Hallo Zusammen,

seit gestern meldet der Spybot S&D das Vorhandensein eines Viruses mit dem Namen WIN32.Katusha.o. Der Viraus lässt sich leider mit Hilfe des Programms sowie auch manuell nicht entfernen. Das System meldet, es könnte keine Winini-Datei erstellen. Wie knn ich diesen tückischen Virus bei mir entfernen?

anbei hier der Scan über OTL:
OTL.Txt:

OTL Logfile:

OTL logfile created on: 28.05.2011 15:08:58 - Run 1
OTL by OldTimer - Version 3.2.23.0     Folder = C:\Users\***\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1014,64 Mb Total Physical Memory | 202,95 Mb Available Physical Memory | 20,00% Memory free
2,24 Gb Paging File | 1,05 Gb Available in Paging File | 46,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,04 Gb Total Space | 101,66 Gb Free Space | 68,67% Space Free | Partition Type: NTFS
 
Computer Name: DANI-NOTEBOOK | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.05.28 15:03:29 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe
PRC - [2011.04.18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgtray.exe
PRC - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011.04.14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgnsx.exe
PRC - [2011.03.28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgcsrvx.exe
PRC - [2011.03.16 16:05:20 | 001,025,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgemcx.exe
PRC - [2011.03.16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgchsvx.exe
PRC - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011.02.09 05:35:14 | 001,265,504 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgsrmax.exe
PRC - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgwdsvc.exe
PRC - [2011.02.08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgrsx.exe
PRC - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2009.07.29 20:32:46 | 000,066,864 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009.03.05 17:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.02.13 13:06:58 | 002,196,240 | ---- | M] () -- C:\Programme\Logitech\QuickCam\Quickcam.exe
PRC - [2008.02.13 13:02:46 | 000,564,496 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2008.02.13 13:02:24 | 000,405,776 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2008.02.05 18:20:42 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2008.02.05 18:18:48 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007.11.13 19:38:28 | 002,510,848 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.bin
PRC - [2007.11.13 19:38:26 | 002,359,296 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.exe
PRC - [2007.01.23 11:53:34 | 000,565,248 | ---- | M] (MSI) -- C:\Programme\LG Software\System Control Manager\MGSysCtrl.exe
PRC - [2007.01.11 17:24:56 | 004,321,280 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2006.10.19 14:42:00 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Windows\System32\o2flash.exe
PRC - [2006.10.05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2006.03.02 16:43:24 | 000,040,960 | ---- | M] () -- C:\Programme\LG Software\System Control Manager\edd.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.05.28 15:03:29 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2008.02.05 18:20:30 | 000,109,080 | ---- | M] (Logitech Inc.) -- C:\Windows\Temp\logishrd\LVPrcInj01.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008.02.05 18:22:36 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Programme\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2008.02.05 18:20:42 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.02.05 18:18:48 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.10.19 14:42:00 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\System32\o2flash.exe -- (O2Flash)
SRV - [2006.10.05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006.03.02 16:43:24 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Programme\LG Software\System Control Manager\edd.exe -- (NishService)
SRV - [2004.08.18 19:36:44 | 000,450,560 | ---- | M] (Lexmark International, Inc.) [On_Demand | Stopped] -- C:\Windows\System32\lxbucoms.exe -- (lxbu_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.04.14 21:28:18 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011.04.05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011.03.16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011.03.01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011.02.22 08:12:38 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011.02.10 07:53:30 | 000,028,624 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011.02.10 07:53:28 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011.01.07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008.02.06 04:21:37 | 004,658,456 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam S5500(UVC)
DRV - [2008.02.06 04:21:25 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008.02.06 04:20:40 | 000,628,760 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2008.02.05 18:20:08 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2008.02.05 18:18:12 | 000,689,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2006.11.20 15:14:08 | 000,038,400 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2media.sys -- (O2MDRDR)
DRV - [2006.11.17 13:58:32 | 000,031,360 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2sd.sys -- (O2SDRDR)
DRV - [2006.11.08 16:29:44 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.04 09:35:50 | 000,059,392 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006.10.30 09:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006.09.28 22:41:46 | 000,247,808 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2006.07.03 10:31:26 | 000,009,088 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MGHwCtrl.sys -- (MGHwCtrl)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=971163"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1374
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011.05.11 16:10:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.27 13:59:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.27 13:59:24 | 000,000,000 | ---D | M]
 
[2009.01.07 21:47:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2011.05.27 21:06:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions
[2010.06.20 17:25:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.05.27 21:05:57 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011.05.27 21:05:53 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\engine@conduit.com
[2009.11.25 22:05:31 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\moveplayer@movenetworks.com
[2011.05.26 18:21:47 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-1.xml
[2011.02.16 22:00:07 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-10.xml
[2009.08.11 15:32:54 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-2.xml
[2009.08.12 15:16:19 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-3.xml
[2009.09.13 22:49:10 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-4.xml
[2009.10.31 00:08:22 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-5.xml
[2009.12.21 09:56:12 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-6.xml
[2010.01.13 19:28:55 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-7.xml
[2010.02.20 17:35:43 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-8.xml
[2010.03.31 07:06:42 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-9.xml
[2009.07.25 14:22:11 | 000,000,944 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin.xml
[2011.05.27 13:59:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.07.15 20:49:18 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.07.18 22:50:17 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.06.19 17:44:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.12.04 00:21:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.27 00:03:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.05.11 16:58:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) -- 
[2011.05.11 16:10:55 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2009.07.25 16:39:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009.09.01 23:12:01 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2010.04.11 13:06:05 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2010.06.19 17:44:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.12.04 00:21:55 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.27 00:03:58 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.05.11 16:58:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2011.04.14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.08 12:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Programme\Mozilla Firefox\plugins\npmidas.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} -  File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LG Intelligent Update] C:\Program Files\lg_swupdate\giljabistart.exe (BIT LEADER)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MGSysCtrl] C:\Programme\LG Software\System Control Manager\MGSysCtrl.exe (MSI)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WinampAgent]  File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk = C:\Programme\OpenOffice.org 2.3\program\quickstart.exe ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\fluxhttp {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()
O18 - Protocol\Handler\fluxhttp\0x00000007 {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img34.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img34.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.28 14:17:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.05.28 14:17:13 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2011.05.28 01:49:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2011.05.28 01:49:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2011.05.28 01:49:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2011.05.27 23:54:03 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011.05.27 21:43:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2011.05.27 21:43:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.27 21:43:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.05.27 21:43:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.27 21:43:13 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.27 21:43:13 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.05.27 14:05:15 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.05.11 17:03:53 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2011.05.02 14:09:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\AVG10
[2011.05.02 14:04:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011.05.02 14:00:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\AVG
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.28 15:06:39 | 116,341,506 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011.05.28 14:59:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.28 14:59:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.28 14:21:08 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.28 14:17:18 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.28 11:07:09 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.28 11:07:08 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.28 11:07:08 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.28 11:07:08 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.28 10:59:48 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.28 10:59:20 | 000,016,384 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2011.05.28 10:59:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.28 10:58:27 | 1064,689,664 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.28 01:56:59 | 000,308,360 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.05.27 21:43:24 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.27 13:59:37 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.05.26 19:36:59 | 000,044,544 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.05.11 17:14:48 | 000,030,720 | ---- | M] () -- C:\Windows\System32\npmpsoxy.dll
[2011.05.11 16:13:54 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011.05.02 19:04:32 | 000,119,374 | ---- | M] () -- C:\Users\***\Documents\Email Fuerte Ventura.pdf
[2011.05.02 18:29:46 | 000,175,403 | ---- | M] () -- C:\Users\***\Documents\Ryanair-Fuerte Ventura.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.28 15:06:39 | 116,341,506 | ---- | C] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011.05.28 14:17:18 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.27 21:43:24 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.27 13:59:36 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.05.11 17:14:48 | 000,030,720 | ---- | C] () -- C:\Windows\System32\npmpsoxy.dll
[2011.05.02 19:04:28 | 000,119,374 | ---- | C] () -- C:\Users\***\Documents\Email Fuerte Ventura.pdf
[2011.05.02 18:29:39 | 000,175,403 | ---- | C] () -- C:\Users\***\Documents\Ryanair-Fuerte Ventura.pdf
[2011.05.02 14:04:29 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011.01.02 14:50:36 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe
[2010.12.07 23:13:01 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010.12.05 18:57:17 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.12.05 18:57:16 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.06.13 23:17:37 | 000,005,000 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2010.03.06 04:16:53 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2010.03.05 20:41:48 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009.09.01 00:06:57 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009.07.29 20:31:39 | 000,066,482 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2009.07.15 20:13:03 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.05.08 18:05:10 | 000,000,890 | ---- | C] () -- C:\Windows\ccinst.ini
[2008.04.27 19:52:56 | 000,044,544 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.02.05 18:20:08 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2007.10.19 21:23:50 | 000,098,304 | ---- | C] () -- C:\Windows\System32\MGHwCtrl.dll
[2007.10.19 21:23:50 | 000,032,768 | ---- | C] () -- C:\Windows\System32\MGFPCtrl.dll
[2007.10.19 21:23:50 | 000,024,576 | ---- | C] () -- C:\Windows\System32\MGPwrShm.dll
[2007.07.03 04:52:13 | 000,009,589 | ---- | C] () -- C:\Windows\lg_up.ini
[2007.07.03 04:40:03 | 000,000,896 | ---- | C] () -- C:\Windows\lgcenter.ini
[2007.07.02 11:30:53 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.07.02 11:30:45 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1187.dll
[2007.07.02 11:23:59 | 000,000,181 | ---- | C] () -- C:\Windows\lgps.ini
[2006.11.02 17:33:31 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,126,260 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,308,360 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:21 | 000,180,224 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005.01.21 12:02:28 | 000,013,312 | ---- | C] () -- C:\Windows\System32\RMDevice.dll
[2004.08.19 18:47:32 | 000,098,304 | ---- | C] () -- C:\Windows\System32\lxbuinsr.dll
[2004.08.19 18:47:24 | 000,032,768 | ---- | C] () -- C:\Windows\System32\lxbucur.dll
[2004.08.19 18:46:54 | 000,131,072 | ---- | C] () -- C:\Windows\System32\lxbujswr.dll
[2003.07.11 15:55:28 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxbuvs.dll
 
========== LOP Check ==========
 
[2009.08.21 23:20:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon
[2011.05.02 14:09:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG10
[2010.03.06 04:17:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canneverbe Limited
[2010.06.19 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Facebook
[2008.05.12 13:50:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2009.07.29 20:32:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Leadertech
[2010.05.02 15:57:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2011.05.28 03:47:12 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.02.16 00:27:50 | 000,000,000 | -H-D | M] -- C:\$AVG
[2008.02.15 18:25:05 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.05.28 02:03:45 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.05.27 23:43:06 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2008.05.16 00:41:57 | 000,000,000 | ---D | M] -- C:\ContentComposer
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.02.15 18:23:46 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.08.15 17:00:31 | 000,000,000 | ---D | M] -- C:\drivers
[2007.10.19 21:17:22 | 000,000,000 | ---D | M] -- C:\Intel
[2009.08.16 10:37:16 | 000,000,000 | ---D | M] -- C:\My documents
[2010.12.04 18:07:24 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.05.28 14:17:13 | 000,000,000 | R--D | M] -- C:\Programme
[2011.05.27 21:43:19 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2008.02.15 18:23:46 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.05.28 15:13:02 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2009.06.29 20:16:18 | 000,000,000 | ---D | M] -- C:\Temp
[2008.02.15 18:24:41 | 000,000,000 | R--D | M] -- C:\Users
[2011.05.28 14:28:03 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008.03.08 12:17:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008.03.08 12:17:35 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 23:32:16

< End of report >
         

--- --- ---


Extras.TxT:

OTL Logfile:

OTL Extras logfile created on: 28.05.2011 15:08:58 - Run 1
OTL by OldTimer - Version 3.2.23.0     Folder = C:\Users\***\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1014,64 Mb Total Physical Memory | 202,95 Mb Available Physical Memory | 20,00% Memory free
2,24 Gb Paging File | 1,05 Gb Available in Paging File | 46,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,04 Gb Total Space | 101,66 Gb Free Space | 68,67% Space Free | Partition Type: NTFS
 
Computer Name: DANI-NOTEBOOK | User Name: Dani | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{18F4C66F-1BAF-47CE-B437-5DE4064AAEA7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{228AF9AF-B893-48F0-9144-B411BB07C653}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{363A099D-37E1-43EA-895A-969A8C705297}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{3906340B-B1F2-446A-9D24-099B6B92E7C1}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe | 
"{57AB2FF6-A9F2-4F06-A206-716B9FA99E31}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe | 
"{5D4C0393-696D-48C4-BD94-C15B5EA07304}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe | 
"{61281235-C1ED-4B2B-ADAB-2876214A34CB}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe | 
"{78EF0061-0B61-4C29-B3D3-202253D14623}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe | 
"{805A3E77-9F9C-46BE-BE29-A03BA2C76704}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{976B86E0-7F8C-4897-86C7-5628ED24DFD9}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe | 
"{978AEB42-6F95-41D1-90BC-9D31693E554C}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe | 
"{9E88F43C-352F-4813-B19F-2048C27C7665}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{A1EC9F9A-0619-426C-B9C5-DC67E31C0F98}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{AB0E9769-9FA4-4033-9847-61BC219F6002}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{AB56AB07-5214-4AF4-BF5E-D044DDE9BB31}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe | 
"{C244C80F-49C6-4628-95F3-FD1D8FC9FA89}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{CF60E9D7-3BBE-4329-8207-D5874B366EC1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{D2E2D3E9-2291-4138-9F56-C0B7A5A72FAF}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 
"{E4C0AD93-BD10-487D-97FB-AD36A6D5DC7D}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"TCP Query User{78E2D04B-E7BD-48B3-898C-2DE8224DFC2A}C:\program files\soulseekns\slsk.exe" = protocol=6 | dir=in | app=c:\program files\soulseekns\slsk.exe | 
"TCP Query User{965C2BA2-A6D1-4D17-B94D-5F9D4941CB14}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{C4E48F61-184B-46AB-B753-93DF302E65F9}C:\program files\ea games\mohaa\mohaa.exe" = protocol=6 | dir=in | app=c:\program files\ea games\mohaa\mohaa.exe | 
"TCP Query User{C8C0E0A0-A2FE-40E8-8112-E93ACDE3E6CB}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{CF1B17F2-42E9-4017-AE8F-37765E853161}C:\users\***\desktop\utorrent_2.0.exe" = protocol=6 | dir=in | app=c:\users\***\desktop\utorrent_2.0.exe | 
"TCP Query User{D5ACD48A-253A-4131-8D14-82D40F4BCA94}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{DC322422-4704-4650-B8A3-8B14651D00CC}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{23D7AE1C-F02A-44D1-950D-E502A476E9BB}C:\users\***\desktop\utorrent_2.0.exe" = protocol=17 | dir=in | app=c:\users\***\desktop\utorrent_2.0.exe | 
"UDP Query User{40021DA0-BA4E-4C63-B5A4-A06FB7C35219}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{6B65D546-41B4-42BD-917B-A929D860D040}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{A17C1EFC-6759-41B3-A617-0BF4E7885C92}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 
"UDP Query User{A9FB1B05-D1D7-4E41-BBA7-15D974C5944E}C:\program files\soulseekns\slsk.exe" = protocol=17 | dir=in | app=c:\program files\soulseekns\slsk.exe | 
"UDP Query User{C4AAB6BC-29F0-479C-92FB-2E951C2884BA}C:\program files\ea games\mohaa\mohaa.exe" = protocol=17 | dir=in | app=c:\program files\ea games\mohaa\mohaa.exe | 
"UDP Query User{D66576F5-BFFF-4864-B17F-57F0D38BCB94}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{230E8DDC-FB78-4F9F-8461-22ED20DBC3BA}" = AVG 2011
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 25
"{3562A082-CF01-419B-8A02-233E31B8A83C}" = O2Micro Flash Memory Card Windows Driver V3.00
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{447E63B1-507A-45FF-A6FE-E8A5B960E7FD}" = Druckstudio FotoKalender
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{6444D9D9-CD6C-4464-B970-55C606C944DC}" = Logitech QuickCam
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{81717D01-32F6-449C-85E1-41AFD678E545}" = LG Intelligent Update
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{AC76BA86-7AD7-2447-0000-800000000003}" = Chinese Simplified Fonts Support For Adobe Reader 8
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BABA6734-23CF-42AC-9E4C-EA2C7C80AA4E}" = AVG 2011
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes
"{DD5B65F7-7CA5-4DE4-AEE7-7E8F26BF78F5}" = OpenOffice.org 2.3
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E5809572-2ADC-11D7-81AC-00D009DAF871}" = GrafStat Ausgabe 2006
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.5
"Audacity_is1" = Audacity 1.2.6
"Audiograbber" = Audiograbber 1.83 SE 
"AVG" = AVG 2011
"CCleaner" = CCleaner
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2009-09-09
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ICQToolbar" = ICQ Toolbar
"InstallShield_{3562A082-CF01-419B-8A02-233E31B8A83C}" = O2Micro Flash Memory Card Windows Driver V3.00
"InstallShield_{E5809572-2ADC-11D7-81AC-00D009DAF871}" = GrafStat Ausgabe 2006
"king.com" = king.com (remove only)
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"lvdrivers_11.70" = Logitech QuickCam-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"Soulseek2" = SoulSeek 157 NS 13e
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Videoload Manager" = Videoload Manager 2.0.2200
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 24.04.2011 05:08:25 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 25.04.2011 05:09:04 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 25.04.2011 05:09:04 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 26.04.2011 16:52:01 | Computer Name = ***-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 28.04.2011 16:00:07 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 01.05.2011 05:29:42 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung RIMBBLaunchAgent.exe, Version 4.2.0.9, Zeitstempel
 0x4d5e9443, fehlerhaftes Modul kernel32.dll, Version 6.0.6001.18215, Zeitstempel
 0x49953395, Ausnahmecode 0xe06d7363, Fehleroffset 0x000442eb,  Prozess-ID 0x884, 
Anwendungsstartzeit 01cc07e23cfd31ee.
 
Error - 02.05.2011 12:22:27 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung AcroRd32.exe, Version 8.1.0.137, Zeitstempel
 0x46444e37, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x24003f75,  Prozess-ID 0x2590, Anwendungsstartzeit
 01cc08e4ef4c6c2e.
 
[ System Events ]
Error - 27.05.2011 07:14:11 | Computer Name = ***-Notebook | Source = HTTP | ID = 15016
Description = 
 
Error - 27.05.2011 07:15:10 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 27.05.2011 17:43:24 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021
Description = 
 
Error - 27.05.2011 17:43:24 | Computer Name = ***-Notebook | Source = HTTP | ID = 15016
Description = 
 
Error - 27.05.2011 17:44:09 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 27.05.2011 19:57:29 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021
Description = 
 
Error - 27.05.2011 19:58:14 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 27.05.2011 20:03:58 | Computer Name = ***-Notebook | Source = DCOM | ID = 10010
Description = 
 
Error - 28.05.2011 04:59:13 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021
Description = 
 
Error - 28.05.2011 04:59:26 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

--- --- ---

[/CODE]

Wär super, wenn ihr mir helfen könntet!

Lieben Dank vorab!
sporty33

Hallo und

Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Hallo Arne,

vielen Dank für Deine Antwort. Habe den Vollscan mit Malwarebytes durchgeführt, dieser findet jedoch keinen Virus... Gehe aber davon aus, dass der Trojaner noch da ist, denn mit dem Spybot habe ich ihn gestern ja noch gefunden...

Anbei schonmal der Logfile, hoffe, Du kanst mir da weiterhelfen.

Vielen Dank vorab!

sporty33

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
 
Datenbank Version: 6711
 
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048
 
29.05.2011 14:53:28
mbam-log-2011-05-29 (14-53-28).txt
 
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 266483
Laufzeit: 1 Stunde(n), 51 Minute(n), 7 Sekunde(n)
 
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
 
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
 
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
         

Sorry, hab vorgestern auch noch einen Logfile über Malwarebytes gemacht. Die Iren habe ich natürlich bereits entfernt... :-)

Anbei:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
 
Datenbank Version: 6694
 
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19048
 
27.05.2011 23:33:41
mbam-log-2011-05-27 (23-33-41).txt
 
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 262054
Laufzeit: 1 Stunde(n), 42 Minute(n), 38 Sekunde(n)
 
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 7
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2
 
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ToolBand.XTTBPos00.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ToolBand.XTTBPos00 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
 
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
 
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateien:
c:\Users\Dani\downloads\xvidsetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\program files\icqtoolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.
         

Dann bitte jetzt CF ausführen. AVG musst du vorher vorübergehend deinstalllieren, da es sich nicht mit CF verträgt.

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

So anbei der Logfile von Combofix:

Combofix Logfile:

	
	
ComboFix 11-05-28.01 - *** 29.05.2011  21:08:18.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1015.245 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\cofi.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\***\***.exe
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-28 bis 2011-05-29  ))))))))))))))))))))))))))))))
.
.
2011-05-29 19:30 . 2011-05-29 19:30	0	---ha-w-	c:\users\***\AppData\Local\BITAA37.tmp
2011-05-29 19:24 . 2011-05-29 19:29	--------	d-----w-	c:\users\***\AppData\Local\temp
2011-05-29 19:24 . 2011-05-29 19:24	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-05-29 19:03 . 2011-05-29 19:03	--------	d-----w-	C:\32788R22FWJFW
2011-05-29 02:08 . 2011-05-29 02:08	--------	d-----w-	c:\program files\Windows Portable Devices
2011-05-29 02:04 . 2009-09-10 02:00	92672	----a-w-	c:\windows\system32\UIAnimation.dll
2011-05-29 02:04 . 2009-09-10 02:01	3023360	----a-w-	c:\windows\system32\UIRibbon.dll
2011-05-29 02:04 . 2009-09-10 02:00	1164800	----a-w-	c:\windows\system32\UIRibbonRes.dll
2011-05-29 02:03 . 2009-09-25 01:33	369664	----a-w-	c:\windows\system32\WMPhoto.dll
2011-05-29 02:03 . 2009-09-25 02:07	189440	----a-w-	c:\windows\system32\WindowsCodecsExt.dll
2011-05-29 02:03 . 2009-09-25 02:10	974848	----a-w-	c:\windows\system32\WindowsCodecs.dll
2011-05-29 02:03 . 2009-09-25 02:04	321024	----a-w-	c:\windows\system32\PhotoMetadataHandler.dll
2011-05-29 02:03 . 2009-09-25 01:33	195584	----a-w-	c:\windows\system32\dxdiagn.dll
2011-05-29 02:03 . 2009-09-25 01:32	252928	----a-w-	c:\windows\system32\dxdiag.exe
2011-05-29 02:03 . 2009-09-25 01:31	519680	----a-w-	c:\windows\system32\d3d11.dll
2011-05-29 02:00 . 2009-10-08 21:07	4096	----a-w-	c:\windows\system32\oleaccrc.dll
2011-05-29 02:00 . 2009-10-08 21:08	555520	----a-w-	c:\windows\system32\UIAutomationCore.dll
2011-05-29 02:00 . 2009-10-08 21:08	234496	----a-w-	c:\windows\system32\oleacc.dll
2011-05-28 14:55 . 2011-01-20 14:15	979456	----a-w-	c:\windows\system32\MFH264Dec.dll
2011-05-28 14:55 . 2011-01-20 16:08	478720	----a-w-	c:\windows\system32\dxgi.dll
2011-05-28 14:55 . 2011-01-20 14:27	876032	----a-w-	c:\windows\system32\XpsPrint.dll
2011-05-28 14:55 . 2011-01-20 14:24	135680	----a-w-	c:\windows\system32\XpsRasterService.dll
2011-05-28 14:55 . 2011-01-20 16:37	638336	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2011-05-28 14:55 . 2011-01-20 14:14	357376	----a-w-	c:\windows\system32\MFHEAACdec.dll
2011-05-28 14:55 . 2011-01-20 14:14	261632	----a-w-	c:\windows\system32\mfreadwrite.dll
2011-05-28 14:54 . 2011-01-20 14:14	302592	----a-w-	c:\windows\system32\mfmp4src.dll
2011-05-28 14:54 . 2011-01-20 16:07	37376	----a-w-	c:\windows\system32\cdd.dll
2011-05-28 14:54 . 2011-01-20 16:06	2873344	----a-w-	c:\windows\system32\mf.dll
2011-05-28 14:54 . 2011-01-20 16:04	209920	----a-w-	c:\windows\system32\mfplat.dll
2011-05-28 14:54 . 2011-01-20 14:26	667648	----a-w-	c:\windows\system32\printfilterpipelinesvc.exe
2011-05-28 14:54 . 2011-01-20 16:07	586240	----a-w-	c:\windows\system32\stobject.dll
2011-05-28 14:54 . 2011-01-20 16:07	258048	----a-w-	c:\windows\system32\winspool.drv
2011-05-28 14:54 . 2011-01-20 16:06	26112	----a-w-	c:\windows\system32\printfilterpipelineprxy.dll
2011-05-28 14:54 . 2011-01-20 16:04	98816	----a-w-	c:\windows\system32\mfps.dll
2011-05-28 14:53 . 2011-01-20 16:08	160768	----a-w-	c:\windows\system32\d3d10_1.dll
2011-05-28 14:53 . 2011-01-20 14:12	1172480	----a-w-	c:\windows\system32\d3d10warp.dll
2011-05-28 14:53 . 2011-01-20 13:47	683008	----a-w-	c:\windows\system32\d2d1.dll
2011-05-28 14:53 . 2011-02-22 13:33	1068544	----a-w-	c:\windows\system32\DWrite.dll
2011-05-28 14:53 . 2011-02-22 13:33	797696	----a-w-	c:\windows\system32\FntCache.dll
2011-05-28 14:53 . 2011-01-20 16:08	1029120	----a-w-	c:\windows\system32\d3d10.dll
2011-05-28 14:53 . 2011-01-20 16:08	219648	----a-w-	c:\windows\system32\d3d10_1core.dll
2011-05-28 14:53 . 2011-01-20 16:08	189952	----a-w-	c:\windows\system32\d3d10core.dll
2011-05-28 14:53 . 2011-01-20 14:28	1554432	----a-w-	c:\windows\system32\xpsservices.dll
2011-05-28 14:53 . 2011-01-20 14:11	486400	----a-w-	c:\windows\system32\d3d10level9.dll
2011-05-28 14:53 . 2011-02-22 14:13	288768	----a-w-	c:\windows\system32\XpsGdiConverter.dll
2011-05-28 14:53 . 2011-01-20 14:25	847360	----a-w-	c:\windows\system32\OpcServices.dll
2011-05-28 14:37 . 2010-05-04 19:13	231424	----a-w-	c:\windows\system32\msshsq.dll
2011-05-28 12:17 . 2011-05-28 12:17	--------	d-----w-	c:\program files\CCleaner
2011-05-27 23:49 . 2011-05-27 23:50	--------	d-----w-	c:\windows\system32\ca-ES
2011-05-27 23:49 . 2011-05-27 23:50	--------	d-----w-	c:\windows\system32\eu-ES
2011-05-27 23:49 . 2011-05-27 23:50	--------	d-----w-	c:\windows\system32\vi-VN
2011-05-27 21:54 . 2011-05-27 21:54	--------	d-----w-	c:\windows\system32\EventProviders
2011-05-27 19:43 . 2011-05-27 19:43	--------	d-----w-	c:\users\***\AppData\Roaming\Malwarebytes
2011-05-27 19:43 . 2010-12-20 16:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-27 19:43 . 2011-05-27 19:43	--------	d-----w-	c:\programdata\Malwarebytes
2011-05-27 19:43 . 2011-05-27 19:43	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-05-27 19:43 . 2010-12-20 16:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-05-27 11:59 . 2011-04-14 16:40	142296	----a-w-	c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-27 11:59 . 2011-04-14 16:40	16856	----a-w-	c:\program files\Mozilla Firefox\plugin-container.exe
2011-05-27 11:59 . 2011-04-14 16:40	89048	----a-w-	c:\program files\Mozilla Firefox\libEGL.dll
2011-05-27 11:59 . 2011-04-14 16:40	781272	----a-w-	c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-27 11:59 . 2011-04-14 16:40	719832	----a-w-	c:\program files\Mozilla Firefox\mozcpp19.dll
2011-05-27 11:59 . 2011-04-14 16:40	465880	----a-w-	c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-27 11:59 . 2011-04-14 16:40	1874904	----a-w-	c:\program files\Mozilla Firefox\mozjs.dll
2011-05-27 11:59 . 2011-04-14 16:40	15832	----a-w-	c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-27 11:59 . 2010-01-01 08:00	1974616	----a-w-	c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-27 11:59 . 2010-01-01 08:00	1892184	----a-w-	c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-26 16:35 . 2011-05-26 16:35	1138440	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-11 15:14 . 2011-05-11 15:14	30720	----a-w-	c:\windows\system32\npmpsoxy.dll
2011-05-11 15:03 . 2011-05-11 15:03	--------	d-----w-	c:\program files\Common Files\Java
2011-05-11 14:18 . 2011-04-07 12:01	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
2011-05-02 12:09 . 2011-05-02 12:09	--------	d-----w-	c:\users\***\AppData\Roaming\AVG10
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 19:30 . 2011-05-29 19:30	0	---ha-w-	c:\users\***\AppData\Local\BITF3F4.tmp
2011-04-14 03:07 . 2010-06-19 15:44	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-04-11 07:04 . 2011-04-29 18:07	7071056	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{9795B267-A553-4A5D-BF2C-5801A5955E81}\mpengine.dll
2011-03-10 17:03 . 2011-04-13 19:54	1162240	----a-w-	c:\windows\system32\mfc42u.dll
2011-03-10 17:03 . 2011-04-13 19:54	1136640	----a-w-	c:\windows\system32\mfc42.dll
2011-03-03 15:42 . 2011-04-13 19:53	739328	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-03 15:40 . 2011-04-26 20:50	28672	----a-w-	c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40 . 2011-04-26 20:50	173056	----a-w-	c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-26 20:50	542720	----a-w-	c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-26 20:50	458752	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-26 20:50	2159616	----a-w-	c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35 . 2011-04-26 20:50	4240384	----a-w-	c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25 . 2011-04-13 19:53	2041856	----a-w-	c:\windows\system32\win32k.sys
2011-03-02 15:44 . 2011-04-13 19:54	86528	----a-w-	c:\windows\system32\dnsrslvr.dll
2011-04-14 16:40 . 2011-05-27 11:59	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-15 39408]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-01-11 4321280]
"LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" [2007-02-06 228456]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]
"MGSysCtrl"="c:\program files\LG Software\System Control Manager\MGSysCtrl.exe" [2007-01-23 565248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-7-29 66864]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 135664]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 135664]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2006-11-20 38400]
S0 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2006-11-17 31360]
S2 NishService;Evil Driver Daemon;c:\program files\LG Software\System Control Manager\edd.exe [2006-03-02 40960]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 MGHwCtrl;MGHwCtrl;c:\windows\system32\drivers\MGHwCtrl.sys [2006-07-03 9088]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2006-09-28 247808]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 10:44]
.
2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 10:44]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: Interfaces\{7438D09B-C767-4D83-A264-3BA385E7A7DC}: NameServer = 195.50.140.248 195.50.140.246
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
.
.
.
**************************************************************************
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(9836)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\o2flash.exe
c:\windows\system32\conime.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-05-29  21:36:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-05-29 19:36
.
Vor Suchlauf: 10 Verzeichnis(se), 105.661.661.184 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 105.510.154.240 Bytes frei
.
- - End Of File - - 4037597B5F678EA4265B6877A8B8EB7C
         
 
--- --- ---
         

c:\***\***.exe

Was hast du da zensiert?

Das ist ein Programm von einem früheren Arbeitgeber von mir. Sollte nicht jeder wissen, was es für eines ist. Ich kenne es aber und es ist ungefährlich! :-)

Wie geht es jetzt weiter? Spybot meldet den Virus immer noch....
Wie gefährlich ist dieser WIN32.Katusha eigentlich?

Danke und Grüße
sporty33

Dann bitte unzensiert per PN posten

Habe dir eine Email geschrieben, PN ging leider nicht...
Viele Grüße
sporty33

Ok, schau ich nachher mal rein

Das ist ein Programm von einem früheren Arbeitgeber von mir. Sollte nicht jeder wissen, was es für eines ist. Ich kenne es aber und es ist ungefährlich! :-)

CF hat das Teil aber gelöscht. Es legt ein Back in C:\Qoobox an.


Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

• Doppelklick auf die MBRCheck.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Das Tool braucht nur wenige Sekunden.
• Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

So, habe nun GMER und OSAM ausgeführt.
Anbei die beiden Logs:

GMER:
[CODE]

GMER Logfile:

GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-05-31 13:38:02
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9160821AS rev.3.ALC
Running: pr2co8ui.exe; Driver: C:\Users\***\AppData\Local\Temp\pxtoqpoc.sys


---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                                  [03192F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                                       [03192D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                         [03192CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                             [03192CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                          [021B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                               [021B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                 [021B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                     [021B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]           [01902F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                [01902D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]  [01902CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]      [01902CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                      [00242F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                           [00242D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                             [00242CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                 [00242CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                         [000C2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                              [000C2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                [000C2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                    [000C2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                   Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                   Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
         

--- --- ---


Und OSAM:

OSAM Logfile:

	
	
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 12:16:16 on 31.05.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 4.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"bdeadmin.cpl" - ? - C:\Windows\system32\bdeadmin.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MGHwCtrl" (MGHwCtrl) - "Windows (R) 2000 DDK provider" - C:\Windows\system32\drivers\MGHwCtrl.sys
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{9462A756-7B47-47BC-8C80-C34B9B80B32B} "BackWeb GA Pluggable Protocol" - "Logitech Inc." - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{8E2D00A0-82C6-4821-90BC-07F290841BB6} "XEB Navigation Filter" - ? - C:\Program Files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{C9CF278C-460E-4917-BC43-3F75E6E47D3D} "fluxDVD Shell Information Extractor" - "ACE GmbH" - C:\PROGRA~1\COMMON~1\fluxDVD\Lib\XEB\XEBShell.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)
 "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash9e.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"OpenOffice.org 2.3.lnk" - ? - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Logitech Desktop Messenger.lnk" - "Logitech Inc." - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"LG Intelligent Update" - "BIT LEADER" - "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc
"LogitechCommunicationsManager" - "Logitech Inc." - "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
"LogitechQuickCamRibbon" - "Logitech Inc." - "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"MGSysCtrl" - "MSI" - C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Evil Driver Daemon" (NishService) - ? - C:\Program Files\LG Software\System Control Manager\edd.exe  (File found, but it contains no detailed information)
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
"LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"NMSAccessU" (NMSAccessU) - ? - C:\Program Files\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"O2Micro Flash Memory" (O2Flash) - "O2Micro International" - C:\Windows\system32\o2flash.exe
"Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
         
 
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
         

Viele Grüße
sporty33

Und hier auch noch MBRCheck:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:	MICRO-STAR INT'L CO.,LTD.
BIOS Manufacturer:		American Megatrends Inc.
System Manufacturer:		LG Electronics
System Product Name:		FS-2.AACBG
Logical Drives Mask:		0x00000014

Kernel Drivers (total 143):
  0x8204D000 \SystemRoot\system32\ntkrnlpa.exe
  0x8201A000 \SystemRoot\system32\hal.dll
  0x80403000 \SystemRoot\system32\kdcom.dll
  0x8040A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x8047A000 \SystemRoot\system32\PSHED.dll
  0x8048B000 \SystemRoot\system32\BOOTVID.dll
  0x80493000 \SystemRoot\system32\CLFS.SYS
  0x804D4000 \SystemRoot\system32\CI.dll
  0x80608000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x80679000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x80687000 \SystemRoot\system32\drivers\acpi.sys
  0x806CD000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x806D6000 \SystemRoot\system32\drivers\msisadrv.sys
  0x806DE000 \SystemRoot\system32\drivers\pci.sys
  0x80705000 \SystemRoot\System32\drivers\partmgr.sys
  0x80714000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x80717000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x80721000 \SystemRoot\system32\drivers\volmgr.sys
  0x80730000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8077A000 \SystemRoot\system32\DRIVERS\pcmcia.sys
  0x807A7000 \SystemRoot\system32\DRIVERS\pciide.sys
  0x807AE000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
  0x807BC000 \SystemRoot\System32\drivers\mountmgr.sys
  0x807CC000 \SystemRoot\system32\drivers\atapi.sys
  0x807D4000 \SystemRoot\system32\drivers\ataport.SYS
  0x807F2000 \SystemRoot\system32\DRIVERS\o2sd.sys
  0x805B4000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
  0x805DA000 \SystemRoot\system32\DRIVERS\o2media.sys
  0x82605000 \SystemRoot\system32\drivers\fltmgr.sys
  0x82637000 \SystemRoot\system32\drivers\fileinfo.sys
  0x82647000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x826B8000 \SystemRoot\system32\drivers\ndis.sys
  0x827C3000 \SystemRoot\system32\drivers\msrpc.sys
  0x82C0E000 \SystemRoot\system32\drivers\NETIO.SYS
  0x82C49000 \SystemRoot\System32\drivers\tcpip.sys
  0x82D33000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x82E09000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x82F19000 \SystemRoot\system32\drivers\volsnap.sys
  0x82F52000 \SystemRoot\System32\Drivers\spldr.sys
  0x82F5A000 \SystemRoot\System32\Drivers\mup.sys
  0x82F69000 \SystemRoot\System32\drivers\ecache.sys
  0x82F90000 \SystemRoot\system32\drivers\disk.sys
  0x82FA1000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x82FC2000 \SystemRoot\system32\drivers\crcdisk.sys
  0x82FEB000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x82FF6000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x82D4E000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8A201000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
  0x82D5D000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8A7D8000 \SystemRoot\System32\drivers\watchdog.sys
  0x8AA0E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8AA9B000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
  0x8AAAE000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8AAB9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8AAF7000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8AB06000 \SystemRoot\system32\DRIVERS\ohci1394.sys
  0x8AB16000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
  0x8AB24000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8AB37000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8AB42000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8AB6D000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8AB6F000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8AB7A000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8AB7E000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8AB96000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x8AB9C000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8AE0D000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8AE4E000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8AE59000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8AE70000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8AE7B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8AE9E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8AEAD000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8AEC1000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8AED6000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8AEE6000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8AEE8000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8AF12000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8AF1C000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8AF29000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8AF5E000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x89E06000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x89F9E000 \SystemRoot\system32\drivers\portcls.sys
  0x89FCB000 \SystemRoot\system32\drivers\drmk.sys
  0x8B00D000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0x8B129000 \SystemRoot\system32\drivers\modem.sys
  0x8B136000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8B13F000 \SystemRoot\System32\Drivers\Null.SYS
  0x8B146000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8B14D000 \SystemRoot\System32\drivers\vga.sys
  0x8B159000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8B17A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8B182000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8B18A000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8B195000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8B1A3000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8B1AC000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8B1C2000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8AF78000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8AFAA000 \SystemRoot\system32\drivers\afd.sys
  0x8B1D6000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8B1EC000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8ABCB000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8B405000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8B441000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8B44B000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8B462000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8B46B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8B47B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8B482000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8B48A000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8B497000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8B4A2000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x8B4AA000 \SystemRoot\system32\DRIVERS\netr73.sys
  0x928F0000 \SystemRoot\System32\win32k.sys
  0x8B4EB000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8B4F5000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x92B10000 \SystemRoot\System32\TSDDD.dll
  0x92B30000 \SystemRoot\System32\cdd.dll
  0x8B504000 \SystemRoot\system32\drivers\luafv.sys
  0x8B530000 \SystemRoot\system32\drivers\spsys.sys
  0x8B5E0000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0xA5E0A000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0xA5E34000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xA5E3E000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0xA5E51000 \SystemRoot\system32\drivers\HTTP.sys
  0xA5EBE000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0xA5EDB000 \SystemRoot\system32\DRIVERS\bowser.sys
  0xA5EF4000 \SystemRoot\System32\drivers\mpsdrv.sys
  0xA5F09000 \SystemRoot\system32\drivers\mrxdav.sys
  0xA5F2A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xA5F49000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0xA5F82000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0xA5F9A000 \SystemRoot\System32\DRIVERS\srv2.sys
  0xA680A000 \SystemRoot\System32\DRIVERS\srv.sys
  0xA6871000 \SystemRoot\system32\drivers\peauth.sys
  0xA694F000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xA6959000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xA6965000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
  0xA696A000 \??\C:\Windows\system32\drivers\MGHwCtrl.sys
  0xA696D000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0xA6983000 \??\C:\Users\Dani\AppData\Local\Temp\pxtoqpoc.sys
  0x77A80000 \Windows\System32\ntdll.dll

Processes (total 69):
       0 System Idle Process
       4 System
     488 C:\Windows\System32\smss.exe
     556 csrss.exe
     600 C:\Windows\System32\wininit.exe
     612 csrss.exe
     644 C:\Windows\System32\services.exe
     656 C:\Windows\System32\lsass.exe
     664 C:\Windows\System32\lsm.exe
     720 C:\Windows\System32\winlogon.exe
     868 C:\Windows\System32\svchost.exe
     928 C:\Windows\System32\svchost.exe
     968 C:\Windows\System32\svchost.exe
    1060 C:\Windows\System32\svchost.exe
    1088 C:\Windows\System32\svchost.exe
    1120 C:\Windows\System32\svchost.exe
    1236 C:\Windows\System32\audiodg.exe
    1260 C:\Windows\System32\svchost.exe
    1280 C:\Windows\System32\SLsvc.exe
    1336 C:\Windows\System32\svchost.exe
    1536 C:\Windows\System32\svchost.exe
    1724 C:\Windows\System32\spoolsv.exe
    1752 C:\Windows\System32\svchost.exe
     340 C:\Windows\System32\dwm.exe
     368 C:\Windows\System32\taskeng.exe
     432 C:\Windows\explorer.exe
    1228 C:\Windows\System32\taskeng.exe
    1620 C:\Windows\RtHDVCpl.exe
    1532 C:\Windows\System32\igfxtray.exe
    1464 C:\Windows\System32\hkcmd.exe
     924 C:\Windows\System32\igfxpers.exe
    1028 C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe
    1940 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2028 C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
     480 C:\Program Files\Logitech\QuickCam\Quickcam.exe
     876 C:\Program Files\iTunes\iTunesHelper.exe
    1172 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2084 C:\Program Files\Windows Sidebar\sidebar.exe
    2104 C:\Windows\ehome\ehtray.exe
    2116 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    2128 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    2184 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    2308 C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    2328 C:\Windows\ehome\ehmsas.exe
    2368 C:\Program Files\OpenOffice.org 2.3\program\soffice.bin
    2792 C:\Windows\System32\agrsmsvc.exe
    2824 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    2836 C:\Program Files\Bonjour\mDNSResponder.exe
    2876 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    2892 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    3008 C:\Program Files\LG Software\System Control Manager\edd.exe
    3032 C:\Program Files\CDBurnerXP\NMSAccessU.exe
    3100 C:\Windows\System32\o2flash.exe
    3108 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    3180 C:\Windows\System32\svchost.exe
    3204 C:\Windows\System32\svchost.exe
    3312 C:\Windows\System32\svchost.exe
    3340 C:\Windows\System32\SearchIndexer.exe
    3468 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    3756 C:\Program Files\iPod\bin\iPodService.exe
    1256 C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
    3476 C:\Windows\System32\svchost.exe
    4664 C:\Windows\System32\wuauclt.exe
    5496 C:\Program Files\Mozilla Firefox\firefox.exe
    4856 C:\Windows\System32\SearchProtocolHost.exe
    3252 C:\Windows\System32\SearchFilterHost.exe
    4564 C:\Users\***\Desktop\MBRCheck.exe
    1616 C:\Windows\System32\conime.exe
    4696 <unknown>

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`40398600  (NTFS)

PhysicalDrive0 Model Number: ST9160821AS, Rev: 3.ALC   

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \\.\PhysicalDrive0   Unknown MBR code
            SHA1: 16FACB29D75458833E397367B1DA17929157C2B3


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice:
         

149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 16FACB29D75458833E397367B1DA17929157C2B3

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

Habe da noch eine Frage zu:
die viste recover Datei ist als rar gepackt, muss ich die vorher entpacken, oder kann ich die auch so auf eine CD brennen und dann davon booten? (wahrscheinlich nicht, aber von sowas hab ich keine Ahnung und gemacht hab ich sowas auch noch nie...).

Danke für Deine Hilfe!
Grüße sporty33