Trojaner-Board - Drive by Download. JavaScript ausgeführt.. auf Facebook

ComboFix 11-11-16.01 - Loris Tischer 16.11.2011 22:23:14.3.2 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.3071.2816 [GMT 1:00]
ausgeführt von:: c:\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))

C:\config.dat
C:\Dokumente und Einstellungen\Loris Tischer\WINDOWS
C:\Programme\FreeYouTubeDownload3016.exe
C:\readme.txt
C:\WINDOWS\IsUn0407.exe
C:\WINDOWS\iun6002.exe

Infizierte Kopie von C:\WINDOWS\system32\midimap.dll wurde gefunden und desinfiziert
Kopie von - C:\WINDOWS\NiwradSoft Shell Pack\Backup\midimap.dll wurde wiederhergestellt

((((((((((((((((((((((( Dateien erstellt von 2011-10-16 bis 2011-11-16 ))))))))))))))))))))))))))))))

2011-11-16 20:25:32 . 2011-11-16 20:26:23 -------- d-----w- C:\Dokumente und Einstellungen\Administrator
2011-11-14 21:46:16 . 2011-11-14 21:46:16 -------- d-----w- C:\_OTL
2011-11-10 15:50:15 . 2011-11-10 15:50:15 -------- d-----w- C:\Programme\ESET
2011-11-09 20:42:03 . 2011-11-09 20:42:03 -------- d-----w- C:\Dokumente und Einstellungen\Loris Tischer\Anwendungsdaten\Malwarebytes
2011-11-09 20:41:51 . 2011-11-09 20:41:51 -------- d-----w- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-11-09 20:41:47 . 2011-11-10 15:31:01 -------- d-----w- C:\Programme\Malwarebytes' Anti-Malware
2011-11-09 20:41:47 . 2011-08-31 16:00:50 22216 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2011-11-08 20:03:13 . 2011-11-08 20:03:13 -------- d-----w- C:\Programme\Gemeinsame Dateien\Java
2011-10-18 19:13:37 . 2011-10-18 19:13:37 -------- d-----w- C:\Dokumente und Einstellungen\Loris Tischer\Anwendungsdaten\Avira
2011-10-18 19:11:07 . 2011-10-11 13:00:01 36000 ----a-w- C:\WINDOWS\system32\drivers\avkmgr.sys
2011-10-18 19:11:07 . 2011-10-11 13:00:01 134344 ----a-w- C:\WINDOWS\system32\drivers\avipbb.sys
2011-10-18 19:10:06 . 2011-10-18 19:12:50 -------- d-----w- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2011-10-18 19:10:06 . 2011-10-18 19:10:06 -------- d-----w- C:\Programme\Avira
2011-10-18 18:48:26 . 2011-10-18 18:50:56 83538448 ----a-w- C:\Programme\avira_free_antivirus_de.exe
.

(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))

2011-10-19 12:25:49 . 2011-06-07 14:31:53 414368 ----a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2011-10-13 15:14:11 . 2011-10-13 15:14:06 1110476 ----a-w- C:\Programme\7z920.exe
2011-10-11 13:00:01 . 2009-12-10 19:45:12 74640 ----a-w- C:\WINDOWS\system32\drivers\avgntflt.sys
2011-10-10 14:22:46 . 2005-11-07 16:49:37 692736 ----a-w- C:\WINDOWS\system32\inetcomm.dll
2011-10-03 04:06:03 . 2011-05-25 20:03:41 472808 ----a-w- C:\WINDOWS\system32\deployJava1.dll
2011-10-03 01:37:52 . 2011-05-25 20:03:41 73728 ----a-w- C:\WINDOWS\system32\javacpl.cpl
2011-09-28 07:06:43 . 2005-11-07 08:37:41 604160 ----a-w- C:\WINDOWS\system32\crypt32.dll
2011-09-26 09:41:54 . 2008-07-29 18:59:58 614912 ----a-w- C:\WINDOWS\system32\uiautomationcore.dll
2011-09-26 09:41:54 . 2005-11-07 08:37:50 23040 ----a-w- C:\WINDOWS\system32\oleaccrc.dll
2011-09-26 09:41:20 . 2005-11-07 08:37:50 220160 ----a-w- C:\WINDOWS\system32\oleacc.dll
2011-09-06 14:10:01 . 2005-11-07 08:37:56 1859072 ----a-w- C:\WINDOWS\system32\win32k.sys
2011-08-22 23:41:33 . 2005-11-07 08:37:56 916480 ----a-w- C:\WINDOWS\system32\wininet.dll
2011-08-22 23:41:31 . 2005-11-07 08:37:46 43520 ----a-w- C:\WINDOWS\system32\licmgr10.dll
2011-08-22 23:41:31 . 2005-11-07 08:37:45 1469440 ----a-w- C:\WINDOWS\system32\inetcpl.cpl
2011-08-22 11:56:39 . 2005-11-07 08:37:44 385024 ----a-w- C:\WINDOWS\system32\html.iec

------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.

[7] 2008-04-14 02:22:08 . D0DE8A2EC95184E5193BB4B3112E29DF . 846848 . . [2001.12.4414.700] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\comres.dll
[-] 2008-04-14 02:22:08 . 08AD15F9B0449D12587A2ED34AAACD12 . 1548800 . . [2001.12.4414.700] . . C:\WINDOWS\ServicePackFiles\i386\comres.dll
[-] 2008-04-14 02:22:08 . 08AD15F9B0449D12587A2ED34AAACD12 . 1548800 . . [2001.12.4414.700] . . C:\WINDOWS\system32\comres.dll
[7] 2004-08-04 12:00:00 . 4B9D9E2708019763C5A72DA776DB1158 . 846848 . . [2001.12.4414.258] . . C:\WINDOWS\$NtServicePackUninstall$\comres.dll

[7] 2008-04-14 02:23:05 . F09A527B422E25C478E38CAA0E44417A . 513024 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\winlogon.exe
[-] 2008-04-14 02:23:05 . AD37DF3FB8F168E42C09B77B487F6812 . 552448 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 02:23:05 . AD37DF3FB8F168E42C09B77B487F6812 . 552448 . . [5.1.2600.5512 (xpsp.080413-2113)] . . C:\WINDOWS\system32\winlogon.exe
[-] 2004-08-25 16:59:56 . 325A82EBBD69248D75C5F831E8817D17 . 507904 . . [5.1.2600.2508 (xpsp.040806-1825)] . . C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[7] 2004-08-04 12:00:00 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\$NtUninstallKB883529$\winlogon.exe

[7] 2008-04-14 02:22:31 . B0050CC5340E3A0760DD8B417FF7AEBD . 580096 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\user32.dll
[-] 2008-04-14 02:22:31 . C268AE6C540CC43F2264C8CB7A9A4243 . 580096 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 02:22:31 . C268AE6C540CC43F2264C8CB7A9A4243 . 580096 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\user32.dll
[-] 2007-03-08 15:48:39 . 78785EFF8CB90CEC1862A4CCFD9A3C3A . 579584 . . [5.1.2600.3099 (xpsp_sp2_qfe.070308-0217)] . . C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 15:36:30 . 492E166CFD26A50FB9160DB536FF7D2B . 579072 . . [5.1.2600.3099 (xpsp_sp2_gdr.070308-0222)] . . C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[-] 2005-03-02 18:19:56 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622 (xpsp.050301-1521)] . . C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 18:09:46 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] . . C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[7] 2004-08-04 12:00:00 . 56785FD5236D7B22CF471A6DA9DB46D8 . 578560 . . [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[-] 2008-04-14 02:22:45 . C4F91B363B29E589E84E6D9D41A92952 . 1544192 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\explorer.exe
[7] 2008-04-14 02:22:45 . 418045A93CD87A352098AB7DABE1B53E . 1036800 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\explorer.exe
[-] 2008-04-14 02:22:45 . C4F91B363B29E589E84E6D9D41A92952 . 1544192 . . [6.00.2900.5512 (xpsp.080413-2105)] . . C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 13:10:08 . 331ED93570BAF3CFE30340298762CD56 . 1036288 . . [6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)] . . C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[-] 2005-04-07 18:46:59 . 64322E8399B205B7281FF883737A9B03 . 1035264 . . [6.00.2900.2649 (xpsp.050406-1732)] . . C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[7] 2004-08-04 12:00:00 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\$NtUninstallKB884883$\explorer.exe

[-] 2008-04-14 02:22:58 . B4E7A9D7524304DC390E19ED7E1D7EE3 . 283136 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\regedit.exe
[7] 2008-04-14 02:22:58 . AD9226BF3CED13636083BB9C76E9D2A2 . 153600 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\regedit.exe
[-] 2008-04-14 02:22:58 . B4E7A9D7524304DC390E19ED7E1D7EE3 . 283136 . . [5.1.2600.5512 (xpsp.080413-2111)] . . C:\WINDOWS\ServicePackFiles\i386\regedit.exe
[7] 2004-08-04 12:00:00 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\$NtServicePackUninstall$\regedit.exe
[7] 2004-08-04 12:00:00 . 8193CE5FB09E83F2699FD65BBCBE2FD2 . 153600 . . [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\I386\REGEDIT.EXE

[7] 2008-04-14 02:22:40 . 01B4E6E990B6C5EA8856D96C7FD044B2 . 15360 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\ctfmon.exe
[-] 2008-04-14 02:22:40 . 6BB3F4E4B01913F1764CC137E841B520 . 40448 . . [5.1.2600.5512 (xpsp.080413-2105)] . . C:\WINDOWS\system32\ctfmon.exe
[7] 2004-08-04 12:00:00 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe

[7] 2008-04-14 02:22:11 . 0DAF0705D7B39C94E287913226688804 . 348672 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\hnetcfg.dll
[-] 2008-04-14 02:22:11 . 0F68637BB752D674D110928CD31B7292 . 373248 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\ServicePackFiles\i386\hnetcfg.dll
[-] 2008-04-14 02:22:11 . 0F68637BB752D674D110928CD31B7292 . 373248 . . [5.1.2600.5512 (xpsp.080413-0852)] . . C:\WINDOWS\system32\hnetcfg.dll
[7] 2004-08-04 12:00:00 . AE93E415220A4C0112768A0DEE36D28D . 348672 . . [5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\$NtServicePackUninstall$\hnetcfg.dll

[7] 2009-06-29 08:35:10 . 3CFC56F73D494FC1AA2B6E981DF15ACD . 634632 . . [7.00.6000.16876 (vista_gdr.090625-2339)] . . C:\WINDOWS\ie8\iexplore.exe
[7] 2009-06-29 07:25:31 . 02E2754D3E566C11A4934825920C47DD . 634632 . . [7.00.6000.21073 (vista_ldr.090625-2339)] . . C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\iexplore.exe
[7] 2009-04-25 05:27:50 . 092A7F2B49A19ECCE5369D3CB2276148 . 636088 . . [7.00.6000.16850 (vista_gdr.090423-0018)] . . C:\WINDOWS\ie7updates\KB972260-IE7\iexplore.exe
[7] 2009-04-25 05:27:39 . C0503FD8D163652735C1EE900672A75C . 636088 . . [7.00.6000.21045 (vista_ldr.090423-0018)] . . C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
[7] 2009-03-08 12:09:26 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\NiwradSoft Shell Pack\Backup\iexplore.exe
[-] 2009-03-08 12:09:26 . F68C1BAC147227B86FFB36828FF8BEDF . 510816 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[-] 2009-03-08 12:09:26 . F68C1BAC147227B86FFB36828FF8BEDF . 510816 . . [8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)] . . C:\WINDOWS\system32\dllcache\iexplore.exe
[7] 2009-02-28 04:54:44 . BCD8E48709BE4A79606F0B6E8E9A6162 . 636088 . . [7.00.6000.21020 (vista_ldr.090226-1506)] . . C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[7] 2009-02-28 04:54:41 . A251068640DDB69FD7805B57D89D7FF7 . 636072 . . [7.00.6000.16827 (vista_gdr.090226-1506)] . . C:\WINDOWS\ie7updates\KB969897-IE7\iexplore.exe
[7] 2008-12-19 05:25:30 . 15E8A89499741D5CF59A9CF6463A4339 . 634024 . . [7.00.6000.20978 (vista_ldr.081217-1620)] . . C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe
[7] 2008-12-19 05:25:30 . 15E8A89499741D5CF59A9CF6463A4339 . 634024 . . [7.00.6000.20978 (vista_ldr.081217-1620)] . . C:\WINDOWS\SoftwareDistribution\Download\16035e76e7a72d3a2285fb1603a86010\SP2QFE\iexplore.exe
[7] 2008-12-19 05:25:25 . 030D78FE84A086ED376EFCBD2D72C522 . 634024 . . [7.00.6000.16791 (vista_gdr.081217-1620)] . . C:\WINDOWS\ie7updates\KB963027-IE7\iexplore.exe
[7] 2008-12-19 05:25:25 . 030D78FE84A086ED376EFCBD2D72C522 . 634024 . . [7.00.6000.16791 (vista_gdr.081217-1620)] . . C:\WINDOWS\SoftwareDistribution\Download\16035e76e7a72d3a2285fb1603a86010\SP2GDR\iexplore.exe
[7] 2008-08-23 05:56:16 . E8305C30D35E85D6657ED3E9934CB302 . 635848 . . [7.00.6000.20900 (vista_ldr.080820-1506)] . . C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe
[7] 2008-08-23 05:56:16 . E8305C30D35E85D6657ED3E9934CB302 . 635848 . . [7.00.6000.20900 (vista_ldr.080820-1506)] . . C:\WINDOWS\SoftwareDistribution\Download\d53a19238e3664857cfe3ba9425b011d\SP2QFE\iexplore.exe
[7] 2008-08-23 05:56:15 . 1F03216084447F990AE797317D0A6E70 . 635848 . . [7.00.6000.16735 (vista_gdr.080820-1506)] . . C:\WINDOWS\ie7updates\KB961260-IE7\iexplore.exe
[7] 2008-08-23 05:56:15 . 1F03216084447F990AE797317D0A6E70 . 635848 . . [7.00.6000.16735 (vista_gdr.080820-1506)] . . C:\WINDOWS\SoftwareDistribution\Download\d53a19238e3664857cfe3ba9425b011d\SP2GDR\iexplore.exe
[7] 2007-08-13 17:43:56 . DE49B348A18369B4626FBA1D49B07FB4 . 622080 . . [7.00.5730.13 (longhorn(wmbla).070711-1130)] . . C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
[7] 2004-08-04 12:00:00 . B39A6AF04A431E317C85BF061719E705 . 93184 . . [6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] . . C:\WINDOWS\ie7\iexplore.exe

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAShCut.exe" [2005-01-07 16:07:16 61952]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 11:36:20 14854144]
"EPSON Stylus DX4200 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE" [2005-03-08 04:00:00 98304]
"AOLDialer"="C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe" [2007-06-21 12:42:56 70952]
"HostManager"="C:\Programme\Gemeinsame Dateien\AOL\1174821229\ee\AOLSoftware.exe" [2006-11-17 13:16:10 50736]
"AVMWlanClient"="C:\Programme\avmwlanstick\wlangui.exe" [2009-05-07 01:01:00 1904640]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2009-03-27 08:03:00 13684736]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2009-03-27 08:03:00 86016]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2007-03-11 15:27:02 98304]
"IntelliPoint"="C:\Programme\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 19:16:31 1468296]
"VirtualCloneDrive"="C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 11:44:11 85160]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 16:55:10 55824]
"avgnt"="C:\Programme\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 12:59:37 258512]
"SunJavaUpdateSched"="C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 12:06:06 254696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 02:22:40 40448]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\
AOL 9.0 Tray-Symbol.lnk - C:\Programme\AOL 9.0\aoltray.exe [2007-3-11 156784]
Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe [2010-10-31 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 11:28:42 72208 ----a-w- c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk
backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KMCONFIG]
2007-03-06 12:51:14 212992 ----a-w- C:\Programme\Trust\Trust R-Series Mouse\StartAutorun.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 02:22:54 1695232 ------w- C:\Programme\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 10:50:42 155648 ----a-w- C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2005-11-01 12:23:32 143360 ----a-w- C:\Program Files\CyberLink\PowerCinema\PCMService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress]
2005-08-24 19:14:44 2031711 ----a-w- C:\Program Files\CyberLink\Power2Go\Power2GoExpress.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-03-11 15:27:02 98304 ----a-w- C:\Programme\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2009-06-02 03:54:21 26112 ----a-w- C:\Programme\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2005-04-15 15:13:00 45056 ----a-w- C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WEB.DE Update]
2009-10-30 15:06:47 2276744 ----a-w- C:\Programme\Web.de\LiveUpdate\m2LUTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{1290A33C-85F5-4164-A1BE-7DD299D4986A}]
2005-04-11 14:34:02 69721 ----a-w- C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"C:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
"C:\\Programme\\Messenger\\Msmsgs.exe"=
"C:\\Programme\\Gemeinsame Dateien\\aol\\ACS\\AOLacsd.exe"=
"C:\\Programme\\Gemeinsame Dateien\\aol\\ACS\\AOLDial.exe"=
"C:\\Programme\\AOL 9.0\\waol.exe"=
"C:\\Programme\\UBISOFT\\Heroes of Might and Magic V\\bin\\H5_Game.exe"=
"C:\\Programme\\ANNO 1602 Königs-Edition\\1602.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Programme\\Reality Pump\\KnightShift\\KnightShift.ex2"=
"C:\\Programme\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
"C:\\Programme\\GameSpy Arcade\\Aphex.exe"=
"C:\\Programme\\Gemeinsame Dateien\\aol\\1174821229\\ee\\aolsoftware.exe"=
"C:\\Programme\\JoWooD\\SpellForce\\spellforce.exe"=
"C:\\Programme\\Microsoft Games\\Age of Mythology\\aom.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Programme\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"C:\\Programme\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"C:\\Programme\\Kalypso\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"C:\\Programme\\UBISOFT\\Heroes of Might and Magic V - Tribes of the East\\bin\\H5_Game.exe"=
"C:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=
"C:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"C:\\Dokumente und Einstellungen\\Loris Tischer\\Eigene Dateien\\World of Padman\\wop.exe"=
"C:\\Programme\\ICQ7.4\\ICQ.exe"=
"C:\\Dokumente und Einstellungen\\Loris Tischer\\Desktop\\Games\\World of Padman 1.5\\wop.exe"=
"C:\\Programme\\Skype\\Phone\\Skype.exe"=
"C:\\Programme\\TmNationsForever\\TmForever.exe"=
"C:\\Programme\\Steam\\SteamApps\\larrygarry927\\counter-strike source\\hl2.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"59124:TCP"= 59124:TCP:Pando Media Booster
"59124:UDP"= 59124:UDP:Pando Media Booster
"8396:TCP"= 8396:TCP:League of Legends Launcher
"8396:UDP"= 8396:UDP:League of Legends Launcher
"6976:TCP"= 6976:TCP:League of Legends Launcher
"6976:UDP"= 6976:UDP:League of Legends Launcher
"6921:TCP"= 6921:TCP:League of Legends Launcher
"6921:UDP"= 6921:UDP:League of Legends Launcher
"6893:TCP"= 6893:TCP:League of Legends Launcher
"6893:UDP"= 6893:UDP:League of Legends Launcher
"8397:TCP"= 8397:TCP:League of Legends Launcher
"8397:UDP"= 8397:UDP:League of Legends Launcher
"6988:TCP"= 6988:TCP:League of Legends Launcher
"6988:UDP"= 6988:UDP:League of Legends Launcher
"8398:TCP"= 8398:TCP:League of Legends Launcher
"8398:UDP"= 8398:UDP:League of Legends Launcher
"8393:TCP"= 8393:TCP:League of Legends Lobby
"8393:UDP"= 8393:UDP:League of Legends Lobby
"8390:TCP"= 8390:TCP:League of Legends Game Client
"8390:UDP"= 8390:UDP:League of Legends Game Client
"6964:TCP"= 6964:TCP:League of Legends Launcher
"6964:UDP"= 6964:UDP:League of Legends Launcher

R0 878BDA;DVB-TV 878 BDA Driver;C:\WINDOWS\system32\drivers\878BDA.sys [07.11.2005 09:45:06 78336]
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys [05.07.2006 13:46:06 63352]
R1 avkmgr;avkmgr;C:\WINDOWS\system32\drivers\avkmgr.sys [18.10.2011 20:11:07 36000]
R2 AntiVirSchedulerService;Avira Planer;C:\Programme\Avira\AntiVir Desktop\sched.exe [18.10.2011 20:11:15 86224]
R2 AntiVirWebService;Avira Browser Schutz;C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe [18.10.2011 20:11:08 463824]
R2 FsUsbExService;FsUsbExService;C:\WINDOWS\system32\FsUsbExService.Exe [13.05.2009 20:00:20 233472]
R2 KMWDSERVICE;Keyboard And Mouse Communication Service;C:\Programme\Trust\Trust R-Series Mouse\KMWDSrv.exe [08.06.2007 23:23:50 208896]
R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\drivers\LBeepKE.sys [31.10.2010 18:10:22 10384]
R3 FsUsbExDisk;FsUsbExDisk;C:\WINDOWS\system32\FsUsbExDisk.Sys [13.05.2009 20:00:20 36608]
R3 FWLANUSB;AVM FRITZ!WLAN;C:\WINDOWS\system32\drivers\fwlanusb.sys [21.01.2007 15:59:17 265088]
R3 LADF_DHP2;G35 DHP2 Filter Driver;C:\WINDOWS\system32\drivers\ladfDHP2i386.sys [10.04.2009 19:19:38 53264]
R3 LADF_SBVM;G35 SBVM Filter Driver;C:\WINDOWS\system32\drivers\ladfSBVMi386.sys [10.04.2009 19:19:44 334992]
R3 PhilCap;PhilCap service;C:\WINDOWS\system32\drivers\PhilCap.sys [07.11.2005 09:45:06 787840]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16:28 130384]
S2 gupdate1c991e6324b2b64;Google Update Service (gupdate1c991e6324b2b64);C:\Programme\Google\Update\GoogleUpdate.exe [18.02.2009 17:30:22 133104]
S3 ActionReplayDS;ActionReplayDS;C:\WINDOWS\system32\drivers\actionreplayds.sys [21.10.2009 22:22:14 29184]
S3 avmeject;AVM Eject;C:\WINDOWS\system32\drivers\avmeject.sys [07.05.2009 02:01:00 4352]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe [07.11.2005 18:37:07 1527900]
S3 gupdatem;Google Update-Dienst (gupdatem);C:\Programme\Google\Update\GoogleUpdate.exe [18.02.2009 17:30:22 133104]
S3 SIS163u;SiS163 usb Wireless LAN Adapter Driver;C:\WINDOWS\system32\drivers\sis163u.sys [07.11.2005 09:45:10 215040]
S3 VMUVC;Vimicro Camera Service VMUVC;C:\WINDOWS\system32\Drivers\VMUVC.sys --> C:\WINDOWS\system32\Drivers\VMUVC.sys [?]
S3 vvftUVC;Vimicro Camera Filter Service VMUVC;C:\WINDOWS\system32\drivers\vvftUVC.sys --> C:\WINDOWS\system32\drivers\vvftUVC.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16:28 753504]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - FSUSBEXDISK

Inhalt des "geplante Tasks" Ordners

2011-11-16 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Programme\Google\Update\GoogleUpdate.exe [2009-02-18 16:30:22 . 2009-02-18 16:30:19]

2011-11-16 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Programme\Google\Update\GoogleUpdate.exe [2009-02-18 16:30:22 . 2009-02-18 16:30:19]

------- Zusätzlicher Suchlauf -------

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.de/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://go.web.de/suchbox/webdesuche?su=%s
IE: Free YouTube Download - C:\Dokumente und Einstellungen\Loris Tischer\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Loris Tischer\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Programme\ICQ7.4\ICQ.exe
LSP: C:\Programme\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{21BBC1BB-38CE-4F03-AE6E-AFE194038080}: NameServer = 192.168.178.1
FF - ProfilePath - C:\Dokumente und Einstellungen\Loris Tischer\Anwendungsdaten\Mozilla\Firefox\Profiles\9sirfwyx.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - google.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
FF - Ext: FoxyProxy Standard: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
FF - Ext: FoxyProxy Basic: foxyproxy@eric.h.jung - %profile%\extensions\foxyproxy@eric.h.jung
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Free YouTube Download (Free Studio) Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - C:\Programme\Java\jre6\lib\deploy\jqs\ff

- - - - Entfernte verwaiste Registrierungseinträge - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-ApnUpdater - C:\Programme\Ask.com\Updater\Updater.exe
Notify-AtiExtEvent - (no file)
MSConfigStartUp-swg - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-ANNO 1602 Königs-Edition - C:\WINDOWS\IsUn0407.exe
AddRemove-Heroes of Might and Magic IV - C:\WINDOWS\IsUn0407.exe
AddRemove-Microsoft Interactive Training - C:\WINDOWS\IsUn0407.exe
AddRemove-World of Padman 1.5 - C:\Dokumente und Einstellungen\Loris Tischer\Eigene Dateien\World of Padman\World of Padman 1.5\UnWoP.exe
AddRemove-YouTube Song Downloader_is1 - C:\Programme\YouTube Song Downloader\unins000.exe
AddRemove-Zuma_Deluxe!_1.0 - C:\WINDOWS\iun6002.exe

mehr steht da nicht..