdatusUser_ON_C..\RunOnce: [mctadmin] File not found 
O4 - Startup: C:\Users\MaxMarter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKU\MaxMarter_ON_C Winlogon: Shell - (C:\Users\MaxMarter\AppData\Roaming\msconfig.dat) - C:\Users\MaxMarter\AppData\Roaming\msconfig.dat () 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] 
O33 - MountPoints2\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\Shell\AutoRun\command - "" = D:\RunGame.exe 
O33 - MountPoints2\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe 
O33 - MountPoints2\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\Shell - "" = AutoRun 
O33 - MountPoints2\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\Shell\AutoRun\command - "" = E:\preinst.exe 
O34 - HKLM BootExecute: (autocheck autochk *) - File not found 
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found 
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found 

[2012/01/11 09:46:22 | 000,084,480 | ---- | C] () -- C:\Users\MaxMarter\AppData\Roaming\msconfig.dat 
[2011/11/21 18:45:28 | 000,000,068 | ---- | C] () -- C:\Users\MaxMarter\AppData\Roaming\blckdom.res 
[2011/11/21 18:45:33 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\5045 
[2011/11/21 18:44:38 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\kock 
[2011/12/18 11:00:35 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\UAs 
[2011/12/18 11:01:02 | 000,000,000 | ---D | M] -- C:\Users\MaxMarter\AppData\Roaming\xmldm 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Max1988 · 29.08.2012, 09:56

Code:

ATTFilter

All processes killed
========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Registry key HKEY_USERS\MaxMarter_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{213c8ed6-1d78-4d8f-8729-25006aa86a76}\ deleted successfully.
Unable to set value : HKU\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E!
Unable to set value : HKU\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E!
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\MozillaPlugins\@esn.me/esnsonar,version=0.70.4\ deleted successfully.
C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{213c8ed6-1d78-4d8f-8729-25006aa86a76}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{213c8ed6-1d78-4d8f-8729-25006aa86a76}\ not found.
File C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{213c8ed6-1d78-4d8f-8729-25006aa86a76} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{213c8ed6-1d78-4d8f-8729-25006aa86a76}\ not found.
File C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll not found.
Registry key HKEY_USERS\MaxMarter_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{213C8ED6-1D78-4D8F-8729-25006AA86A76}\ not found.
File C:\Program Files (x86)\WiseConvert_1.3\prxtbWise.dll not found.
Registry key HKEY_USERS\MaxMarter_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ deleted successfully.
File C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll not found.
Registry key HKEY_USERS\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\MaxMarter_ON_C\Software\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\UpdatusUser_ON_C\Software\Microsoft\Windows\CurrentVersion\RunOnce not found.
File C:\Users\MaxMarter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\livecall\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ not found.
File {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msnim\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F}\ not found.
File {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03C514A3-1EFB-4856-9F99-10D7BE1653C0}\ not found.
File {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry key HKEY_USERS\MaxMarter_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon not found.
File C:\Users\MaxMarter\AppData\Roaming\msconfig.dat not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File X:\AUTORUN.INF not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{493c55bf-0c15-11e0-abf7-806e6f6e6963}\ not found.
File D:\RunGame.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939ad35c-ab9e-11df-8a54-806e6f6e6963}\ not found.
File D:\Autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cffa62f6-c3da-11df-bff1-20cf301d67c4}\ not found.
File E:\preinst.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
File C:\Users\MaxMarter\AppData\Roaming\msconfig.dat not found.
File C:\Users\MaxMarter\AppData\Roaming\blckdom.res not found.
Folder C:\Users\MaxMarter\AppData\Roaming\5045\ not found.
Folder C:\Users\MaxMarter\AppData\Roaming\kock\ not found.
Folder C:\Users\MaxMarter\AppData\Roaming\UAs\ not found.
Folder C:\Users\MaxMarter\AppData\Roaming\xmldm\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\MaxMarter\Desktop\cmd.bat deleted successfully.
C:\Users\MaxMarter\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: MaxMarter
->Temp folder emptied: 8252 bytes
->Temporary Internet Files folder emptied: 3057780 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 492 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5336 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 127830217 bytes
 
Total Files Cleaned = 125,00 mb
 
 
OTL by OldTimer - Version 3.2.59.1 log created on 08292012_155320

Files\Folders moved on Reboot...
C:\Users\MaxMarter\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

t'john · 29.08.2012, 19:49

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Max1988 · 29.08.2012, 23:44

Hey der PC läuft super,
hier ist der Bericht vom Malwarebytes Anti-Malware:

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.29.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
MaxMarter :: MAXMARTER-PC [Administrator]

Schutz: Aktiviert

29.08.2012 23:44:34
mbam-log-2012-08-29 (23-44-34).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 388299
Laufzeit: 45 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 8
HKCR\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Banker) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{EFF39A40-C163-4d5d-B073-52FBB55C646A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EFF39A40-C163-4D5D-B073-52FBB55C646A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EFF39A40-C163-4D5D-B073-52FBB55C646A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EFF39A40-C163-4D5D-B073-52FBB55C646A} (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|shell (Trojan.Agent) -> Daten: explorer.exe,C:\Users\MaxMarter\AppData\Roaming\msconfig.dat -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\08292012_141636\C_Users\MaxMarter\AppData\Roaming\msconfig.dat (Trojan.Agent.VGENX) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

der Bericht vom ADwCleaner :

Code:

ATTFilter

# AdwCleaner v1.801 - Logfile created 08/30/2012 at 00:45:13
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : MaxMarter - MAXMARTER-PC
# Boot Mode : Normal
# Running from : C:\Users\MaxMarter\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\MaxMarter\AppData\Local\Conduit
Folder Found : C:\Users\MaxMarter\AppData\LocalLow\Conduit
Folder Found : C:\Users\MaxMarter\AppData\LocalLow\PriceGong
Folder Found : C:\Users\MaxMarter\AppData\LocalLow\WiseConvert_1.3
Folder Found : C:\Program Files (x86)\Ask.com
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\WiseConvert_1.3

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3242337
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\PriceGong
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Softonic
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert_1.3 Toolbar
Key Found : HKLM\SOFTWARE\WiseConvert_1.3
[x64] Key Found : HKCU\Software\AppDataLow\Software\Conduit
[x64] Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
[x64] Key Found : HKCU\Software\AppDataLow\Software\PriceGong
[x64] Key Found : HKCU\Software\AppDataLow\Software\SmartBar
[x64] Key Found : HKCU\Software\AppDataLow\Toolbar
[x64] Key Found : HKCU\Software\Softonic

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E2415F90-FE4C-4182-964F-51941C8870C3}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B649199E-BB0D-44E5-B5A5-D5C65D98E8ED}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
[x64] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [3821 octets] - [30/08/2012 00:45:13]

########## EOF - C:\AdwCleaner[R1].txt - [3949 octets] ##########

Und schon mal aller Besten dank für die super Hilfe von dir.
Gruß

t'john · 29.08.2012, 23:56

Bereibst du Homebanking mit der Kiste?

---------------

Zitat:

Trojan.Banker

HKCR\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C689C99E-3A8C-4C87-A79C-C80DC9C81632}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C689C99E-3A8C-4C87-A79C-C80DC9C81632}

Trojan.Agent

HKCR\CLSID\{EFF39A40-C163-4d5d-B073-52FBB55C646A}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EFF39A40-C163-4D5D-B073-52FBB55C646A}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EFF39A40-C163-4D5D-B073-52FBB55C646A}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EFF39A40-C163-4D5D-B073-52FBB55C646A}
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|shell

Trojan.Agent.VGENX

C:\_OTL\MovedFiles\08292012_141636\C_Users\MaxMarter\AppData\Roaming\msconfig.dat

Max1988 · 30.08.2012, 08:23

Nein mach ch nich wieso fragst du? Hab noch ma den rechner scannen lassen und er hat nix mehr gefunden ist denn nu alles wieder ok oder muss ich noch irgendwas machen ?

t'john · 30.08.2012, 19:17

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Max1988 · 30.08.2012, 20:41

Der Bericht von adwclener.exe

Code:

ATTFilter

# AdwCleaner v1.801 - Logfile created 08/30/2012 at 20:19:43
# Updated 14/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : MaxMarter - MAXMARTER-PC
# Boot Mode : Normal
# Running from : C:\Users\MaxMarter\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\MaxMarter\AppData\Local\Conduit
Folder Deleted : C:\Users\MaxMarter\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\MaxMarter\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\MaxMarter\AppData\LocalLow\WiseConvert_1.3
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\WiseConvert_1.3

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3242337
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert_1.3 Toolbar
Key Deleted : HKLM\SOFTWARE\WiseConvert_1.3

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E2415F90-FE4C-4182-964F-51941C8870C3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B649199E-BB0D-44E5-B5A5-D5C65D98E8ED}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [3926 octets] - [30/08/2012 00:45:13]
AdwCleaner[S1].txt - [2622 octets] - [30/08/2012 20:19:43]

########## EOF - C:\AdwCleaner[S1].txt - [2750 octets] ##########

un der Bericht von Emsisoft Anti-Malware

Code:

ATTFilter

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 30.08.2012 20:26:21

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, Q:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	30.08.2012 21:08:20

c:\program files (x86)\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\addins 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\cstrike\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\action 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\firearms 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\gearbox 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\halflife\tfc 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\aq2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\battle 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\chaosdm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\freeze 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gloom 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\gxmod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\holywars 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\jail 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\kots 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lfiredm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lithium2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\lmctf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\pball 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\q2comp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\qpong 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\ra2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\sconfig 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\tourney 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake2\wod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\alliance 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\beryllium 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\instagib 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\jailbreak 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\matchmod 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\osp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3comp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3f 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\q3ut2 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\rocketarena3 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\quake3\wfa 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\arena 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ch 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctf 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfb 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\ctfplus 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\dm 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\fr 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\mt 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\open cal 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\rpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\tribes\tac 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\rocketarena 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\custom\ut\swat 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\icons 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\images\portraits 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\profiles\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_common 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_demospy 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_fplanet 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gnews 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_gspyder 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\skins\(default3) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\sounds\classic 	gefunden: Trace.File.gamespy arcade!E1
c:\users\maxmarter\appdata\roaming\microsoft\windows\start menu\programs\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\users\maxmarter\appdata\roaming\microsoft\internet explorer\quick launch\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\users\maxmarter\desktop\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\4dca9208.dat 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\arcres.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\dat.bmp 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_banner.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\aphex.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_bannerbg.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_loading.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_logo.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\def_news.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\fpupdate.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade - debug.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade help.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade website.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gamespy.com gaming's homepage.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsapak.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gslan.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\gsws.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\install.log 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\pw32.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\readme.html 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\register gamespy arcade.url 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\rptcrash.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_news\service_tab+.tga 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\services\_support\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
c:\program files (x86)\gamespy arcade\ws_default.html 	gefunden: Trace.File.gamespy arcade!E1
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir 	gefunden: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname 	gefunden: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring 	gefunden: Trace.Registry.gamespy arcade!E1
C:\Users\MaxMarter\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J6WSKVGM\indexCAXFJMAM.htm 	gefunden: AdWare.JS.Pornpop!E2
C:\Users\MaxMarter\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FFYW54OB\indexCA6PVRL0.htm 	gefunden: AdWare.JS.Pornpop!E2
C:\Users\MaxMarter\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\29XQCV1O\indexCA1CMLLF.htm 	gefunden: AdWare.JS.Pornpop!E2

Gescannt	671356
Gefunden	124

Scan Ende:	30.08.2012 21:39:50
Scan Zeit:	0:31:30

t'john · 31.08.2012, 08:54

Sehr gut!

Deinstalliere:
Emsisoft Anti-Malware

ESET Online Scanner

Vorbereitung

Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

Lade und starte Eset Smartinstaller
Haken setzen bei YES, I accept the Terms of Use.
Klick auf Start.
Haken setzen bei Remove found threads und Scan archives.
Klick auf Start.
Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Finish drücken.
Browser schließen.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
Logfile hier posten.
Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Max1988 · 31.08.2012, 10:08

Hoffe das das alles so richtig ist:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=89ad2eed93c73f459394095d8c7ad3a9
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-31 09:04:41
# local_time=2012-08-31 11:04:41 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 2680394 2680394 0 0
# compatibility_mode=5893 16776573 100 94 266 98030039 0 0
# compatibility_mode=8192 67108863 100 0 105 105 0 0
# scanned=192136
# found=1
# cleaned=1
# scan_time=3693
C:\Users\MaxMarter\Downloads\SoftonicDownloader49024.exe	a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C

t'john · 31.08.2012, 19:32

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 7 ) herunter laden.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

Max1988 · 31.08.2012, 22:18

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Internet Explorer 9.0 ist aktuell

Flash 11,3,300,271 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version!

Java (1,7,0,7) ist aktuell.

Adobe Reader 10,1,0,0 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version: 10,1,3

Bildschirm weiß nach Hochfahren

Log-Analyse und Auswertung: Bildschirm weiß nach Hochfahren