Hallo, beim Surfen über Firefox an meinem Haupt-PC wurde ich heute wohl Opfer einer Drive-By-Attacke.
Als ich nach einem Neustart versuchte, eine Internetverbindung (Fritz!Wlan USB Stick --> Router) aufzubauen, fiel mir auf, dass nicht mehr alle meiner Netzwerkverbindungen sichtbar waren und ich den Wlan USB-Stick nicht mehr starten konnte (ich meine damit, dass sich der Stick nicht wie normalerweise selbst installiert hat, sondern einfach "geblockt" wurde bei dem Versuch).

Ich habe anschließend Malwarebytes laufen lassen, welches 4 Infizierte Dateien fand:

C:/Dokumente und Einstellungen/XXXXX/Anwendungsdaten/logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:/Dokumente und Einstellungen/Gast/Anwendungsdaten/logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:/Dokumente und Einstellungen/Gast/Lokale Einstellungen/Temp/UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully.
C:/Dokumente und Einstellungen/Gast/Lokale Einstellungen/Temp/XxX.xXx (Malware.Trace) -> Quarantined and deleted successfully.

Danach ließ ich Spybot - Search & Destroy suchen.
Es fand folgendes:

Microsoft.Windows.AppFirewallBypass

(einen Registry-Eintrag mit der Endung zu /C:/WINDOWS/system32/usmt/migwiz.exe)

Nach dem Neustart konnte ich keinerlei Änderungen erkennen. Ein erneuter Scan fand nichts.

Auch konnte ich beim Systemstart neue, mir bisher unbekannte Prozesse auffinden. Ein Beispiel ist "FsUsbExService.Exe" oder "NclUSBSrv.exe".
Ich fand heraus, dass diese Prozesse eigentlich zu dem Nokia/Samsung PC Center gehören, welches ich auch regelmäßig nutze.

Ein erneuter Restart brachte nichts - das Problem bleibt bestehen.

Ich weiß nun gerade gar nicht, was ich tun könnte.


Danke im Vorraus.

EDIT: Habe nun versucht, auf dem infizierten Rechner GMER zu starten, allerdings startet dieser bei dem Versuch einfach neu.

Poste die Logs bitte grundsätzlich vollständig und nicht so einen halben Kram!

Hier der Malwarebytes Log:

Malwarebytes' Anti-Malware 1.42
Datenbank Version: 3358
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.11

07.08.2010 21:56:28
mbam-log-2010-08-07 (21-56-28).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 123852
Laufzeit: 18 minute(s), 20 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Gast\Anwendungsdaten\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Gast\Lokale Einstellungen\Temp\UuU.uUu (Malware.Trace) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Gast\Lokale Einstellungen\Temp\XxX.xXx (Malware.Trace) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.42
Datenbank Version: 3358

Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.
So wärs richtig:

Malwarebytes' Anti-Malware 1.46
Datenbank Version: 4422

Habe nun den Test mit der neuesten Version durchgeführt.
Das Problem besteht weiterhin.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4422

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.11

12.08.2010 21:27:21
mbam-log-2010-08-12 (21-27-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|H:\|)
Durchsuchte Objekte: 360620
Laufzeit: 2 Stunde(n), 34 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Dateien gefunden)

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Doppelklick auf die OTL.exe
• Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
• Unter Extra Registry, wähle bitte Use SafeList
• Klicke nun auf Run Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in den Thread.

OTL.txt

OTL Logfile:

OTL logfile created on: 13.08.2010 22:19:42 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\XXXXXXX\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.022,00 Mb Total Physical Memory | 622,00 Mb Available Physical Memory | 61,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,54 Gb Total Space | 1,59 Gb Free Space | 2,14% Space Free | Partition Type: NTFS
Drive D: | 66,62 Gb Total Space | 1,30 Gb Free Space | 1,96% Space Free | Partition Type: NTFS
Drive E: | 7,87 Gb Total Space | 0,11 Gb Free Space | 1,35% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 995,70 Mb Total Space | 13,05 Mb Free Space | 1,31% Space Free | Partition Type: FAT
I: Drive not present or media not loaded
 
Computer Name: XXXXXXX-XXXXXXX
Current User Name: XXXXXXX
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\XXXXXXX\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avfwsvc.exe (Avira GmbH)
PRC - C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
PRC - C:\Programme\LG Soft India\forteManager\bin\Monitor.exe ()
PRC - C:\Programme\Atomic Alarm Clock\AtomicAlarmClock.exe ()
PRC - C:\Programme\Stardock\CursorFX\CursorFX.exe (Stardock Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe (AOL LLC)
PRC - C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\Programme\A4Tech\Mouse\Amoumain.exe (A4Tech Co., Ltd.)
PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\XXXXXXX\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programme\Stardock\CursorFX\CurXP0.dll ( )
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\Amhooker.dll (A4Tech Co., Ltd.)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\wbsys.dll (Stardock.Net, Inc)
MOD - C:\Programme\AlienGUIse\wbhelp.dll (Stardock.Net, Inc)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (de_serv) -- C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirWebService) -- C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)
SRV - (AntiVirMailService) -- C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirFirewallService) -- C:\Programme\Avira\AntiVir Desktop\avfwsvc.exe (Avira GmbH)
SRV - (FsUsbExService) -- C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (VMnetDHCP) -- C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMware NAT Service) -- C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
SRV - (VMAuthdService) -- C:\Programme\VMware\VMware Workstation\vmware-authd.exe (VMware, Inc.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (ufad-ws60) -- C:\Programme\VMware\VMware Workstation\vmware-ufad.exe (VMware, Inc.)
SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) -- C:\Programme\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (IGDCTRL) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (PSI_SVC_2) -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (UPnPService) -- C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (AOL ACS) -- C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe (AOL LLC)
SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (x10nets) -- C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (viamraid) -- C:\WINDOWS\System32\DRIVERS\viamraid.sys File not found
DRV - (USBAAPL) -- C:\WINDOWS\System32\Drivers\usbaapl.sys File not found
DRV - (Trufos) -- C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\trufos.sys File not found
DRV - (Profos) -- C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\profos.sys File not found
DRV - (pfc) -- C:\WINDOWS\System32\drivers\pfc.sys File not found
DRV - (cpuz130) -- C:\DOKUME~1\XXXXXXX~1\LOKALE~1\Temp\cpuz130\cpuz_x32.sys File not found
DRV - (AVSNDISIMMP) -- C:\WINDOWS\System32\DRIVERS\AVSNDISIMDriver.sys File not found
DRV - (AVSNDISIM) -- C:\WINDOWS\System32\DRIVERS\AVSNDISIMDriver.sys File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avfwot) -- C:\WINDOWS\system32\drivers\avfwot.sys (Avira GmbH)
DRV - (avfwim) -- C:\WINDOWS\system32\drivers\avfwim.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (FsUsbExDisk) -- C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (tap0901) -- C:\WINDOWS\system32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (Tcpip6) -- C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (taphss) -- C:\WINDOWS\system32\drivers\taphss.sys (AnchorFree Inc)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (hcmon) -- C:\WINDOWS\system32\drivers\hcmon.sys (VMware, Inc.)
DRV - (vmci) -- C:\WINDOWS\system32\drivers\vmci.sys (VMware, Inc.)
DRV - (VMnetuserif) -- C:\WINDOWS\system32\drivers\vmnetuserif.sys (VMware, Inc.)
DRV - (vmx86) -- C:\WINDOWS\system32\drivers\vmx86.sys (VMware, Inc.)
DRV - (vmkbd) -- C:\WINDOWS\system32\drivers\VMkbd.sys (VMware, Inc.)
DRV - (VMparport) -- C:\WINDOWS\system32\drivers\vmparport.sys (VMware, Inc.)
DRV - (VMnetBridge) -- C:\WINDOWS\system32\drivers\vmnetbridge.sys (VMware, Inc.)
DRV - (VMnetAdapter) -- C:\WINDOWS\system32\drivers\vmnetadapter.sys (VMware, Inc.)
DRV - (SCREAMINGBDRIVER) -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)
DRV - (LGII2CDevice) -- C:\Programme\LG Soft India\forteManager\bin\PII2CDriver.sys ()
DRV - (LGDDCDevice) -- C:\Programme\LG Soft India\forteManager\bin\I2CDriver.sys ()
DRV - (vstor2-ws60) -- C:\Programme\VMware\VMware Workstation\vstor2-ws60.sys (VMware, Inc.)
DRV - (SRS_iWowPC_Service) -- C:\WINDOWS\system32\drivers\SRS_iWowPC_i386.sys ()
DRV - (BootScreen) -- C:\WINDOWS\System32\drivers\vidstub.sys ()
DRV - (NPF) -- C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (scramby_out) -- C:\WINDOWS\system32\drivers\scramby_out.sys (RapidSolution Software AG)
DRV - (Maplom) -- C:\WINDOWS\System32\drivers\maplom.sys (SlySoft Inc.)
DRV - (nmwcdsa) -- C:\WINDOWS\system32\drivers\nmwcdsa.sys (Nokia)
DRV - (nmwcdsacm) -- C:\WINDOWS\system32\drivers\nmwcdsacm.sys (Nokia)
DRV - (nmwcdsacj) -- C:\WINDOWS\system32\drivers\nmwcdsacj.sys (Nokia)
DRV - (nmwcdsac) -- C:\WINDOWS\system32\drivers\nmwcdsac.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\nmwcd.sys (Nokia)
DRV - (nmwcdcm) -- C:\WINDOWS\system32\drivers\nmwcdcm.sys (Nokia)
DRV - (nmwcdcj) -- C:\WINDOWS\system32\drivers\nmwcdcj.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\nmwcdc.sys (Nokia)
DRV - (scramby) -- C:\WINDOWS\system32\drivers\scramby.sys (RapidSolution Software AG)
DRV - (Afc) -- C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (TarFltr) -- C:\WINDOWS\system32\drivers\UsbFltr.sys (Waytech Development, Inc.)
DRV - (FWLANUSB) -- C:\WINDOWS\system32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (Amusbprt) -- C:\WINDOWS\system32\drivers\Amusbprt.sys (A4Tech Co.,Ltd.)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (Amfilter) -- C:\WINDOWS\system32\drivers\Amfilter.sys (A4Tech Co.,Ltd.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (MouseCap) -- C:\WINDOWS\system32\drivers\MouseCap.sys ()
DRV - (Moufiltr) -- C:\WINDOWS\system32\drivers\Moufiltr.sys (Windows (R) 2000 DDK provider)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
DRV - (ASPI) -- C:\WINDOWS\system32\drivers\ASPI32.SYS (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.egisca.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook: {1CFFA392-0898-4b1c-89D1-6E98F9D8EF78} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EDA081CA-C809-49F0-B2D8-151DA26A6CF8} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box;192.168.178.1
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.de/search?q="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.47.4
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.7
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: support@lastpass.com:1.69.1
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.8.3
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: {9c51bd27-6ed8-4000-a2bf-36cb95c0c947}:11.0.1
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.3
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1
FF - prefs.js..extensions.enabledItems: info@youtube-mp3.org:1.0.1
FF - prefs.js..keyword.URL: "hxxp://www.google.de/search?q="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Programme\Google\Google Gears\Firefox\ [2010.03.05 20:11:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: D:\Firefox\components [2010.04.08 21:21:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: D:\Firefox\plugins [2010.04.08 21:21:18 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.25 00:20:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.25 00:20:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\bdThunderbird@bitdefender.com: C:\Programme\BitDefender\BitDefender 2008\tbextension
 
[2009.01.30 21:40:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Extensions
[2010.06.18 16:15:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b44bnjm1.Neuer Benutzer\extensions
[2009.06.28 00:48:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b44bnjm1.Neuer Benutzer\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.04.27 19:36:05 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b44bnjm1.Neuer Benutzer\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2009.07.04 21:12:38 | 000,000,000 | ---D | M] (jDownFF) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b44bnjm1.Neuer Benutzer\extensions\{a3b24d40-bac4-11dc-95ff-0800200c9a66}
[2010.04.27 19:36:05 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b44bnjm1.Neuer Benutzer\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.08.07 18:43:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b9rd8j04.Neu\extensions
[2009.06.27 11:42:47 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b9rd8j04.Neu\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.12.16 16:41:22 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b9rd8j04.Neu\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009.06.07 14:29:08 | 000,000,000 | ---D | M] (Platypus) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b9rd8j04.Neu\extensions\{a089fffd-e0cb-431b-8d3a-ebb8afb26dcf}
[2010.02.02 14:39:50 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b9rd8j04.Neu\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2009.12.15 18:23:40 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\b9rd8j04.Neu\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.04.08 21:21:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions
[2009.03.28 15:32:41 | 000,000,000 | ---D | M] (CS Lite) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{00084897-021a-4361-8423-083407a033e0}
[2009.03.28 15:32:54 | 000,000,000 | ---D | M] (Image Zoom) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
[2009.11.28 18:51:30 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.03.28 15:32:54 | 000,000,000 | ---D | M] (Groowe Search Toolbar) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{268ad77e-cff8-42d7-b479-da60a7b93305}
[2009.03.28 15:32:46 | 000,000,000 | ---D | M] (Forecastbar Enhanced) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}
[2009.03.28 15:32:42 | 000,000,000 | ---D | M] (JonDoFox) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{437be45a-4114-11dd-b9ab-71d256d89593}
[2009.03.28 15:32:46 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2009.03.28 15:32:41 | 000,000,000 | ---D | M] (Dr.Web anti-virus link checker) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
[2009.03.28 15:32:44 | 000,000,000 | ---D | M] (SafeCache) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{670a77c5-010e-4476-a8ce-d09171318839}
[2009.03.28 15:32:46 | 000,000,000 | ---D | M] (Copy Plain Text) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{723AAF16-AF1F-4404-A5D7-0BFE39766605}
[2009.03.28 15:32:43 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010.04.08 21:07:29 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{76fa7c10-8169-11de-8a39-0800200c9a66}
[2009.03.28 15:32:55 | 000,000,000 | ---D | M] (TabRenamizer) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{792BDDFE-2E7C-42ed-B18D-18154D2761BD}
[2009.03.28 15:32:56 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
[2009.03.28 15:32:55 | 000,000,000 | ---D | M] (MR Tech Toolkit) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}
[2009.03.28 15:32:45 | 000,000,000 | ---D | M] (CacheIt!) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{98449521-9320-4257-aa35-9e1a39c8cbe0}
[2009.03.28 15:32:45 | 000,000,000 | ---D | M] (Calculator) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}
[2009.03.28 15:32:44 | 000,000,000 | ---D | M] (Temporary Inbox) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{ac1e10b8-206d-4746-a18e-0483852dc20b}
[2009.03.28 15:32:41 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2009.03.28 15:32:55 | 000,000,000 | ---D | M] (Plain Text to Link) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{C90B0826-5A17-4970-A5BF-A43D22452E21}
[2009.03.28 15:32:42 | 000,000,000 | ---D | M] (Media Pirate - The video downloader) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cc265d3d-3f6f-0170-a78b-bbbaef7a868c}
[2009.03.28 15:32:55 | 000,000,000 | ---D | M] (JSView) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{cf15270e-cf08-4def-b4ea-6a5ac23f3bca}
[2009.03.28 15:32:40 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009.03.28 15:32:54 | 000,000,000 | ---D | M] (FoxClocks) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2009.03.28 15:32:42 | 000,000,000 | ---D | M] (Menu Editor) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
[2009.08.04 23:28:47 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2009.03.28 15:32:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\abhere2@moztw.org
[2009.03.28 15:32:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\beysim@beysim.net
[2009.03.28 15:32:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\elemhidehelper@adblockplus.org
[2010.04.08 21:21:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\staged-xpis
[2010.04.08 21:14:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\JonDoFox\extensions\stats@vintacore.com
[2010.08.07 14:55:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions
[2010.02.11 16:08:31 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}(2)
[2010.07.13 20:30:00 | 000,000,000 | ---D | M] (Flagfox) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010.07.30 23:30:47 | 000,000,000 | ---D | M] (Session Manager) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2010.05.08 22:49:10 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.02.11 16:08:32 | 000,000,000 | ---D | M] (SmoothWheel (mozdev.org)) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{5F590AA2-1221-4113-A6F4-A4BB62414FAC}(2)
[2010.02.11 16:08:31 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2)
[2010.06.21 17:20:23 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.07.13 20:29:59 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.04.10 15:20:59 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2010.07.16 00:23:38 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010.06.21 17:20:10 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010.04.08 20:09:00 | 000,000,000 | ---D | M] (BlockSite) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2010.02.11 16:08:34 | 000,000,000 | ---D | M] (Gradient iCool) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{de5809e0-2b07-11dd-bd0b-0800200c9a66}(2)
[2010.06.21 17:20:20 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{E4091D66-127C-11DB-903A-DE80D2EFDFE8}
[2010.04.10 15:21:09 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.02.11 16:08:33 | 000,000,000 | ---D | M] (New Tab King) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}(2)
[2008.03.09 10:46:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\fdm_ffext@freedownloadmanager.org
[2010.06.21 17:20:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\info@youtube-mp3.org
[2010.05.08 22:49:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\personas@christopher.beard
[2009.08.30 13:09:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\redshift_V2@shift-themes.com
[2010.07.30 23:30:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\staged-xpis
[2010.07.14 23:50:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\support@lastpass.com
[2010.02.10 19:49:17 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}(2)\chrome(2)\mozapps\extensions
[2009.07.30 23:11:12 | 000,002,679 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\searchplugins\collectr.xml
[2009.07.30 23:11:13 | 000,001,730 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\searchplugins\erweiterungende.xml
[2009.07.30 23:11:13 | 000,001,022 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\searchplugins\goo-green-label.xml
[2009.07.30 23:11:13 | 000,002,621 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\searchplugins\mozilla-add-ons.xml
[2009.07.30 23:11:13 | 000,002,026 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\searchplugins\softonicde.xml
[2009.07.30 23:11:13 | 000,001,287 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\searchplugins\yahoo-answers.xml
[2009.07.30 23:11:13 | 000,002,264 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\Mozilla\Firefox\Profiles\nk2zea58.default\searchplugins\youtube-videosuche.xml
[2010.06.18 21:03:55 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2008.01.08 02:45:16 | 000,054,600 | ---- | M] (BitTorrent, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npbittorrent.dll
[2007.03.10 01:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Programme\Mozilla Firefox\plugins\npyaxmpb.dll
[2010.04.01 18:54:38 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.04.01 18:54:38 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.04.01 18:54:38 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.04.01 18:54:38 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.04.01 18:54:38 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.05.23 21:57:33 | 000,358,975 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1    update.bitdefender.com
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 12319 more lines...
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Programme\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {C1E68079-1B2C-41D7-A3C2-BE82E570251E} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A6F74643-242A-A7A4-8DD5-DB40B9E25345} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C1E68079-1B2C-41D7-A3C2-BE82E570251E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DAF8EC58-AC63-40D0-9224-1583F6D55716} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [KernelFaultCheck]  File not found
O4 - HKLM..\Run: [LogonStudio] C:\Programme\WinCustomize\LogonStudio\logonstudio.exe (Stardock and Luca Saggese)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz]  File not found
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [WheelMouse] C:\Programme\A4Tech\Mouse\Amoumain.exe (A4Tech Co., Ltd.)
O4 - HKCU..\Run: [CursorFX] C:\Programme\Stardock\CursorFX\CursorFX.exe (Stardock Corporation)
O4 - HKCU..\Run: [SkinClock] C:\Programme\Atomic Alarm Clock\AtomicAlarmClock.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\forteManager.lnk = C:\Programme\LG Soft India\forteManager\bin\Monitor.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\system32\spynet\SPY_NET_RAT.exe File not found
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = B1 00 00 00  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Start_EnabledDragDrop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\system32\spynet\SPY_NET_RAT.exe File not found
O8 - Extra context menu item: &AOL Toolbar-Suche - c:\Programme\AOL\AOL Toolbar 4.0\resources\de-DE\local\search.html ()
O9 - Extra 'Tools' menuitem : &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Programme\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\FRITZ!DSL\\sarah.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Programme\FRITZ!DSL\sarah.dll (AVM Berlin)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Programme\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Programme\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL) - C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL File not found
O20 - AppInit_DLLs: (wbsys.dll) - C:\WINDOWS\System32\wbsys.dll (Stardock.Net, Inc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\WB: DllName - C:\Programme\AlienGUIse\fastload.dll - C:\Programme\AlienGUIse\fastload.dll (Stardock)
O24 - Desktop Components:0 () - 
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\XXXXXXX\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\XXXXXXX\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\Shell - "" = AutoRun
O33 - MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\Shell\AutoRun\command - "" = K:\Autorun.exe -- File not found
O33 - MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\Shell - "" = AutoRun
O33 - MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\Shell\AutoRun\command - "" = L:\pushinst.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.13 22:11:00 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\XXXXXXX\Desktop\OTL.exe
[2010.08.12 21:34:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\XXXXXXX\Recent
[2010.07.20 23:01:17 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Skype
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.13 22:17:05 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010.08.13 22:09:01 | 000,000,814 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Anwendungsdaten\AtomicAlarmClock.ini
[2010.08.13 22:07:52 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.08.13 22:07:43 | 000,276,202 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010.08.13 22:07:42 | 000,000,024 | ---- | M] () -- C:\WINDOWS\LogonStudio.ini
[2010.08.13 22:06:51 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010.08.13 22:06:32 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.08.13 22:06:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.08.13 16:43:26 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\XXXXXXX\Desktop\OTL.exe
[2010.08.12 21:35:00 | 016,515,072 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\ntuser.dat
[2010.08.12 20:36:00 | 000,001,232 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1275210071-796845957-839522115-1004UA.job
[2010.08.12 18:39:30 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.07 23:01:18 | 000,293,376 | ---- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\Desktop\0rle0fbf.exe
[2010.08.07 00:48:37 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\XXXXXXX\ntuser.ini
[2010.08.07 00:36:00 | 000,001,180 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1275210071-796845957-839522115-1004Core.job
[2010.08.04 21:18:19 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.08.02 13:10:53 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2010.07.24 18:55:27 | 000,001,074 | ---- | M] () -- C:\WINDOWS\win.ini
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.12 18:39:30 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.09 21:04:40 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2010.06.29 19:31:10 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010.06.05 21:38:45 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll
[2010.06.05 21:38:45 | 000,036,640 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys
[2010.05.07 19:02:38 | 000,137,464 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010.05.06 21:30:05 | 000,000,283 | ---- | C] () -- C:\WINDOWS\game.ini
[2010.04.06 01:16:07 | 000,001,816 | ---- | C] () -- C:\WINDOWS\TSearch.INI
[2010.02.08 22:20:13 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
[2010.02.08 22:20:13 | 000,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
[2009.11.29 18:31:12 | 000,000,015 | ---- | C] () -- C:\WINDOWS\SCHEIBE.INI
[2009.11.15 15:09:26 | 000,000,237 | ---- | C] () -- C:\WINDOWS\gfscore.ini
[2009.11.15 15:05:06 | 000,000,018 | ---- | C] () -- C:\WINDOWS\gfact.ini
[2009.10.26 19:40:35 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009.09.30 16:19:06 | 000,055,856 | R--- | C] () -- C:\WINDOWS\System32\vnetinst.dll
[2009.09.03 16:11:32 | 000,000,075 | ---- | C] () -- C:\WINDOWS\KTEL.INI
[2009.06.20 00:13:23 | 000,000,650 | ---- | C] () -- C:\WINDOWS\BeatBox.INI
[2009.05.31 12:39:50 | 000,080,384 | R--- | C] () -- C:\WINDOWS\System32\drivers\tshd4_kern_i386.sys
[2009.05.31 12:39:50 | 000,061,952 | R--- | C] () -- C:\WINDOWS\System32\drivers\cshp_kern_i386.sys
[2009.05.31 12:39:50 | 000,043,776 | R--- | C] () -- C:\WINDOWS\System32\drivers\hp360_kern_i386.sys
[2009.05.31 12:39:50 | 000,037,888 | R--- | C] () -- C:\WINDOWS\System32\drivers\SRS_iWowPC_i386.sys
[2009.05.21 17:53:36 | 000,554,496 | ---- | C] () -- C:\WINDOWS\System32\dvmsg.dll
[2009.05.17 14:57:51 | 000,016,000 | ---- | C] () -- C:\WINDOWS\System32\drivers\linsgt.sys
[2009.05.09 16:27:38 | 000,000,028 | ---- | C] () -- C:\WINDOWS\Robota.INI
[2009.05.09 16:20:58 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\mgxasio2.dll
[2009.02.28 15:11:41 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008.08.22 22:58:06 | 000,000,111 | ---- | C] () -- C:\WINDOWS\ANS2000.INI
[2008.08.22 22:58:06 | 000,000,020 | -H-- | C] () -- C:\WINDOWS\akebook.ini
[2008.08.22 22:58:06 | 000,000,004 | -H-- | C] () -- C:\WINDOWS\a3kebook.ini
[2008.08.18 15:15:22 | 000,000,121 | ---- | C] () -- C:\WINDOWS\bdagent.INI
[2008.07.05 11:03:49 | 000,000,024 | ---- | C] () -- C:\WINDOWS\LogonStudio.ini
[2008.07.05 10:57:11 | 000,187,392 | ---- | C] () -- C:\WINDOWS\System32\JPGUtils.dll
[2008.07.03 17:46:49 | 000,163,712 | ---- | C] () -- C:\WINDOWS\System32\drivers\vidstub.sys
[2008.06.14 16:15:35 | 000,722,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008.03.08 18:48:56 | 000,000,052 | ---- | C] () -- C:\WINDOWS\wb.ini
[2008.02.04 20:15:39 | 000,021,504 | ---- | C] () -- C:\WINDOWS\jestertb.dll
[2008.01.01 14:20:37 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2007.12.29 21:05:36 | 000,000,063 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2007.11.22 20:38:16 | 000,000,240 | ---- | C] () -- C:\WINDOWS\KLETT.INI
[2007.11.16 21:34:27 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.11.15 16:35:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\odbcddp.ini
[2007.11.15 16:23:33 | 000,002,354 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007.11.14 13:05:46 | 000,000,118 | ---- | C] () -- C:\WINDOWS\asciiart.ini
[2007.11.06 22:19:28 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2007.10.20 15:43:45 | 000,000,144 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini
[2007.09.17 01:07:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007.08.17 10:56:51 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2007.07.30 19:24:29 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll
[2007.07.30 19:23:43 | 000,007,119 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini
[2007.06.18 10:35:38 | 000,000,008 | RHS- | C] () -- C:\WINDOWS\System32\67148CCBE5.sys
[2007.06.18 10:35:31 | 000,004,184 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2007.06.02 12:39:40 | 000,000,224 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2007.05.29 12:48:16 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDEC64Euro.ini
[2007.05.26 21:45:41 | 000,157,184 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2007.04.13 22:40:03 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\USBaccess.dll
[2006.11.18 00:04:17 | 000,235,520 | ---- | C] () -- C:\WINDOWS\System32\jangraphics.dll
[2005.08.08 14:44:04 | 000,006,640 | ---- | C] () -- C:\WINDOWS\System32\drivers\MouseCap.sys
[2005.07.01 13:15:20 | 000,001,022 | ---- | C] () -- C:\WINDOWS\System32\Generic.ini
[2005.07.01 10:38:06 | 000,000,232 | ---- | C] () -- C:\WINDOWS\SwapDrvrSP3.ini
[2005.07.01 10:37:46 | 000,000,233 | ---- | C] () -- C:\WINDOWS\SwapDrvrSP2.ini
[2005.02.05 21:46:00 | 000,004,608 | ---- | C] () -- C:\WINDOWS\fgexec.dll
[2004.11.22 10:05:42 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\Tidriver.dll
[2004.11.22 09:58:02 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\TIPAGE.DLL
[2004.09.28 23:54:30 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 512 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:05EE1EEF
@Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29
< End of report >
         

--- --- ---



Extras.txt

OTL Logfile:

OTL Extras logfile created on: 13.08.2010 22:19:42 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Dokumente und Einstellungen\XXXXXXX\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.022,00 Mb Total Physical Memory | 622,00 Mb Available Physical Memory | 61,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,54 Gb Total Space | 1,59 Gb Free Space | 2,14% Space Free | Partition Type: NTFS
Drive D: | 66,62 Gb Total Space | 1,30 Gb Free Space | 1,96% Space Free | Partition Type: NTFS
Drive E: | 7,87 Gb Total Space | 0,11 Gb Free Space | 1,35% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 995,70 Mb Total Space | 13,05 Mb Free Space | 1,31% Space Free | Partition Type: FAT
I: Drive not present or media not loaded
 
Computer Name: XXXXXXX
Current User Name: XXXXXXX
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"33336:TCP" = 33336:TCP:*:Enabled:EE
"33336:UDP" = 33336:UDP:*:Enabled:EE
"33334:TCP" = 33334:TCP:*:Enabled:EE
"33334:UDP" = 33334:UDP:*:Enabled:EE
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Programme\AOL 9.0\waol.exe" = C:\Programme\AOL 9.0\waol.exe:*:Enabled:AOL 9.0 -- (America Online, Inc.)
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"I:\fsetup.exe" = I:\fsetup.exe:*:Enabled:AVM FSetup Application -- File not found
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLDial.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Programme\AOL 9.0\waol.exe" = C:\Programme\AOL 9.0\waol.exe:*:Enabled:AOL 9.0 -- (America Online, Inc.)
"C:\Programme\FRITZ!DSL\FBOXUPD.EXE" = C:\Programme\FRITZ!DSL\FBOXUPD.EXE:*:Enabled:AVM FRITZ!Box Firmware-Update -- (AVM Berlin)
"C:\Programme\Gemeinsame Dateien\aol\1180210672\ee\aolsoftware.exe" = C:\Programme\Gemeinsame Dateien\aol\1180210672\ee\aolsoftware.exe:*:Enabled:AOL Services -- (America Online, Inc.)
"C:\Programme\Gemeinsame Dateien\aol\1180210672\ee\aim6.exe" = C:\Programme\Gemeinsame Dateien\aol\1180210672\ee\aim6.exe:*:Enabled:AIM -- (AOL LLC)
"C:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE" = C:\WINDOWS\system32\spool\drivers\w32x86\3\SAGENT4.EXE:*:Enabled:SAgent4 -- (SEIKO EPSON CORPORATION)
"C:\Programme\Gemeinsame Dateien\aol\1180210672\ee\aexplore.exe" = C:\Programme\Gemeinsame Dateien\aol\1180210672\ee\aexplore.exe:*:Enabled:AOL Browser -- (AOL LLC)
"C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe" = C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe:*:Enabled:AOL Optimized Dial-In -- (AOL LLC)
"C:\Programme\FRITZ!DSL\IGDCTRL.EXE" = C:\Programme\FRITZ!DSL\IGDCTRL.EXE:*:Enabled:AVM FRITZ!DSL - igdctrl.exe -- (AVM Berlin)
"C:\Programme\FRITZ!DSL\WebwaIgd.exe" = C:\Programme\FRITZ!DSL\WebwaIgd.exe:*:Enabled:AVM FRITZ!DSL - webwaigd.exe -- (AVM Berlin)
"C:\Programme\AOL 9.0 VR\waol.exe" = C:\Programme\AOL 9.0 VR\waol.exe:*:Enabled:AOL -- (AOL, LLC.)
"C:\Programme\Gemeinsame Dateien\aol\TopSpeed\3.0\aoltpsd3.exe" = C:\Programme\Gemeinsame Dateien\aol\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed -- (AOL LLC)
"C:\Programme\Gemeinsame Dateien\aol\Loader\aolload.exe" = C:\Programme\Gemeinsame Dateien\aol\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)
"C:\Programme\Gemeinsame Dateien\aol\System Information\sinf.exe" = C:\Programme\Gemeinsame Dateien\aol\System Information\sinf.exe:*:Enabled:AOL System Information -- (AOL LLC)
"C:\Programme\AOL 9.0 VRa\waol.exe" = C:\Programme\AOL 9.0 VRa\waol.exe:*:Enabled:AOL -- (AOL, LLC.)
"C:\Programme\Anno 1701\Anno1701.exe" = C:\Programme\Anno 1701\Anno1701.exe:*:Enabled:Anno 1701 -- File not found
"C:\WINDOWS\system32\usmt\migwiz.exe" = C:\WINDOWS\system32\usmt\migwiz.exe:*:Enabled:Assistent zum Übertragen von Dateien und Einstellungen -- (Microsoft Corporation)
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- File not found
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Xfire\Xfire.exe" = C:\Programme\Xfire\Xfire.exe:*:Enabled:Xfire -- (Xfire Inc.)
"C:\Programme\VMware\VMware Workstation\vmware-authd.exe" = C:\Programme\VMware\VMware Workstation\vmware-authd.exe:*:Enabled:VMware Authd -- (VMware, Inc.)
"C:\Programme\Pidgin\pidgin.exe" = C:\Programme\Pidgin\pidgin.exe:*:Enabled:Pidgin -- (The Pidgin developer community)
"C:\Programme\Zattoo\zattood.exe" = C:\Programme\Zattoo\zattood.exe:*:Enabled:zattood -- File not found
"C:\Programme\Safari\Safari.exe" = C:\Programme\Safari\Safari.exe:*:Enabled:Safari Web Browser -- File not found
"C:\Programme\uTorrent\uTorrent.exe" = C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Dokumente und Einstellungen\XXXXXXX\temp\TeamViewer\Version5\TeamViewer.exe" = C:\Dokumente und Einstellungen\XXXXXXX\temp\TeamViewer\Version5\TeamViewer.exe:*:Enabled:TeamViewer -- (TeamViewer GmbH)
"C:\Programme\Opera 10 Beta\opera.exe" = C:\Programme\Opera 10 Beta\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\HLSW\hlsw.exe" = C:\Programme\HLSW\hlsw.exe:*:Enabled:HLSW Application -- (Stripf Software)
"C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server -- (PeeringPortal)
"C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server -- (PeeringPortal)
"C:\Programme\ICQ7.2\ICQ.exe" = C:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Programme\ICQ7.2\aolload.exe" = C:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW(R) Graphics Suite X4
"_{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime
"{044F9133-B8D7-4d11-BF39-803FA20F5C8B}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{086a7d8c-0a38-4c7f-819a-620275550d5c}" = Nero Burning ROM Help
"{0AE95CE7-910B-48EF-9C71-2B23004603DA}" = PixiePack Codec Pack
"{0E592C31-09EF-3CA1-A7DE-05D13DFCF791}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - deu
"{12803180-9CAD-11DE-B804-005056806466}" = Google Earth
"{1c00c7c5-e615-4139-b817-7f4003de68c0}" = Nero PhotoSnap Help
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{2457326B-C110-40C3-89B0-889CC913871A}" = AVM FRITZ!DSL
"{247A11CA-F5CE-4DD6-85E2-64850E64E064}" = USB2.0 CARD READER
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 16
"{2BD5C305-1B27-4D41-B690-7A61172D2FEB}" = Macromedia Flash 8
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{359cfc0a-beb1-440d-95ba-cf63a86da34f}" = Nero Recode
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{44A27085-0616-4181-A0C3-81C7ECA17F73}" = CorelDRAW Graphics Suite X4
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision
"{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{738B0934-6676-44F6-AB52-32F4E60DCA7F}" = Microsoft SQL Server Compact 3.5 SP1 Design Tools (Deutsch)
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{77e33d87-255e-413e-9c8d-eed2a7f9bebf}" = Nero Live Help
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7EC19307-7C22-47A8-922B-3FA965291260}" = OpenOffice.org 3.0
"{7F05E704-30A6-421A-97A7-8EEB1C7FF010}" = CorelDRAW Graphics SUite X4 - ICA
"{7F05E704-30A6-421A-97A7-8EEB1C7FF012}" = CorelDRAW Graphics Suite X4 - Capture
"{7F05E704-30A6-421A-97A7-8EEB1C7FF013}" = CorelDRAW Graphics Suite X4 - Draw
"{7F05E704-30A6-421A-97A7-8EEB1C7FF014}" = CorelDRAW Graphics Suite X4 - PP
"{7F05E704-30A6-421A-97A7-8EEB1C7FF016}" = CorelDRAW Graphics Suite X4 - Content
"{7F05E704-30A6-421A-97A7-8EEB1C7FF017}" = CorelDRAW Graphics Suite X4 - Filters
"{7F05E704-30A6-421A-97A7-8EEB1C7FF019}" = CorelDRAW Graphics Suite X4 - FontNav
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help
"{85243696-5e58-4357-9cf8-3498c609941d}" = NeroLiveGadget Help
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A793FC6-6DF5-11DD-BB6A-00018021113F}" = EPSON PhotoQuicker3.4
"{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder
"{8F714418-F3C3-3BF0-B548-E4BDA7AD41DE}" = Microsoft Visual Basic 2008 Express Edition with SP1 - DEU
"{90170407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{90840407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{972B1D9B-0EAD-49E8-B7D6-3B83FD5665B1}" = Nokia Connectivity Cable Driver
"{989112B0-74DB-4A40-932F-580049CD0B97}" = Visual Basic for Applications (R) Core - German
"{98a67610-a3b5-4098-a423-3708040026d3}" = "Nero SoundTrax Help
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}" = CorelDRAW Graphics Suite X4 - IPM
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{9e82b934-9a25-445b-b8df-8012808074ac}" = Nero PhotoSnap
"{9e9fdde6-2c26-492a-85a0-05646b3f2795}" = NeroLiveGadget
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{a209525b-3377-43f4-b886-32f6b6e7356f}" = Nero WaveEditor
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3FF5CB2-FB35-4658-8751-9EDE1D65B3AA}" = VMware Workstation
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6F6C80-1C35-4672-BDEF-F26FF214C409}" = Samsung PC Studio 7
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{ad6bc5cc-2ef0-49c4-b33d-cdc8b2c4dc80}" = Nero Recode Help
"{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}" = CorelDRAW Graphics Suite X4 - Lang DE
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{b1adf008-e898-4fe2-8a1f-690d9a06acaf}" = DolbyFiles
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B61D21B6-469D-4423-B161-62DB20B8A70E}" = Visual Basic for Applications (R) Core - English
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{BF439B41-0252-48DE-8B8B-0430CB26A181}" = CorelDRAW Graphics Suite X4 - VBA
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1080852-065E-4991-9260-F3756E3CC182}" = CursorFX
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}" = SoundTrax
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE2DA11A-917F-4CF5-AB55-755EC115DD10}" = CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{d025a639-b9c9-417d-8531-208859000af8}" = NeroBurningROM
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{DA6FAB8D-E87A-4E8E-A3D3-B7B9F479C725}" = forteManager
"{DB81779E-7CC5-4630-BCFC-754004956444}" = Visual Basic for Applications (R) Core
"{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}" = Nero Live
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed
"{e8631efb-6b9a-426c-b1ce-e7173ca26bf8}" = Nero WaveEditor Help
"{E89B484C-B913-49A0-959B-89E836001658}" = GEAR 32bit Driver Installer
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{f1861f30-3419-44db-b2a1-c274825698b3}" = Nero Disc Copy Gadget
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights
"{FA440BE8-EC2F-4478-A01A-077DA0606501}" = Microsoft SQL Server Compact 3.5 SP1 (Deutsch)
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"0C5EDC3653FED5B121F464339EAC12534D253B25" = Windows Driver Package - Nokia Modem  (02/15/2007 3.1)
"12345_is1" = WeGame Client Public Beta 1.2.1
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"AlienGUIse Theme Manager" = AlienGUIse Theme Manager
"AOL Deinstallation" = AOL Deinstallation
"AOL Installations-Manager" = AOL Installations-Manager
"AOL Toolbar 4.0" = 
"AOLCoach de" = AOL Coach Version 1.0(Build:20040229.1 de)
"Atomic Alarm Clock_is1" = Atomic Alarm Clock 5.81
"Avira AntiVir Desktop" = Avira Premium Security Suite
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxMonitor" = AVM FRITZ!Box Monitor
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"AVMWLANCLI" = AVM FRITZ!WLAN
"BlueVoda_Website_Builder_1.0" = BlueVoda Website Builder 11.4
"BootSkin" = BootSkin
"BurnAware Free_is1" = BurnAware Free 2.3.3
"CCleaner" = CCleaner (remove only)
"CoD RconTool" = CoD RconTool
"COSMOS 5.0_is1" = Uninstaller
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"ESC64 Referenzhandbuch" = ESC64 Referenzhandbuch
"ESC64 Softwarehandbuch" = ESC64 Softwarehandbuch
"F064B256B4A20996EA9E333B5E0F14B61AB3333D" = Windows Driver Package - Nokia (WUDFRd) WPD  (03/19/2007 6.83.31.1)
"FLVCodec" = PlayFLV
"Foxit Reader" = Foxit Reader
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"Game Cam" = Game Cam 2.2
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (nur entfernen)
"Hama Flashlight Pad" = Hama Flashlight Pad
"HLSW_is1" = HLSW v1.3.3.7b
"Icy Tower v1.4_is1" = Icy Tower v1.4
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch
"InstallShield_{6A3E5F76-7DD4-4F59-9CD6-B0159622B353}" = SL-6690 ForceFeedback 3
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}" = Far Cry
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"InstallShield_{FEFAF112-4DA8-479C-89E2-7DE25091711A}" = Call of Juarez - Bound in Blood
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.1.0 (Basic)
"LineRider" = Line Rider
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.5.48 (remove only)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual Basic 2008 Express Edition with SP1 - DEU" = Microsoft Visual Basic 2008 Express Edition mit SP1 - DEU
"Morpheus Photo Morpher_is1" = Morpheus Photo Morpher v3.15
"Mozilla Firefox (3.0.15)" = Mozilla Firefox (3.0.15)
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PhotoFiltre" = PhotoFiltre
"PhotoScape" = PhotoScape
"Pidgin" = Pidgin
"Samsung PC Studio 7" = Samsung PC Studio 7
"StreetPlugin" = Learn2 Player (Uninstall Only)
"SystemRequirementsLab" = System Requirements Lab
"TeamViewer 3" = TeamViewer 3
"uTorrent" = µTorrent
"VIA/S3G UniChrome Family Win2K/XP/Server2003 Display" = VIA/S3G Display Driver
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 1.1.0
"WheelMouse" = Smart-X7 7.72
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.0.2
"winpcap-nmap" = winpcap-nmap 4.02
"WinRAR archiver" = WinRAR archiver
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"X10Hardware" = X10 Hardware(TM)
"Xfire" = Xfire (remove only)
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CursorFX" = CursorFX
"Google Chrome" = Google Chrome
"jlGui 3.0" = jlGui 3.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 10.08.2010 14:17:05 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 10.08.2010 15:01:06 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divxupdate.exe, Version 1.0.1.10, fehlgeschlagenes
 Modul msvcp80.dll, Version 8.0.50727.4053, Fehleradresse 0x000100b5.
 
Error - 10.08.2010 15:17:23 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 12.08.2010 13:17:11 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 12.08.2010 14:17:08 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 12.08.2010 15:17:07 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
[ Application Events ]
Error - 10.08.2010 14:17:05 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 10.08.2010 15:01:06 | Computer Name = XXXXXXX | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divxupdate.exe, Version 1.0.1.10, fehlgeschlagenes
 Modul msvcp80.dll, Version 8.0.50727.4053, Fehleradresse 0x000100b5.
 
Error - 10.08.2010 15:17:23 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 12.08.2010 13:17:11 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 12.08.2010 14:17:08 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
Error - 12.08.2010 15:17:07 | Computer Name = XXXXXXX | Source = Google Update | ID = 20
Description = 
 
[ System Events ]
Error - 12.08.2010 12:37:41 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "PnkBstrB" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
Error - 12.08.2010 12:37:43 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "PnkBstrA" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
Error - 12.08.2010 14:14:13 | Computer Name = XXXXXXX | Source = Windows Update Agent | ID = 16
Description = Verbindung nicht möglich: Es konnte keine Verbindung mit dem Dienst
 "Automatische Updates" hergestellt werden, daher können Updates nicht nach dem 
angegebenen Zeitplan heruntergeladen und installiert werden. Es wird weiterhin versucht,
 eine Verbindung herzustellen.
 
Error - 13.08.2010 16:06:39 | Computer Name = XXXXXXX | Source = Print | ID = 19
Description = Freigabe des Druckers fehlgeschlagen (+ 1722). Drucker Microsoft XPS
 Document Writer, Freigabename Drucker.
 
Error - 13.08.2010 16:07:58 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 13.08.2010 16:08:01 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "VMware Authorization Service" wurde unerwartet beendet. Dies
 ist bereits 1 Mal passiert.
 
Error - 13.08.2010 16:08:04 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "PnkBstrB" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
Error - 13.08.2010 16:08:05 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "PnkBstrA" wurde unerwartet beendet. Dies ist bereits 1 Mal
 passiert.
 
Error - 13.08.2010 16:08:11 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "FsUsbExService" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 13.08.2010 16:08:13 | Computer Name = XXXXXXX | Source = Service Control Manager | ID = 7034
Description = Dienst "Protexis Licensing V2" wurde unerwartet beendet. Dies ist 
bereits 1 Mal passiert.
 
[ TuneUp Events ]
Error - 16.05.2009 18:58:46 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 16.05.2009 18:58:46 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 26.06.2009 16:34:44 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 26.06.2009 16:35:13 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 22.08.2009 07:49:47 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 22.08.2009 07:51:39 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 22.08.2009 07:52:21 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 22.08.2009 07:52:26 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
Error - 22.08.2009 07:53:32 | Computer Name = XXXXXXX | Source = TuneUp Program Statistics | ID = 131840
Description = 
 
 
< End of report >
         

--- --- ---

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {C1E68079-1B2C-41D7-A3C2-BE82E570251E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {724D43A0-0D85-11D4-9908-00400523E39A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A6F74643-242A-A7A4-8DD5-DB40B9E25345} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C1E68079-1B2C-41D7-A3C2-BE82E570251E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {DAF8EC58-AC63-40D0-9224-1583F6D55716} - No CLSID value found.
O33 - MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\Shell - "" = AutoRun
O33 - MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\Shell\AutoRun\command - "" = K:\Autorun.exe -- File not found
O33 - MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\Shell - "" = AutoRun
O33 - MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\Shell\AutoRun\command - "" = L:\pushinst.exe -- File not found
@Alternate Data Stream - 512 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:05EE1EEF
@Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29
:Commands
[purity]
[resethosts]
[emptytemp]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Nach dem Neustart des Rechners öffnete sich dieser Log:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0124123D-61B4-456f-AF86-78C53A0790C5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0124123D-61B4-456f-AF86-78C53A0790C5}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{C1E68079-1B2C-41D7-A3C2-BE82E570251E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1E68079-1B2C-41D7-A3C2-BE82E570251E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4F11ACBB-393F-4C86-A214-FF3D0D155CC3}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{55FAF0F2-44D4-425F-B5F5-6B275B621EAB} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{55FAF0F2-44D4-425F-B5F5-6B275B621EAB}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{724D43A0-0D85-11D4-9908-00400523E39A} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{724D43A0-0D85-11D4-9908-00400523E39A}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A6F74643-242A-A7A4-8DD5-DB40B9E25345} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6F74643-242A-A7A4-8DD5-DB40B9E25345}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C1E68079-1B2C-41D7-A3C2-BE82E570251E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C1E68079-1B2C-41D7-A3C2-BE82E570251E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DAF8EC58-AC63-40D0-9224-1583F6D55716} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DAF8EC58-AC63-40D0-9224-1583F6D55716}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68475f9b-3a28-11dd-88ee-001a4f9c4472}\ not found.
File K:\Autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bc854830-0bc0-11dc-852a-0013d3f94ad7}\ not found.
File L:\pushinst.exe not found.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:05EE1EEF deleted successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:1CA73D29 deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 155453 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: XXXXXXX
->Temp folder emptied: 65172 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 114889570 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 28912665 bytes
->Flash cache emptied: 66518 bytes

User: Gast
->Temp folder emptied: 2661823 bytes
->Temporary Internet Files folder emptied: 34868380 bytes
->Java cache emptied: 581826 bytes
->FireFox cache emptied: 19901412 bytes
->Apple Safari cache emptied: 50984960 bytes
->Flash cache emptied: 11359 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 34199165 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 64608248 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 336,00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 08142010_225044

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\XXXXXXX\Lokale Einstellungen\Temp\plugtmp\plugin-51dd352e3589b9203a94d92c21fd9435f41004d67097040f9a36ee032ee0d27cc74647953dafc0b5ad7a10169b40e0e8b649de15aed82184bd353c8c846b2db2ff4f8671468a7dc600ef60 3e01b9c8fc9ab58505ad7660b50666df4efaa5ee84 not found!
File\Folder C:\Dokumente und Einstellungen\XXXXXXX\Lokale Einstellungen\Temp\pub__1,2,37,40,30,9,120,85,86,243,187,931,935,164,129,48,49,134,209,60,64,65,74,262,365,610,602,607,614,846,850,827,698,876,785,697 ,25,28,232,762,885,141,643,492,496,721,760,671,672,741_4-1.png not found!
File\Folder C:\Dokumente und Einstellungen\XXXXXXX\Lokale Einstellungen\Temp\pub__1,2,37,40,30,9,120,85,86,243,187,931,935,164,129,48,49,134,209,60,64,65,74,262,365,610,602,607,614,846,850,827,698,876,785,697 ,25,28,232,762,885,141,643,492,496,721,760,671,672,741_4-2.png not found!

Registry entries deleted on Reboot...

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

• Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Ich habe die Anleitung genau befolgt.
Nach dem Start von ComboFix kamen erstmal zwei Fehlermeldungen, danach ein Neustart.
Danach fing ComboFix an zu arbeiten. Ich wurde gefragt ob ich die Wiederherstellungskonsole herunterladen und installieren will, da diese nicht gefunden wurde. Leider ist dies, wegen der fehlerhaften Internetverbindung, nicht möglich. Dann suchte ComboFix bis zu Stufe 49.
Dann startete sich der Rechner erneut neu, und die Fehlermeldung "Das System wird nach einem schwerwiegenden Fehler wieder ausgeführt." erschien.
Ein Protokoll wurde nicht erstellt.

Dann probier es bitte nochmal. Vorher die alte cofi.exe löschen und neu herunterladen.

Habe ich gemacht.
Das Programm hat zwar bis Stufe 50 gesucht und "Dateien löschen" angezeigt mit folgendem Neustart, aber die Meldung "Das System wird nach einem schwerwiegenden Fehler wieder ausgeführt." kam trotzdem. Eine Logdatei konnte ich nicht finden.
Was mich etwas irritiert, ist folgendes:


Habe die Suche direkt nach dem Neustart ausgeführt.
Den ersten Eintrag habe ich noch nie gesehen (möglicherweise ein AVM blocker?)

Dann machen wir erst anders weiter:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread