Windows XP: Bundestrojaner und regmonstd auf meinem PC

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Sondern (administrator) on KLEMENS on 03-10-2013 11:13:52
Running from C:\Dokumente und Einstellungen\Sondern\Desktop\Trojaner-Board
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(Hauppauge Inc.) C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
(Analog Devices, Inc.) C:\Programme\Analog Devices\Core\smax4pnp.exe
() C:\Programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe
(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\WINDOWS\vVX1000.exe
(Apple Inc.) C:\Programme\iTunes\iTunesHelper.exe
(Adobe Systems Inc.) C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Safer-Networking Ltd.) C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
(Skype Technologies S.A.) C:\Programme\Skype\Phone\Skype.exe
(Hauppauge Computer Works) C:\Programme\WinTV\Ir.exe
() C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Programme\Bonjour\mDNSResponder.exe
(Hauppauge Computer Works) C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe
(Nero AG) C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
() C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
(Skype Technologies S.A.) C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Programme\iPod\bin\iPodService.exe
(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Microsoft Corporation) C:\Programme\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EPGServiceTool] - C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe [688128 2008-05-15] (Hauppauge Inc.)
HKLM\...\Run: [SoundMAXPnP] - C:\Programme\Analog Devices\Core\smax4pnp.exe [1044480 2010-01-08] (Analog Devices, Inc.)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [EEventManager] - C:\Programme\EPSON\Creativity Suite\Event Manager\EEventManager.exe [118784 2004-08-05] ()
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [APSDaemon] - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM\...\Run: [VX1000] - C:\WINDOWS\vVX1000.exe [757248 2009-06-26] (Microsoft Corporation)
HKLM\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Programme\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM\...\Run: [Acrobat Assistant 7.0] - C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [483328 2004-12-14] (Adobe Systems Inc.)
HKLM\...\Run: [avgnt] - C:\Programme\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-03] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [Skype] - C:\Programme\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\AutoStart IR.lnk
ShortcutTarget: AutoStart IR.lnk -> C:\Programme\WinTV\Ir.exe (Hauppauge Computer Works)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE48D7A1588B6CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: No Name - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -  No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -&Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU -Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 04 C:\Programme\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 18 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 217.0.43.17 217.0.43.49

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\Mozilla\Firefox\Profiles\64zqcauk.default
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @united-navigation.com/FalkDevicePlugin - C:\Programme\Falk\Falk Device Plugin\npFalkPlugin.dll (United Navigation)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: www.united-navigation.com/FalkPlugin - C:\Programme\Falk\Falk Device Plugin\npFalkPlugin.dll (United Navigation)
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Programme\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\Mozilla\Firefox\Profiles\64zqcauk.default\Extensions\chrome
FF Extension: No Name - C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\Mozilla\Firefox\Profiles\64zqcauk.default\Extensions\components
FF Extension: No Name - C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\Mozilla\Firefox\Profiles\64zqcauk.default\Extensions\chrome.manifest
FF Extension: No Name - C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\Mozilla\Firefox\Profiles\64zqcauk.default\Extensions\install.rdf
FF Extension: Skype Click to Call - C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff

========================== Services (Whitelisted) =================

R2 AdobeActiveFileMonitor; C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [98304 2004-10-20] ()
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [84024 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-03] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-03] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008 2012-12-21] (Apple Inc.)
R2 Bonjour Service; C:\Programme\Bonjour\mDNSResponder.exe [390504 2011-08-30] (Apple Inc.)
R2 EPGService; C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [437248 2008-05-30] (Hauppauge Computer Works)
R3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [553288 2013-02-20] (Apple Inc.)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [117144 2013-07-06] (Mozilla Foundation)
R2 Nero BackItUp Scheduler 4.0; C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe [935208 2008-08-29] (Nero AG)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
R2 PhotoshopElementsDeviceConnect; C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [118784 2004-10-20] ()
R2 Skype C2C Service; C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 SkypeUpdate; C:\Programme\Skype\Updater\Updater.exe [161384 2013-02-28] (Skype Technologies)
S2 StarMoney 7.0 OnlineUpdate; C:\Programme\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [554160 2011-11-08] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S2 StarMoney 9.0 OnlineUpdate; C:\Programme\StarMoney 9.0\ouservice\StarMoneyOnlineUpdate.exe [663184 2013-06-13] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf"

==================== Drivers (Whitelisted) ====================

R2 Aspi32; C:\Windows\System32\Drivers\Aspi32.sys [16877 2002-07-16] (Adaptec)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-23] (Avira Operations GmbH & Co. KG)
R3 b57w2k; C:\Windows\System32\DRIVERS\b57xp32.sys [161792 2007-06-06] (Broadcom Corporation)
R1 HCW88AUD; C:\Windows\System32\drivers\hcw88aud.sys [12928 2008-04-19] (Hauppauge Computer Works, Inc)
R3 HCW88BDA; C:\Windows\System32\drivers\hcw88bda.sys [182400 2008-04-19] (Hauppauge Computer Works, Inc)
R3 hcw88rc5; C:\Windows\System32\Drivers\hcw88rc5.sys [12288 2008-04-19] (Hauppauge Computer Works, Inc.)
R3 HCW88TSE; C:\Windows\System32\drivers\hcw88tse.sys [320256 2008-04-19] (Hauppauge Computer Works, Inc)
R3 HCW88TUNE; C:\Windows\System32\drivers\hcw88tun.sys [74624 2008-04-19] (Hauppauge Computer Works, Inc.)
R3 hcw88vid; C:\Windows\System32\drivers\hcw88vid.sys [394880 2008-04-19] (Hauppauge Computer Works, Inc)
R3 HCW88XBAR; C:\Windows\System32\drivers\HCW88BAR.sys [17280 2008-04-19] (Hauppauge Computer Works, Inc.)
S3 MPE; C:\Windows\System32\DRIVERS\MPE.sys [15232 2008-04-14] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-23] (Avira GmbH)
R3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1956096 2009-06-26] (Microsoft Corporation)
S1 wceusbsh; C:\Windows\System32\DRIVERS\wceusbsh.sys [32000 2008-04-14] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\Sondern\LOKALE~1\Temp\catchme.sys [x]
S0 cerc6; No ImagePath
S4 IntelIde; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-03 00:20 - 2013-10-03 00:20 - 98878632 _____ C:\WINDOWS\system32\ᚾߘƌ�
2013-09-21 12:46 - 2013-09-21 12:46 - 00001342 _____ C:\Dokumente und Einstellungen\Sondern\Desktop\JRT.txt
2013-09-21 12:44 - 2013-09-21 12:44 - 00000000 ____D C:\WINDOWS\ERUNT
2013-09-21 12:37 - 2013-09-21 12:38 - 00000000 ____D C:\AdwCleaner
2013-09-21 12:24 - 2013-09-21 12:24 - 00000760 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-21 11:14 - 2013-09-21 11:16 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Desktop\Musikwünsche
2013-09-20 14:21 - 2013-09-20 14:21 - 00014265 _____ C:\ComboFix.txt
2013-09-20 14:15 - 2013-09-20 14:15 - 00000000 _RSHD C:\cmdcons
2013-09-20 14:15 - 2013-09-19 19:04 - 00000211 _____ C:\Boot.bak
2013-09-20 14:15 - 2004-08-03 23:00 - 00262448 __RSH C:\cmldr
2013-09-20 14:12 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-09-20 14:12 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-09-20 14:12 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-09-20 14:12 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-09-20 14:12 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-09-20 14:12 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-09-20 14:12 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-09-20 14:12 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-09-20 14:12 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-09-20 14:09 - 2013-09-20 14:21 - 00000000 ____D C:\Qoobox
2013-09-20 14:09 - 2013-09-20 14:09 - 00000000 ___RD C:\Dokumente und Einstellungen\Sondern\Startmenü\Programme\Verwaltung
2013-09-20 14:08 - 2013-09-20 14:20 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-19 20:46 - 2013-09-19 20:46 - 00000000 ____D C:\FRST
2013-09-19 20:44 - 2013-10-03 11:13 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Desktop\Trojaner-Board
2013-09-19 20:44 - 2013-09-19 20:44 - 00000000 _____ C:\Dokumente und Einstellungen\Sondern\defogger_reenable
2013-09-19 18:39 - 2013-09-19 18:41 - 00000004 _____ C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\settings.ini
2013-09-14 17:54 - 2013-09-14 18:26 - 00216576 _____ C:\Dokumente und Einstellungen\Sondern\Desktop\Einladungsliste.xls
2013-09-11 23:43 - 2013-09-11 23:43 - 00011924 _____ C:\WINDOWS\KB2870699-IE8.log
2013-09-11 23:43 - 2013-09-11 23:43 - 00003080 _____ C:\WINDOWS\updspapi.log
2013-09-11 23:43 - 2013-09-11 23:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-11 23:43 - 2013-09-11 23:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-11 23:42 - 2013-09-11 23:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-11 12:27 - 2013-09-11 23:43 - 00010713 _____ C:\WINDOWS\KB2876315.log
2013-09-11 12:27 - 2013-09-11 23:43 - 00010026 _____ C:\WINDOWS\KB2876217.log
2013-09-11 12:27 - 2013-09-11 23:43 - 00008965 _____ C:\WINDOWS\KB2864063.log

==================== One Month Modified Files and Folders =======

2013-10-03 11:13 - 2013-09-19 20:44 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Desktop\Trojaner-Board
2013-10-03 11:10 - 2011-10-15 22:16 - 01859888 _____ C:\WINDOWS\WindowsUpdate.log
2013-10-03 11:04 - 2012-02-17 00:16 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\Skype
2013-10-03 10:18 - 2013-08-18 16:37 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-10-03 10:18 - 2011-10-15 22:19 - 00032542 _____ C:\WINDOWS\SchedLgU.Txt
2013-10-03 09:39 - 2011-10-23 17:50 - 00000276 _____ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2013-10-03 00:20 - 2013-10-03 00:20 - 98878632 _____ C:\WINDOWS\system32\ᚾߘƌ�
2013-10-02 19:24 - 2008-04-14 14:00 - 00000573 _____ C:\WINDOWS\win.ini
2013-10-02 19:11 - 2011-10-23 17:24 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\Lasersoft Imaging
2013-10-02 18:26 - 2011-10-25 17:00 - 00002347 _____ C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader X.lnk
2013-10-02 18:26 - 2011-10-15 23:10 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
2013-10-02 18:24 - 2011-10-17 22:02 - 00201044 _____ C:\WINDOWS\system32\nvapps.xml
2013-10-02 18:24 - 2011-10-15 23:11 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-10-02 18:24 - 2011-10-15 23:11 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-10-02 18:24 - 2011-10-15 22:39 - 00000000 ____D C:\Programme\WinTV
2013-10-02 18:23 - 2011-10-15 22:19 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-10-01 22:48 - 2011-10-15 22:21 - 00000000 ___HD C:\Dokumente und Einstellungen\Sondern\Netzwerkumgebung
2013-09-30 19:45 - 2008-04-14 14:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2013-09-26 19:57 - 2013-07-06 17:40 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-09-21 23:03 - 2011-10-15 23:10 - 00000000 ___RD C:\Programme
2013-09-21 12:46 - 2013-09-21 12:46 - 00001342 _____ C:\Dokumente und Einstellungen\Sondern\Desktop\JRT.txt
2013-09-21 12:44 - 2013-09-21 12:44 - 00000000 ____D C:\WINDOWS\ERUNT
2013-09-21 12:41 - 2013-08-20 19:31 - 00031623 _____ C:\WINDOWS\setupapi.log
2013-09-21 12:38 - 2013-09-21 12:37 - 00000000 ____D C:\AdwCleaner
2013-09-21 12:24 - 2013-09-21 12:24 - 00000760 _____ C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-21 12:24 - 2012-03-21 22:26 - 00000000 ____D C:\Programme\Malwarebytes' Anti-Malware
2013-09-21 12:24 - 2012-03-21 22:26 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
2013-09-21 11:16 - 2013-09-21 11:14 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Desktop\Musikwünsche
2013-09-21 11:13 - 2013-05-22 23:38 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Desktop\Buchwünsche
2013-09-21 00:25 - 2011-10-15 23:05 - 00002607 _____ C:\Dokumente und Einstellungen\Sondern\Desktop\Microsoft Office Outlook 2003.lnk
2013-09-20 22:27 - 2011-10-15 22:18 - 00000000 __SHD C:\Dokumente und Einstellungen\NetworkService
2013-09-20 14:21 - 2013-09-20 14:21 - 00014265 _____ C:\ComboFix.txt
2013-09-20 14:21 - 2013-09-20 14:09 - 00000000 ____D C:\Qoobox
2013-09-20 14:20 - 2013-09-20 14:08 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-20 14:20 - 2011-10-15 23:10 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
2013-09-20 14:19 - 2008-04-14 14:00 - 00000227 _____ C:\WINDOWS\system.ini
2013-09-20 14:15 - 2013-09-20 14:15 - 00000000 _RSHD C:\cmdcons
2013-09-20 14:15 - 2011-10-16 00:08 - 00000327 __RSH C:\boot.ini
2013-09-20 14:09 - 2013-09-20 14:09 - 00000000 ___RD C:\Dokumente und Einstellungen\Sondern\Startmenü\Programme\Verwaltung
2013-09-20 14:09 - 2011-10-15 22:21 - 00000000 ___RD C:\Dokumente und Einstellungen\Sondern\Startmenü\Programme
2013-09-20 03:18 - 2013-08-18 16:37 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-20 03:18 - 2011-10-17 22:16 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-09-19 21:57 - 2013-05-01 10:47 - 00000000 ____D C:\Programme\StarMoney 9.0
2013-09-19 20:46 - 2013-09-19 20:46 - 00000000 ____D C:\FRST
2013-09-19 20:44 - 2013-09-19 20:44 - 00000000 _____ C:\Dokumente und Einstellungen\Sondern\defogger_reenable
2013-09-19 20:44 - 2011-10-15 22:21 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern
2013-09-19 19:04 - 2013-09-20 14:15 - 00000211 _____ C:\Boot.bak
2013-09-19 19:04 - 2011-10-15 22:21 - 00000300 ___SH C:\Dokumente und Einstellungen\Sondern\ntuser.ini
2013-09-19 19:04 - 2011-10-15 22:21 - 00000000 ___RD C:\Dokumente und Einstellungen\Sondern\Startmenü\Programme\Autostart
2013-09-19 19:02 - 2012-03-21 22:09 - 00000000 ____D C:\WINDOWS\pss
2013-09-19 18:41 - 2013-09-19 18:39 - 00000004 _____ C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\settings.ini
2013-09-14 18:26 - 2013-09-14 17:54 - 00216576 _____ C:\Dokumente und Einstellungen\Sondern\Desktop\Einladungsliste.xls
2013-09-14 15:52 - 2011-10-15 22:21 - 00000000 ___RD C:\Dokumente und Einstellungen\Sondern\Eigene Dateien\Eigene Bilder
2013-09-12 18:34 - 2011-10-15 23:09 - 00221632 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-11 23:43 - 2013-09-11 23:43 - 00011924 _____ C:\WINDOWS\KB2870699-IE8.log
2013-09-11 23:43 - 2013-09-11 23:43 - 00003080 _____ C:\WINDOWS\updspapi.log
2013-09-11 23:43 - 2013-09-11 23:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-11 23:43 - 2013-09-11 23:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-11 23:43 - 2013-09-11 23:42 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-11 23:43 - 2013-09-11 12:27 - 00010713 _____ C:\WINDOWS\KB2876315.log
2013-09-11 23:43 - 2013-09-11 12:27 - 00010026 _____ C:\WINDOWS\KB2876217.log
2013-09-11 23:43 - 2013-09-11 12:27 - 00008965 _____ C:\WINDOWS\KB2864063.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00033205 _____ C:\WINDOWS\iis6.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00030914 _____ C:\WINDOWS\FaxSetup.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00014780 _____ C:\WINDOWS\ocgen.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00014105 _____ C:\WINDOWS\tsoc.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00010303 _____ C:\WINDOWS\comsetup.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00009388 _____ C:\WINDOWS\msmqinst.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00006235 _____ C:\WINDOWS\ntdtcsetup.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00005415 _____ C:\WINDOWS\netfxocm.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00002125 _____ C:\WINDOWS\MedCtrOC.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00001710 _____ C:\WINDOWS\ocmsn.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00001555 _____ C:\WINDOWS\tabletoc.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00001545 _____ C:\WINDOWS\msgsocm.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00001374 _____ C:\WINDOWS\imsins.log
2013-09-11 23:43 - 2013-08-29 03:00 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-09-11 23:43 - 2011-10-18 23:43 - 00000000 ____D C:\WINDOWS\ie8updates
2013-09-11 23:42 - 2013-07-16 19:30 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-09-11 23:41 - 2011-10-18 23:42 - 76725432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-09-11 23:13 - 2011-12-31 15:47 - 00000000 ____D C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2013-09-11 20:43 - 2011-11-27 14:59 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\U3
2013-09-03 22:50 - 2011-10-24 17:44 - 00000000 ____D C:\Dokumente und Einstellungen\Sondern\Desktop\StarMoneyDocument
2013-09-03 13:41 - 2013-08-31 13:32 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-09-03 13:41 - 2013-08-31 13:32 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys

Files to move or delete:
====================
C:\Dokumente und Einstellungen\Sondern\Anwendungsdaten\settings.ini


Some content of TEMP:
====================
C:\Dokumente und Einstellungen\Sondern\Lokale Einstellungen\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e 

C:\Windows\System32\winlogon.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a 

C:\Windows\System32\svchost.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366 

C:\Windows\System32\services.exe
[2008-04-14 14:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc 

C:\Windows\System32\User32.dll
[2008-04-14 14:00] - [2008-04-14 14:00] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd 

C:\Windows\System32\userinit.exe
[2008-04-14 14:00] - [2008-04-14 14:00] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106 

C:\Windows\System32\Drivers\volsnap.sys
[2008-04-14 14:00] - [2008-04-14 14:00] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d 


==================== End Of Log ============================