Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   RunDLL nach Bundestrojaner - was ist zur Computer Sicherheit noch nötig? (https://www.trojaner-board.de/117560-rundll-bundestrojaner-computer-sicherheit-noch-noetig.html)

012 055-0 18.06.2012 19:41
RunDLL nach Bundestrojaner - was ist zur Computer Sicherheit noch nötig?
 
Guten Tag!
Heute habe ich mir den Bundestrojaner eingefangen, Mist!
Nach vielem Suchen habe ich Eure Anleitung gefunden.
Habe als erstes AntiVir laufen lassen, indem ich mich mit andrem User am PC anmelden konnte.
8 Funde, gelöscht.
Problem bestand weiter
Task Manager: Das hat mir nicht geholfen, da mit Rechtsklick keine Adresse beim Bild sichtbar wurde.
Auch war der Task Manager imm nur Bruchteile zu sehen, bevor er wieder dahinter verschwand.
Dann habe ich Malewarebytes laufen lassen:
2 Infizierte gefunden, sind noch in Quarantäne.

Jetzt taucht nur noch die Fehlermeldung mit dem RunDLL auf, weil da jetzt natürlich was fehlt.
Wie bekomme ich das weg,
aber,
viel wichtiger, wie bekomme ich den PC wieder sicher?
Ist da noch was drauf?
Neu Aufsetzen - habe ich noch nie gemacht; leider.
Habe Vista und wenig Ahnung.
Normal läuft Free Av als Antivir bei mir - hat aber nicht geholfen.
Habe diesen Thread so erstellt, wie es die Anleitung sagt, daher viel OTL.Txt und Extras.TXT

DANKE + bin sehr gespannt!

Grüße
HelmutOTL Logfile:
Code:
OTL logfile created on: 18.06.2012 20:17:47 - Run 1
OTL by OldTimer - Version 3.2.49.0    Folder = C:\Users\Helmut\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
958,06 Mb Total Physical Memory | 378,67 Mb Available Physical Memory | 39,52% Memory free
2,12 Gb Paging File | 1,25 Gb Available in Paging File | 59,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 147,04 Gb Total Space | 69,04 Gb Free Space | 46,95% Space Free | Partition Type: NTFS
 
Computer Name: HELMUT-PC | User Name: Helmut | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.18 20:16:23 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
PRC - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 17:45:46 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 17:45:46 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.09.01 14:39:54 | 000,966,712 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
PRC - [2011.06.16 14:09:48 | 000,135,168 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe
PRC - [2011.06.14 17:42:26 | 001,540,096 | ---- | M] (Nokia) -- C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe
PRC - [2011.06.08 14:49:48 | 000,159,744 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
PRC - [2008.03.28 15:39:26 | 000,171,448 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
PRC - [2007.02.15 11:04:56 | 000,282,624 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
PRC - [2007.02.04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Programme\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
PRC - [2006.12.22 07:29:56 | 000,067,752 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Elements 5.0\apdproxy.exe
PRC - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2006.11.02 14:34:59 | 000,201,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2006.11.02 11:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.01 14:38:32 | 000,931,896 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Maps Service API.dll
MOD - [2011.09.01 14:37:50 | 010,837,504 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtWebKit4.dll
MOD - [2011.09.01 14:37:50 | 000,913,920 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtNetwork4.dll
MOD - [2011.09.01 14:37:50 | 000,416,256 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\sqldrivers\qsqlite4.dll
MOD - [2011.09.01 14:37:50 | 000,196,608 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qjpeg4.dll
MOD - [2011.09.01 14:37:50 | 000,026,624 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qgif4.dll
MOD - [2011.09.01 14:37:48 | 008,166,912 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtGui4.dll
MOD - [2011.09.01 14:37:48 | 002,551,296 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXmlPatterns4.dll
MOD - [2011.09.01 14:37:48 | 002,282,496 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtCore4.dll
MOD - [2011.09.01 14:37:48 | 002,246,656 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtDeclarative4.dll
MOD - [2011.09.01 14:37:48 | 001,288,192 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtScript4.dll
MOD - [2011.09.01 14:37:48 | 000,676,864 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtOpenGL4.dll
MOD - [2011.09.01 14:37:48 | 000,340,480 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXml4.dll
MOD - [2011.09.01 14:37:48 | 000,266,752 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\phonon4.dll
MOD - [2011.09.01 14:37:48 | 000,190,464 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtSql4.dll
MOD - [2011.09.01 14:08:58 | 000,508,416 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtMultimediaKit1.dll
MOD - [2011.09.01 14:08:56 | 000,109,568 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\mediaservice\dsengine.dll
MOD - [2011.09.01 14:08:18 | 000,378,880 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtCore.dll
MOD - [2011.09.01 14:08:18 | 000,159,232 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtWeb.dll
MOD - [2011.09.01 14:08:16 | 000,089,088 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\qjson.dll
MOD - [2011.09.01 14:08:14 | 000,392,080 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\ssoengine.dll
MOD - [2011.09.01 14:08:14 | 000,387,976 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\OviShareLib.dll
MOD - [2011.09.01 14:08:14 | 000,058,768 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\securestorage.dll
MOD - [2011.09.01 14:07:04 | 000,727,552 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\CommonUpdateChecker.dll
MOD - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
MOD - [2005.07.20 11:48:10 | 000,059,904 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\zlib1.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
SRV - [2008.01.02 23:31:09 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0)
SRV - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.05.08 17:45:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 17:45:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.05.18 10:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011.05.18 10:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011.05.18 10:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011.05.18 10:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007.05.09 17:33:00 | 000,048,640 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006.10.14 05:04:33 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.10.09 15:03:56 | 000,017,152 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX)
DRV - [2006.10.09 14:46:44 | 000,017,536 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.drehscheibe-online.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.09.08 20:25:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.09.08 20:25:51 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [BrowserChoice] C:\Windows\System32\browserchoice.exe (Microsoft Corporation)
O4 - HKCU..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKCU..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: drehscheibe-online.de ([www] http in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: olb.de ([www] * in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: privatbahnforum.de ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} https://www.olb.de/olb_fb3_1867b/plugin/AXFOAM.CAB (B+S Banksysteme AG DDBAC Plug-In)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E45CACCA-FE12-4220-A739-E4ECD74A176F}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\System32\explorer.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.18 20:16:20 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.18 18:48:48 | 000,000,000 | ---D | C] -- C:\Users\Helmut\AppData\Roaming\Malwarebytes
[2012.06.18 18:48:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.18 18:48:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.18 18:48:38 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.18 18:48:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.18 14:52:54 | 000,000,000 | ---D | C] -- C:\T-Online
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.18 20:16:23 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.18 20:14:08 | 000,000,000 | ---- | M] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 19:54:06 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.18 19:54:06 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.18 19:53:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.18 19:53:49 | 1005,244,416 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.18 18:48:40 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:31:47 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.06.18 16:06:54 | 000,000,000 | ---- | M] () -- C:\Windows\System32\explorer.exe
[2012.06.18 15:42:51 | 000,651,112 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.18 15:42:51 | 000,618,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.18 15:42:51 | 000,120,908 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.18 15:42:51 | 000,107,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.18 15:30:07 | 000,000,680 | ---- | M] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
 
========== Files Created - No Company Name ==========
 
[2012.06.18 20:14:08 | 000,000,000 | ---- | C] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 18:48:40 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:28:44 | 1005,244,416 | -HS- | C] () -- C:\hiberfil.sys
[2012.06.18 16:04:08 | 000,000,000 | ---- | C] () -- C:\Windows\System32\explorer.exe
[2012.06.18 13:43:00 | 000,000,680 | ---- | C] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.06.18 13:39:08 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2010.10.01 20:01:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== LOP Check ==========
 
[2009.05.28 22:08:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Canon
[2008.01.01 20:43:47 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\DataDesign
[2009.11.29 15:23:21 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\gtk-2.0
[2009.07.12 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Lasersoft Imaging
[2009.08.25 22:20:31 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\NewSoft
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia Ovi Suite
[2009.05.28 21:38:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Opera
[2011.10.15 22:25:53 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Packnet
[2011.09.08 21:55:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\PC Suite
[2009.05.28 19:37:02 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ScanSoft
[2008.01.01 19:52:30 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\T-Online
[2009.01.11 21:48:09 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Vso
[2009.05.11 19:50:41 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Zoner
[2012.06.18 19:52:56 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---
OTL Logfile:
Code:
OTL Extras logfile created on: 18.06.2012 20:17:47 - Run 1
OTL by OldTimer - Version 3.2.49.0    Folder = C:\Users\Helmut\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
958,06 Mb Total Physical Memory | 378,67 Mb Available Physical Memory | 39,52% Memory free
2,12 Gb Paging File | 1,25 Gb Available in Paging File | 59,05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 147,04 Gb Total Space | 69,04 Gb Free Space | 46,95% Space Free | Partition Type: NTFS
 
Computer Name: HELMUT-PC | User Name: Helmut | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe (Deutsche Telekom AG, T-Com)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG, T-Com)
htmlfile [opennew] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG, T-Com)
http [open] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG, T-Com)
https [open] -- "C:\Program Files\T-Online\T-Online_Software_6\Browser\Browser.exe" "%1" (Deutsche Telekom AG, T-Com)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A371F44-792A-439E-9E0B-A391E6CD6A1D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{77C13F83-6FF3-47F2-B325-C688DFBDFBC9}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{8885869C-42A7-410F-BC0D-532C3FEE3383}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{9E941BEA-09B3-4787-82E3-7EA94A29048D}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"UDP Query User{71A41B21-5852-40F5-98ED-EEDB530D2A67}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{856FCBCE-0457-46F2-8BF5-40A7EDDC4B29}C:\program files\nokia\nokia ovi suite\nokiaovisuite.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia ovi suite\nokiaovisuite.exe |
"UDP Query User{87EB2EE6-7515-4BEB-B4E8-A8A00A93CFF4}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07D77970-B205-460C-84E4-263F30455597}" = Nokia Ovi Suite
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4805" = CanoScan 8800F
"{12451AF7-EFF8-4B5B-8255-282D7CC7CAEE}" = OviMPlatform
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{25569723-DC5A-4467-A639-79535BF01B71}" = Adobe Help Center 2.1
"{2CC53A53-44F4-4667-8584-2FFC9ACB2242}" = Ovi Desktop Sync Engine
"{2D99A593-C841-43A7-B7C9-D6F3AE70B756}" = Nokia Connectivity Cable Driver
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}" = Steuer-Spar-Erklärung 2009
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional 2003 MRT
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F5FD796-86F0-4360-85F8-D54C0F5411EB}" = Steuer-Spar-Erklärung 2011
"{A7B609FB-83D8-4FC3-8477-1BC65ECFE85B}" = Adobe Photoshop Elements 5.0
"{A8F7FCEF-3CA6-4CE9-8FEA-8BB18F8686F0}" = Nokia Ovi Suite Software Updater
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.6 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}" = AAVUpdateManager
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B547CB8D-549A-436E-97B5-E79F911B11E2}" = SDP Downloader
"{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}" = Steuer-Spar-Erklärung 2008
"{C373F7C4-05D2-4047-96D1-6AF30661C6AA}" = PC Connectivity Solution
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCD2BAD2-0919-40CB-80CC-E9538B0E4C2E}" = Steuer-Spar-Erklärung 2012
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.16
"{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}" = Steuer-Spar-Erklärung 2010
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F9336255-6BBB-4B38-9F98-E85988BF99CA}" = DDBAC
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0)
"AC3Filter" = AC3Filter (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop Elements 5" = Adobe Photoshop Elements 5.0
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Free YouTube to Mp3 Converter_is1" = Free YouTube to Mp3 Converter version 3.2
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"Nokia Ovi Suite" = Nokia Ovi Suite
"SilverFast CanonSDK-SE" = SilverFast CanonSDK-SE 6.5.5r2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6i
"ZonerPhotoStudio10_GER_is1" = Zoner Photo Studio 10
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 06.05.2012 13:33:41 | Computer Name = Helmut-PC | Source = Avira Antivirus | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion AVEPROC_InitEngine() für die
 Datei  unknown.  [ACCESS_VIOLATION Exception!! EIP = 0x745461bc]  Bitte Avira informieren
 und die obige Datei übersenden!
 
Error - 08.05.2012 11:48:23 | Computer Name = Helmut-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 08.05.2012 11:48:23 | Computer Name = Helmut-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 10.05.2012 15:17:24 | Computer Name = Helmut-PC | Source = Application Hang | ID = 1002
Description = Programm avcenter.exe, Version 12.3.0.15 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: f08  Anfangszeit: 01cd2eda5fda12cc  Zeitpunkt der Beendigung:
 0
 
Error - 12.05.2012 18:16:37 | Computer Name = Helmut-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6000.17037 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: fdc  Anfangszeit: 01cd308b00f1e85b  Zeitpunkt
 der Beendigung: 62
 
Error - 31.05.2012 08:46:38 | Computer Name = Helmut-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6000.17037 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: e04  Anfangszeit: 01cd3f2aea6590db  Zeitpunkt
 der Beendigung: 788
 
Error - 11.06.2012 14:29:47 | Computer Name = Helmut-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6000.17037 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: e90  Anfangszeit: 01cd47fe891aa8f9  Zeitpunkt
 der Beendigung: 137
 
Error - 11.06.2012 14:40:41 | Computer Name = Helmut-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6000.17037 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 11f0  Anfangszeit: 01cd4800bccfe509  Zeitpunkt
 der Beendigung: 91
 
Error - 18.06.2012 10:03:10 | Computer Name = Helmut-PC | Source = EventSystem | ID = 4609
Description =
 
Error - 18.06.2012 14:12:54 | Computer Name = Helmut-PC | Source = Application Hang | ID = 1002
Description = Programm Explorer.EXE, Version 6.0.6000.16771 arbeitet nicht mehr
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen
über das Problem zu suchen.  Prozess-ID: 4b0  Anfangszeit: 01cd4d7b60505413  Zeitpunkt
 der Beendigung: 0
 
[ System Events ]
Error - 18.06.2012 10:03:45 | Computer Name = Helmut-PC | Source = DCOM | ID = 10005
Description =
 
Error - 18.06.2012 10:03:46 | Computer Name = Helmut-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 18.06.2012 12:28:33 | Computer Name = Helmut-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 18.06.2012 12:28:33 | Computer Name = Helmut-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 3, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 18.06.2012 12:28:41 | Computer Name = Helmut-PC | Source = Microsoft-Windows-Kernel-WHEA | ID = 6
Description =
 
Error - 18.06.2012 12:32:23 | Computer Name = Helmut-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 18.06.2012 12:32:23 | Computer Name = Helmut-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 3, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 18.06.2012 12:32:32 | Computer Name = Helmut-PC | Source = Microsoft-Windows-Kernel-WHEA | ID = 6
Description =
 
Error - 18.06.2012 13:53:36 | Computer Name = Helmut-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 2, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 18.06.2012 13:53:36 | Computer Name = Helmut-PC | Source = ACPI | ID = 327686
Description = IRQARB: ACPI-BIOS enthält keinen IRQ für das Gerät im PCI-Steckplatz
 3, Funktion 0.  Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
 
< End of report >
--- --- ---

Edit:
Gmer.txt ist:
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-18 21:33:14
Windows 6.0.6000  Harddisk0\DR0 -> \Device\00000047 WDC_WD16 rev.05.0
Running: vnwfey1h.exe; Driver: C:\Users\Helmut\AppData\Local\Temp\pwlyrpoc.sys


---- System - GMER 1.0.15 ----

SSDT  89FAFCE4                                                                                                        ZwClose
SSDT  89FAFCEE                                                                                                        ZwCreateSection
SSDT  89FAFCDF                                                                                                        ZwDuplicateObject
SSDT  89FAFC80                                                                                                        ZwOpenProcess
SSDT  89FAFC85                                                                                                        ZwOpenThread
SSDT  89FAFCF8                                                                                                        ZwRequestWaitReplyPort
SSDT  89FAFCF3                                                                                                        ZwSetContextThread
SSDT  89FAFCFD                                                                                                        ZwSetSecurityObject
SSDT  89FAFD02                                                                                                        ZwSystemDebugControl
SSDT  89FAFC8F                                                                                                        ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text  ntkrnlpa.exe!ZwCallbackReturn + 368                                                                              81C80874 4 Bytes  [E4, FC, FA, 89]
.text  ntkrnlpa.exe!ZwCallbackReturn + 3D4                                                                              81C808E0 4 Bytes  [EE, FC, FA, 89]
.text  ntkrnlpa.exe!ZwCallbackReturn + 73C                                                                              81C80C48 4 Bytes  [F3, FC, FA, 89]
?      System32\drivers\rexocp.sys                                                                                      Das System kann den angegebenen Pfad nicht finden. !
.text  C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                                        section is writeable [0x895C8340, 0x28B977, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!DialogBoxIndirectParamW                        75F314EA 5 Bytes  JMP 6FB32046 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!MessageBoxExA                                  75F4570D 5 Bytes  JMP 6FB31F8D C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!DialogBoxParamA                                75F465BF 5 Bytes  JMP 6FB3200B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!MessageBoxIndirectW                            75F4F1B3 5 Bytes  JMP 6F9E17EA C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!DialogBoxParamW                                75F5129F 5 Bytes  JMP 6F9BF4B9 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!DialogBoxIndirectParamA                        75F729C9 5 Bytes  JMP 6FB32081 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!MessageBoxIndirectA                            75F7FACF 5 Bytes  JMP 6FB31FC7 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] USER32.dll!MessageBoxExW                                  75F7FBC9 5 Bytes  JMP 6FB31F53 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text  C:\Program Files\Internet Explorer\iexplore.exe[3872] ole32.dll!OleLoadFromStream                                764908B2 5 Bytes  JMP 6FB32243 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT    C:\Windows\system32\SearchProtocolHost.exe[2652] @ C:\Windows\system32\ole32.dll [USER32.dll!DialogBoxParamW]    [6928D6EF] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT    C:\Windows\system32\SearchProtocolHost.exe[2652] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!DialogBoxParamW]  [6928D6EF] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT    C:\Windows\system32\SearchProtocolHost.exe[2652] @ C:\Windows\system32\SHELL32.dll [USER32.dll!DialogBoxParamW]  [6928D6EF] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT    C:\Windows\system32\SearchProtocolHost.exe[2652] @ C:\Windows\system32\WININET.dll [USER32.dll!DialogBoxParamW]  [6928D6EF] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                            [747BFBC8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                        [7478B9AA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                  [7477A31F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                    [7477CBFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                          [74778AB2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]                [7478CF28] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                        [74777D98] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                          [74777CFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                          [74776A64] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]                  [7480C1D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                      [74797F56] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                        [747790CD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                  [74782179] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                  [747821A4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                            [74787F1C] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                            [74787D3E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[6116] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]              [747B83D5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Files - GMER 1.0.15 ----

File  C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS01570.log                                          131072 bytes

---- EOF - GMER 1.0.15 ----
--- --- ---

cosinus 20.06.2012 15:53
Ohne die Logs von Malwarebytes und Co wird das hier nichts. :glaskugel:
Alles von Malwarebytes (und evtl. anderen Scannern) muss hier gepostet werden.

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

012 055-0 21.06.2012 19:02
die Malewarebyte Logs
 
Hallo,

war auf Dienstreise und bin erst jetzt wieder am heimischen PC;
anbei die MWB Logs

Gruß
Helmut ( + DANKE)

Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.18.06

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.17037
Helmut :: HELMUT-PC [Administrator]

Schutz: Aktiviert

18.06.2012 18:50:12
mbam-log-2012-06-18 (18-50-12).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 343423
Laufzeit: 59 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Helmut\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UBA9DM7H\about[1].exe (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Helmut\AppData\Local\Temp\wpbt0.dll (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

cosinus 21.06.2012 19:46
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

012 055-0 21.06.2012 19:59
Nein, der einzige und erste war das...
 
Hallo,

das war der einzige Suchlauf mit MWB.
DANKE!

cosinus 21.06.2012 20:02
Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
  • Dein Anti-Virus-Programm während des Scans deaktivieren.

    Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
    • Firefox-User:
      Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
    • IE-User:
      müssen das Installieren eines ActiveX Elements erlauben.
  • Setze den einen Haken bei Yes, i accept the Terms of Use.
  • Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
  • Warte bis die Komponenten herunter geladen wurden.
  • Setze einen Haken bei "Scan archives".
  • Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
  • http://img707.imageshack.us/img707/687/starteg.jpg drücken.
  • Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.
Wenn der Scan beendet wurde
  • Klicke Finish.
  • Browser schließen.
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.
Code:
"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"
Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:
"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"
Poste nun den Inhalt der log.txt.

012 055-0 21.06.2012 21:21
hat ESET sich aufgehängt?
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo,

ESET blieb beim ersten Suchlauf über 12 Minuten andieser Stelle stehen.
Habe dann abgebrochen und alles neu gemacht, nun steht er, nachdem er schnell wieder dort war (hat sich wohl die Stelle gemerkt), wieder dort seit vielen Minuten.
Ist das OK?

DANKE * Grüße
Helmut

Edit: Nach 37 Minuten steht das Programm noch genauso da...
Edit: Nach 46 läuft es jetzt weiter, puuuhhhh...!

012 055-0 21.06.2012 23:47
ESET Ergebnis
 
Hallo,
so, nach langem Suchlauf kann ich dieses posten:

Gruß
Helmut
Code:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9e4b38b85bc67e438388b837c10c09f6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-21 10:37:10
# local_time=2012-06-22 12:37:10 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=1792 16777191 100 0 7366685 7366685 0 0
# compatibility_mode=5892 16776638 100 100 49630929 177841995 0 0
# compatibility_mode=8192 67108863 100 0 1442 1442 0 0
# scanned=130359
# found=4
# cleaned=0
# scan_time=9008
C:\Users\Helmut\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\00EQE2QI\99[1].htm        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\Helmut\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEJU0BCM\19[1].htm        HTML/Iframe.B.Gen virus (unable to clean)        00000000000000000000000000000000        I
C:\Users\Helmut\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEJU0BCM\77f67[1].pdf        JS/Exploit.Pdfka.PMD trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\Helmut\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\621842de-7c2e4632        Java/Exploit.CVE-2012-0507.BP trojan (unable to clean)        00000000000000000000000000000000        I

cosinus 22.06.2012 10:12
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

012 055-0 22.06.2012 11:49
Hallo,

ist mir erst heute morgen aufgefallen:
Habe ja noch den Bericht von AntiVir, s. u.

Zur Frage:
Bis auf den Hinweis, dass die Run.dll nicht gefunden wird, sieht alles normal aus und was ich getetstet habe, läuft auch.

Dabke + Grüße
Helmut

Code:

Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 18. Juni 2012  14:00

Es wird nach 3847348 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows Vista (TM) Home Basic
Windowsversion : (plain)  [6.0.6000]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : HELMUT-PC

Versionsinformationen:
BUILD.DAT      : 12.0.0.1125    41829 Bytes  02.05.2012 16:34:00
AVSCAN.EXE    : 12.3.0.15    466896 Bytes  08.05.2012 15:45:46
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  08.05.2012 15:45:46
LUKE.DLL      : 12.3.0.15      68304 Bytes  08.05.2012 15:45:47
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  08.05.2012 15:45:47
AVREG.DLL      : 12.3.0.17    232200 Bytes  10.05.2012 18:23:47
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 09:49:21
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 06:56:15
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 06:56:21
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 13:53:58
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 13:55:40
VBASE005.VDF  : 7.11.29.136  2166272 Bytes  10.05.2012 18:23:45
VBASE006.VDF  : 7.11.29.137    2048 Bytes  10.05.2012 18:23:45
VBASE007.VDF  : 7.11.29.138    2048 Bytes  10.05.2012 18:23:46
VBASE008.VDF  : 7.11.29.139    2048 Bytes  10.05.2012 18:23:46
VBASE009.VDF  : 7.11.29.140    2048 Bytes  10.05.2012 18:23:46
VBASE010.VDF  : 7.11.29.141    2048 Bytes  10.05.2012 18:23:46
VBASE011.VDF  : 7.11.29.142    2048 Bytes  10.05.2012 18:23:46
VBASE012.VDF  : 7.11.29.143    2048 Bytes  10.05.2012 18:23:46
VBASE013.VDF  : 7.11.29.144    2048 Bytes  10.05.2012 18:23:46
VBASE014.VDF  : 7.11.30.3    198144 Bytes  14.05.2012 20:04:22
VBASE015.VDF  : 7.11.30.69    186368 Bytes  17.05.2012 20:48:22
VBASE016.VDF  : 7.11.30.143  223744 Bytes  21.05.2012 18:21:30
VBASE017.VDF  : 7.11.30.207  287744 Bytes  23.05.2012 21:06:23
VBASE018.VDF  : 7.11.31.57    188416 Bytes  28.05.2012 21:06:24
VBASE019.VDF  : 7.11.31.111  214528 Bytes  30.05.2012 12:44:46
VBASE020.VDF  : 7.11.31.151  116736 Bytes  31.05.2012 18:23:16
VBASE021.VDF  : 7.11.31.205  134144 Bytes  03.06.2012 13:06:43
VBASE022.VDF  : 7.11.32.9    169472 Bytes  05.06.2012 20:14:15
VBASE023.VDF  : 7.11.32.85    155648 Bytes  08.06.2012 18:17:37
VBASE024.VDF  : 7.11.32.133  127488 Bytes  11.06.2012 20:59:45
VBASE025.VDF  : 7.11.32.171  182784 Bytes  12.06.2012 20:59:45
VBASE026.VDF  : 7.11.32.251  119296 Bytes  14.06.2012 18:56:47
VBASE027.VDF  : 7.11.32.252    2048 Bytes  14.06.2012 18:56:47
VBASE028.VDF  : 7.11.32.253    2048 Bytes  14.06.2012 18:56:47
VBASE029.VDF  : 7.11.32.254    2048 Bytes  14.06.2012 18:56:48
VBASE030.VDF  : 7.11.32.255    2048 Bytes  14.06.2012 18:56:48
VBASE031.VDF  : 7.11.33.68    143872 Bytes  18.06.2012 11:26:10
Engineversion  : 8.2.10.92
AEVDF.DLL      : 8.1.2.8      106867 Bytes  01.06.2012 18:23:24
AESCRIPT.DLL  : 8.1.4.26      450939 Bytes  15.06.2012 18:56:57
AESCN.DLL      : 8.1.8.2      131444 Bytes  28.03.2012 13:57:01
AESBX.DLL      : 8.2.5.12      606578 Bytes  15.06.2012 18:56:58
AERDL.DLL      : 8.1.9.15      639348 Bytes  31.01.2012 06:55:37
AEPACK.DLL    : 8.2.16.18    807287 Bytes  15.06.2012 18:56:57
AEOFFICE.DLL  : 8.1.2.36      201082 Bytes  15.06.2012 18:56:56
AEHEUR.DLL    : 8.1.4.46    4923767 Bytes  15.06.2012 18:56:55
AEHELP.DLL    : 8.1.21.0      254326 Bytes  12.05.2012 22:06:36
AEGEN.DLL      : 8.1.5.30      422261 Bytes  15.06.2012 18:56:48
AEEXP.DLL      : 8.1.0.52      82293 Bytes  15.06.2012 18:56:58
AEEMU.DLL      : 8.1.3.0      393589 Bytes  31.01.2012 06:55:34
AECORE.DLL    : 8.1.25.10    201080 Bytes  01.06.2012 18:23:18
AEBB.DLL      : 8.1.1.0        53618 Bytes  31.01.2012 06:55:33
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  08.05.2012 15:45:46
AVPREF.DLL    : 12.3.0.15      51920 Bytes  08.05.2012 15:45:46
AVREP.DLL      : 12.3.0.15    179208 Bytes  08.05.2012 15:45:47
AVARKT.DLL    : 12.3.0.15    211408 Bytes  08.05.2012 15:45:46
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  08.05.2012 15:45:46
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  08.05.2012 15:45:47
AVSMTP.DLL    : 12.3.0.15      63440 Bytes  08.05.2012 15:45:46
NETNT.DLL      : 12.3.0.15      17104 Bytes  08.05.2012 15:45:47
RCIMAGE.DLL    : 12.3.0.15    4447952 Bytes  08.05.2012 15:45:46
RCTEXT.DLL    : 12.3.0.15      98512 Bytes  08.05.2012 15:45:46

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Montag, 18. Juni 2012  14:00

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'wmiprvse.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'WrtProc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'NokiaMServer.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'apdproxy.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'WrtMon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'OpWareSE4.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'ToADiMon.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'aavus.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '148' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Program Files\AC3Filter\uninstall.exe
  [WARNUNG]  Unerwartetes Dateiende erreicht
Die Registry wurde durchsucht ( '6050' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <System>
C:\Program Files\AC3Filter\uninstall.exe
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Program Files\Nokia\Nokia Ovi Suite\Help\webhelp.jar
  [WARNUNG]  Einige Dateien dieses Archives sind auf mehrere Teilarchive verteilt  (multiple volume)
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Resources.zip
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\al1326.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\al1376.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\al1380.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\AppIni.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\AppRgn.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Backgrounds.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Calendars.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\CollageLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Effects.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Hardcover.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Leinencover.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Navigation.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Overview.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBFonts.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Photobooks.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Photobooks_DS.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PhotoFun.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Products.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik1.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik2.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik3.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik4.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik5.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik6.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Softcover.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Texts.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\tl1326.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\tl1376.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\tl1380.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\WizFinish.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\WizIntro.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Xchg.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4H\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4H\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4H\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4S\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4S\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4S\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA6\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA6\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA6\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21H\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21H\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21H\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21S\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21S\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21S\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Users\Helmut\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\432b18f8-6ba89a93
  [0] Archivtyp: ZIP
  --> Accord.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.AQ
  --> Atomic.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/12-0507.CF.1.A
  --> Fai.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.AR
  --> Poma.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/12-0507.BL.2
  --> Rami.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/12-0507.BR.1
  --> Taoa.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/12-0507.BJ.2.B
  --> Third.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/10-0840.CH.1

Beginne mit der Desinfektion:
C:\Users\Helmut\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\432b18f8-6ba89a93
  [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.AQ
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5549819d.qua' verschoben!


Ende des Suchlaufs: Montag, 18. Juni 2012  15:26
Benötigte Zeit:  1:25:06 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  15857 Verzeichnisse wurden überprüft
 419276 Dateien wurden geprüft
      8 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 419268 Dateien ohne Befall
  2975 Archive wurden durchsucht
    67 Warnungen
      1 Hinweise
 377438 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

cosinus 22.06.2012 12:40
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

012 055-0 22.06.2012 20:55
jetzt wird es merkwürdig
 
Hallo,

habe während des Fussballspiels noch mal AntiVir laufen lassen, siehe da, mit Erfolg:

Grüße
Helmut

Edit: Sehe gerade, dass es eine neue Anweisung gibt. Im langen Antwortstamm finde ich die gar nicht - oder übersehen? Gilt die Anweisung noch trotz neuem Antivir Suchlauf?

Code:
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Freitag, 22. Juni 2012  20:25

Es wird nach 3859003 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows Vista (TM) Home Basic
Windowsversion : (plain)  [6.0.6000]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : HELMUT-PC

Versionsinformationen:
BUILD.DAT      : 12.0.0.1125    41829 Bytes  02.05.2012 16:34:00
AVSCAN.EXE    : 12.3.0.15    466896 Bytes  08.05.2012 15:45:46
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  08.05.2012 15:45:46
LUKE.DLL      : 12.3.0.15      68304 Bytes  08.05.2012 15:45:47
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  08.05.2012 15:45:47
AVREG.DLL      : 12.3.0.17    232200 Bytes  10.05.2012 18:23:47
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 09:49:21
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 06:56:15
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 06:56:21
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 13:53:58
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 13:55:40
VBASE005.VDF  : 7.11.29.136  2166272 Bytes  10.05.2012 18:23:45
VBASE006.VDF  : 7.11.29.137    2048 Bytes  10.05.2012 18:23:45
VBASE007.VDF  : 7.11.29.138    2048 Bytes  10.05.2012 18:23:46
VBASE008.VDF  : 7.11.29.139    2048 Bytes  10.05.2012 18:23:46
VBASE009.VDF  : 7.11.29.140    2048 Bytes  10.05.2012 18:23:46
VBASE010.VDF  : 7.11.29.141    2048 Bytes  10.05.2012 18:23:46
VBASE011.VDF  : 7.11.29.142    2048 Bytes  10.05.2012 18:23:46
VBASE012.VDF  : 7.11.29.143    2048 Bytes  10.05.2012 18:23:46
VBASE013.VDF  : 7.11.29.144    2048 Bytes  10.05.2012 18:23:46
VBASE014.VDF  : 7.11.30.3    198144 Bytes  14.05.2012 20:04:22
VBASE015.VDF  : 7.11.30.69    186368 Bytes  17.05.2012 20:48:22
VBASE016.VDF  : 7.11.30.143  223744 Bytes  21.05.2012 18:21:30
VBASE017.VDF  : 7.11.30.207  287744 Bytes  23.05.2012 21:06:23
VBASE018.VDF  : 7.11.31.57    188416 Bytes  28.05.2012 21:06:24
VBASE019.VDF  : 7.11.31.111  214528 Bytes  30.05.2012 12:44:46
VBASE020.VDF  : 7.11.31.151  116736 Bytes  31.05.2012 18:23:16
VBASE021.VDF  : 7.11.31.205  134144 Bytes  03.06.2012 13:06:43
VBASE022.VDF  : 7.11.32.9    169472 Bytes  05.06.2012 20:14:15
VBASE023.VDF  : 7.11.32.85    155648 Bytes  08.06.2012 18:17:37
VBASE024.VDF  : 7.11.32.133  127488 Bytes  11.06.2012 20:59:45
VBASE025.VDF  : 7.11.32.171  182784 Bytes  12.06.2012 20:59:45
VBASE026.VDF  : 7.11.32.251  119296 Bytes  14.06.2012 18:56:47
VBASE027.VDF  : 7.11.33.83    159232 Bytes  18.06.2012 18:16:35
VBASE028.VDF  : 7.11.33.84      2048 Bytes  18.06.2012 18:16:35
VBASE029.VDF  : 7.11.33.85      2048 Bytes  18.06.2012 18:16:35
VBASE030.VDF  : 7.11.33.86      2048 Bytes  18.06.2012 18:16:35
VBASE031.VDF  : 7.11.33.174  162816 Bytes  21.06.2012 19:42:24
Engineversion  : 8.2.10.96
AEVDF.DLL      : 8.1.2.8      106867 Bytes  01.06.2012 18:23:24
AESCRIPT.DLL  : 8.1.4.28      455035 Bytes  21.06.2012 19:42:33
AESCN.DLL      : 8.1.8.2      131444 Bytes  28.03.2012 13:57:01
AESBX.DLL      : 8.2.5.12      606578 Bytes  15.06.2012 18:56:58
AERDL.DLL      : 8.1.9.15      639348 Bytes  31.01.2012 06:55:37
AEPACK.DLL    : 8.2.16.22    807288 Bytes  21.06.2012 19:42:33
AEOFFICE.DLL  : 8.1.2.38      201083 Bytes  21.06.2012 19:42:32
AEHEUR.DLL    : 8.1.4.52    4923767 Bytes  21.06.2012 19:42:29
AEHELP.DLL    : 8.1.21.0      254326 Bytes  12.05.2012 22:06:36
AEGEN.DLL      : 8.1.5.30      422261 Bytes  15.06.2012 18:56:48
AEEXP.DLL      : 8.1.0.54      82293 Bytes  21.06.2012 19:42:33
AEEMU.DLL      : 8.1.3.0      393589 Bytes  31.01.2012 06:55:34
AECORE.DLL    : 8.1.25.10    201080 Bytes  01.06.2012 18:23:18
AEBB.DLL      : 8.1.1.0        53618 Bytes  31.01.2012 06:55:33
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  08.05.2012 15:45:46
AVPREF.DLL    : 12.3.0.15      51920 Bytes  08.05.2012 15:45:46
AVREP.DLL      : 12.3.0.15    179208 Bytes  08.05.2012 15:45:47
AVARKT.DLL    : 12.3.0.15    211408 Bytes  08.05.2012 15:45:46
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  08.05.2012 15:45:46
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  08.05.2012 15:45:47
AVSMTP.DLL    : 12.3.0.15      63440 Bytes  08.05.2012 15:45:46
NETNT.DLL      : 12.3.0.15      17104 Bytes  08.05.2012 15:45:47
RCIMAGE.DLL    : 12.3.0.15    4447952 Bytes  08.05.2012 15:45:46
RCTEXT.DLL    : 12.3.0.15      98512 Bytes  08.05.2012 15:45:46

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Freitag, 22. Juni 2012  20:25

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'TrustedInstaller.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclMSBTSrv.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'NclUSBSrv.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'ServiceLayer.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'WrtProc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'NokiaOviSuite.exe' - '193' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleToolbarNotifier.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'NokiaMServer.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'apdproxy.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'WrtMon.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'OpWareSE4.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'ToADiMon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'PhotoshopElementsFileAgent.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'aavus.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '152' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\Program Files\AC3Filter\uninstall.exe
  [WARNUNG]  Unerwartetes Dateiende erreicht
Die Registry wurde durchsucht ( '6182' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <System>
C:\Program Files\AC3Filter\uninstall.exe
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Program Files\Nokia\Nokia Ovi Suite\Help\webhelp.jar
  [WARNUNG]  Einige Dateien dieses Archives sind auf mehrere Teilarchive verteilt  (multiple volume)
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Resources.zip
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\al1326.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\al1376.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\al1380.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\AppIni.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\AppRgn.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Backgrounds.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Calendars.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\CollageLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Effects.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Hardcover.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Leinencover.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Navigation.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Overview.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBFonts.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Photobooks.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Photobooks_DS.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PhotoFun.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Products.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik1.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik2.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik3.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik4.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik5.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Rubrik6.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Softcover.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Texts.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\tl1326.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\tl1376.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\tl1380.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\WizFinish.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\WizIntro.xnf
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\Xchg.dat
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4H\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4H\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4H\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4S\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4S\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA4S\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA5\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA6\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA6\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBA6\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBooklet\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\CoverBkgnds.pbc
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21H\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21H\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21H\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21S\CoverLayouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21S\Default.pbd
  [WARNUNG]  Der Archivheader ist defekt
C:\Program Files\T-Online\T-Online_Software_6\Fotoservice\Data\PBSqr21S\Layouts.pbl
  [WARNUNG]  Der Archivheader ist defekt
C:\Users\Helmut\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEJU0BCM\77f67[1].pdf
  [0] Archivtyp: PDF
  --> pdf_form_2.avp
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/Pidief.def
C:\Users\Helmut\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\621842de-7c2e4632
  [0] Archivtyp: ZIP
  --> r_ea/r_ec.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2012-0507.AW.3
  --> r_ea/r_ea.class
      [FUND]      Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Lamar.AA
  --> r_ea/r_eb.class
      [FUND]      Enthält Erkennungsmuster des Exploits EXP/2008-5353.AK.3

Beginne mit der Desinfektion:
C:\Users\Helmut\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\621842de-7c2e4632
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/2008-5353.AK.3
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54076f7c.qua' verschoben!
C:\Users\Helmut\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEJU0BCM\77f67[1].pdf
  [FUND]      Enthält Erkennungsmuster des Exploits EXP/Pidief.def
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ccf40e1.qua' verschoben!


Ende des Suchlaufs: Freitag, 22. Juni 2012  21:52
Benötigte Zeit:  1:23:36 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  15915 Verzeichnisse wurden überprüft
 421389 Dateien wurden geprüft
      4 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      2 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 421385 Dateien ohne Befall
  3021 Archive wurden durchsucht
    67 Warnungen
      2 Hinweise
 408630 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden

012 055-0 23.06.2012 21:14
Hallo,

wie im anderen Teil des Baumes, warum der gesplittet ist, weiß ich nicht, angeforderte neue Lauf von OTL.

Grüße und DANKE!
Helmut

OTL Logfile:
Code:
OTL logfile created on: 23.06.2012 21:43:28 - Run 2
OTL by OldTimer - Version 3.2.49.0    Folder = C:\Users\Helmut\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
958,06 Mb Total Physical Memory | 218,23 Mb Available Physical Memory | 22,78% Memory free
2,12 Gb Paging File | 1,23 Gb Available in Paging File | 57,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 147,04 Gb Total Space | 68,04 Gb Free Space | 46,28% Space Free | Partition Type: NTFS
 
Computer Name: HELMUT-PC | User Name: Helmut | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.18 20:16:23 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
PRC - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 17:45:46 | 000,613,328 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\update.exe
PRC - [2012.05.08 17:45:46 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 17:45:46 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.08 17:45:46 | 000,047,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\updrgui.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.09.01 14:39:54 | 000,966,712 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
PRC - [2011.06.16 14:09:48 | 000,135,168 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe
PRC - [2011.06.14 17:42:26 | 001,540,096 | ---- | M] (Nokia) -- C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe
PRC - [2011.06.08 14:49:48 | 000,159,744 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe
PRC - [2010.03.09 18:56:18 | 000,634,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
PRC - [2008.03.28 15:39:26 | 000,171,448 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
PRC - [2007.02.15 11:04:56 | 000,282,624 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
PRC - [2007.02.04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Programme\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
PRC - [2006.12.22 07:29:56 | 000,067,752 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Elements 5.0\apdproxy.exe
PRC - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2006.11.02 14:34:59 | 000,201,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.01 14:38:32 | 000,931,896 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Maps Service API.dll
MOD - [2011.09.01 14:37:50 | 010,837,504 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtWebKit4.dll
MOD - [2011.09.01 14:37:50 | 000,913,920 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtNetwork4.dll
MOD - [2011.09.01 14:37:50 | 000,416,256 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\sqldrivers\qsqlite4.dll
MOD - [2011.09.01 14:37:50 | 000,196,608 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qjpeg4.dll
MOD - [2011.09.01 14:37:50 | 000,026,624 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qgif4.dll
MOD - [2011.09.01 14:37:48 | 008,166,912 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtGui4.dll
MOD - [2011.09.01 14:37:48 | 002,551,296 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXmlPatterns4.dll
MOD - [2011.09.01 14:37:48 | 002,282,496 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtCore4.dll
MOD - [2011.09.01 14:37:48 | 002,246,656 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtDeclarative4.dll
MOD - [2011.09.01 14:37:48 | 001,288,192 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtScript4.dll
MOD - [2011.09.01 14:37:48 | 000,676,864 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtOpenGL4.dll
MOD - [2011.09.01 14:37:48 | 000,340,480 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXml4.dll
MOD - [2011.09.01 14:37:48 | 000,266,752 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\phonon4.dll
MOD - [2011.09.01 14:37:48 | 000,190,464 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtSql4.dll
MOD - [2011.09.01 14:08:58 | 000,508,416 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtMultimediaKit1.dll
MOD - [2011.09.01 14:08:56 | 000,109,568 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\mediaservice\dsengine.dll
MOD - [2011.09.01 14:08:18 | 000,378,880 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtCore.dll
MOD - [2011.09.01 14:08:18 | 000,159,232 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtWeb.dll
MOD - [2011.09.01 14:08:16 | 000,089,088 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\qjson.dll
MOD - [2011.09.01 14:08:14 | 000,392,080 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\ssoengine.dll
MOD - [2011.09.01 14:08:14 | 000,387,976 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\OviShareLib.dll
MOD - [2011.09.01 14:08:14 | 000,058,768 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\securestorage.dll
MOD - [2011.09.01 14:07:04 | 000,727,552 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\CommonUpdateChecker.dll
MOD - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
MOD - [2005.07.20 11:48:10 | 000,059,904 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\zlib1.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
SRV - [2008.01.02 23:31:09 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0)
SRV - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.05.08 17:45:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 17:45:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.05.18 10:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011.05.18 10:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011.05.18 10:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011.05.18 10:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007.05.09 17:33:00 | 000,048,640 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006.10.14 05:04:33 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.10.09 15:03:56 | 000,017,152 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX)
DRV - [2006.10.09 14:46:44 | 000,017,536 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.drehscheibe-online.de/
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.09.08 20:25:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.09.08 20:25:51 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O3 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\.DEFAULT..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-18..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-19..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: []  File not found
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [BrowserChoice] C:\Windows\System32\browserchoice.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: drehscheibe-online.de ([www] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: olb.de ([www] * in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: privatbahnforum.de ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} https://www.olb.de/olb_fb3_1867b/plugin/AXFOAM.CAB (B+S Banksysteme AG DDBAC Plug-In)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E45CACCA-FE12-4220-A739-E4ECD74A176F}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\System32\explorer.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.21 21:43:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.18 20:16:20 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.18 18:48:48 | 000,000,000 | ---D | C] -- C:\Users\Helmut\AppData\Roaming\Malwarebytes
[2012.06.18 18:48:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.18 18:48:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.18 18:48:38 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.18 18:48:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.18 14:52:54 | 000,000,000 | ---D | C] -- C:\T-Online
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.23 21:36:33 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.23 21:36:33 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.23 21:36:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.23 21:36:18 | 1005,244,416 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.22 12:44:29 | 000,002,609 | ---- | M] () -- C:\Users\Helmut\Desktop\Microsoft Office Word 2003.lnk
[2012.06.21 22:12:32 | 000,002,517 | ---- | M] () -- C:\Users\Helmut\Desktop\Microsoft Office Picture Manager.lnk
[2012.06.18 20:44:51 | 000,302,592 | ---- | M] () -- C:\Users\Helmut\Desktop\vnwfey1h.exe
[2012.06.18 20:16:23 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.18 20:14:08 | 000,000,000 | ---- | M] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 18:48:40 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:31:47 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.06.18 16:06:54 | 000,000,000 | ---- | M] () -- C:\Windows\System32\explorer.exe
[2012.06.18 15:42:51 | 000,651,112 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.18 15:42:51 | 000,618,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.18 15:42:51 | 000,120,908 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.18 15:42:51 | 000,107,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.18 15:30:07 | 000,000,680 | ---- | M] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
 
========== Files Created - No Company Name ==========
 
[2012.06.18 20:44:50 | 000,302,592 | ---- | C] () -- C:\Users\Helmut\Desktop\vnwfey1h.exe
[2012.06.18 20:14:08 | 000,000,000 | ---- | C] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 18:48:40 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:28:44 | 1005,244,416 | -HS- | C] () -- C:\hiberfil.sys
[2012.06.18 16:04:08 | 000,000,000 | ---- | C] () -- C:\Windows\System32\explorer.exe
[2012.06.18 13:43:00 | 000,000,680 | ---- | C] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.06.18 13:39:08 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2010.10.01 20:01:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== LOP Check ==========
 
[2009.05.28 22:08:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Canon
[2008.01.01 20:43:47 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\DataDesign
[2009.11.29 15:23:21 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\gtk-2.0
[2009.07.12 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Lasersoft Imaging
[2009.08.25 22:20:31 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\NewSoft
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia Ovi Suite
[2009.05.28 21:38:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Opera
[2011.10.15 22:25:53 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Packnet
[2011.09.08 21:55:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\PC Suite
[2009.05.28 19:37:02 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ScanSoft
[2008.01.01 19:52:30 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\T-Online
[2009.01.11 21:48:09 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Vso
[2009.05.11 19:50:41 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Zoner
[2008.01.01 19:12:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\DataDesign
[2007.12.29 18:32:34 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\PeerNetworking
[2008.01.01 19:12:40 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\T-Online
[2011.06.12 02:24:46 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\DataDesign
[2009.07.29 11:03:30 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\NewSoft
[2012.06.11 23:32:15 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\PC Suite
[2009.07.29 11:02:46 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\T-Online
[2012.06.23 21:35:39 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.07.01 15:24:06 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Adobe
[2009.05.28 20:27:46 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ArcSoft
[2012.03.31 20:10:50 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Avira
[2009.01.11 18:10:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\AVS4YOU
[2009.05.28 22:08:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Canon
[2008.01.01 20:43:47 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\DataDesign
[2008.01.01 20:21:39 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Google
[2009.11.29 15:23:21 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\gtk-2.0
[2008.01.01 18:50:37 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Identities
[2009.07.12 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Lasersoft Imaging
[2008.01.01 20:02:36 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Macromedia
[2012.06.18 18:48:48 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Malwarebytes
[2011.01.09 00:11:50 | 000,000,000 | --SD | M] -- C:\Users\Helmut\AppData\Roaming\Microsoft
[2009.08.25 22:20:31 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\NewSoft
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia Ovi Suite
[2009.05.28 21:38:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Opera
[2011.10.15 22:25:53 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Packnet
[2011.09.08 21:55:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\PC Suite
[2009.05.28 19:37:02 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ScanSoft
[2010.10.15 15:39:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Skype
[2010.10.15 15:38:52 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\skypePM
[2008.01.01 19:52:30 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\T-Online
[2008.07.29 17:29:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\vlc
[2009.01.11 21:48:09 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Vso
[2009.05.11 19:50:41 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Zoner
 
< %APPDATA%\*.exe /s >
[2009.01.04 18:54:39 | 000,087,608 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\ezpinst.exe
[2009.01.11 21:48:08 | 000,087,608 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\inst.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007.05.30 18:21:58 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys
[2007.05.30 18:21:58 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\drivers\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys
[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2006.12.22 21:07:10 | 000,093,696 | ---- | M] (NVIDIA Corporation) MD5=5FBF62A83B551F757112B4A0C27432EC -- C:\Fujitsu Siemens Computers\Driver Pool\3\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.02 23:12:59 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2008.01.02 23:12:58 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.02 23:12:58 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

cosinus 24.06.2012 16:39
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

012 055-0 24.06.2012 19:32
Hallo,

vielen Dank für die Hilfe am Sonntag!!!
Anbei die gewünschten Daten:

Grüße Helmut

Code:
20:24:54.0524 2568        TDSS rootkit removing tool 2.7.41.0 Jun 20 2012 20:53:32
20:24:54.0842 2568        ============================================================
20:24:54.0842 2568        Current date / time: 2012/06/24 20:24:54.0842
20:24:54.0842 2568        SystemInfo:
20:24:54.0842 2568       
20:24:54.0842 2568        OS Version: 6.0.6000 ServicePack: 0.0
20:24:54.0842 2568        Product type: Workstation
20:24:54.0842 2568        ComputerName: HELMUT-PC
20:24:54.0843 2568        UserName: Helmut
20:24:54.0843 2568        Windows directory: C:\Windows
20:24:54.0843 2568        System windows directory: C:\Windows
20:24:54.0843 2568        Processor architecture: Intel x86
20:24:54.0843 2568        Number of processors: 1
20:24:54.0843 2568        Page size: 0x1000
20:24:54.0843 2568        Boot type: Normal boot
20:24:54.0843 2568        ============================================================
20:24:56.0227 2568        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:24:56.0229 2568        ============================================================
20:24:56.0229 2568        \Device\Harddisk0\DR0:
20:24:56.0229 2568        MBR partitions:
20:24:56.0229 2568        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x4047FC, BlocksNum 0x12614EB4
20:24:56.0229 2568        ============================================================
20:24:56.0256 2568        C: <-> \Device\Harddisk0\DR0\Partition0
20:24:56.0257 2568        ============================================================
20:24:56.0257 2568        Initialize success
20:24:56.0257 2568        ============================================================
20:26:38.0813 3116        ============================================================
20:26:38.0813 3116        Scan started
20:26:38.0813 3116        Mode: Manual; SigCheck; TDLFS;
20:26:38.0813 3116        ============================================================
20:26:40.0605 3116        AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
20:26:40.0804 3116        AAV UpdateService - ok
20:26:40.0984 3116        ACPI            (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys
20:26:41.0023 3116        ACPI - ok
20:26:41.0142 3116        AdobeActiveFileMonitor5.0 (63ab43534cbf5d7f3eb81dfdc8161490) C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
20:26:41.0159 3116        AdobeActiveFileMonitor5.0 - ok
20:26:41.0231 3116        adp94xx        (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
20:26:41.0275 3116        adp94xx - ok
20:26:41.0330 3116        adpahci        (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
20:26:41.0350 3116        adpahci - ok
20:26:41.0376 3116        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
20:26:41.0388 3116        adpu160m - ok
20:26:41.0427 3116        adpu320        (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
20:26:41.0441 3116        adpu320 - ok
20:26:41.0519 3116        AeLookupSvc    (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
20:26:41.0641 3116        AeLookupSvc - ok
20:26:41.0687 3116        AFD            (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys
20:26:41.0774 3116        AFD - ok
20:26:41.0841 3116        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
20:26:41.0852 3116        agp440 - ok
20:26:41.0878 3116        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
20:26:41.0890 3116        aic78xx - ok
20:26:41.0932 3116        ALG            (e69fb0e3112c40fdc0ef7d21a52dc951) C:\Windows\System32\alg.exe
20:26:42.0034 3116        ALG - ok
20:26:42.0082 3116        aliide          (496eda16a127ac9a38bb285bef17dbb5) C:\Windows\system32\drivers\aliide.sys
20:26:42.0093 3116        aliide - ok
20:26:42.0161 3116        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
20:26:42.0172 3116        amdagp - ok
20:26:42.0220 3116        amdide          (6f65f4147c54398d7280b18cebbed215) C:\Windows\system32\drivers\amdide.sys
20:26:42.0230 3116        amdide - ok
20:26:42.0301 3116        AmdK7          (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
20:26:42.0407 3116        AmdK7 - ok
20:26:42.0447 3116        AmdK8          (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\DRIVERS\amdk8.sys
20:26:42.0561 3116        AmdK8 - ok
20:26:42.0695 3116        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:26:42.0716 3116        AntiVirSchedulerService - ok
20:26:42.0767 3116        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:26:42.0777 3116        AntiVirService - ok
20:26:42.0834 3116        Appinfo        (cfa455816879f06f1c4e5bbf9e8aef7d) C:\Windows\System32\appinfo.dll
20:26:42.0916 3116        Appinfo - ok
20:26:42.0943 3116        arc            (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
20:26:42.0954 3116        arc - ok
20:26:43.0029 3116        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
20:26:43.0042 3116        arcsas - ok
20:26:43.0169 3116        AsyncMac        (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys
20:26:43.0283 3116        AsyncMac - ok
20:26:43.0344 3116        atapi          (e03e8c99d15d0381e02743c36afc7c6f) C:\Windows\system32\drivers\atapi.sys
20:26:43.0355 3116        atapi - ok
20:26:43.0391 3116        AudioEndpointBuilder (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll
20:26:43.0454 3116        AudioEndpointBuilder - ok
20:26:43.0466 3116        Audiosrv        (e760fc1bd68f7f6f1b17eb4e8d9480b0) C:\Windows\System32\Audiosrv.dll
20:26:43.0526 3116        Audiosrv - ok
20:26:43.0576 3116        avgntflt        (d5541f0afb767e85fc412fc609d96a74) C:\Windows\system32\DRIVERS\avgntflt.sys
20:26:43.0645 3116        avgntflt - ok
20:26:43.0698 3116        avipbb          (7d967a682d4694df7fa57d63a2db01fe) C:\Windows\system32\DRIVERS\avipbb.sys
20:26:43.0712 3116        avipbb - ok
20:26:43.0761 3116        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys
20:26:43.0771 3116        avkmgr - ok
20:26:43.0835 3116        Beep            (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys
20:26:43.0915 3116        Beep - ok
20:26:44.0009 3116        BFE            (98ebdffb824a7c265337d68dd480e45c) C:\Windows\System32\bfe.dll
20:26:44.0101 3116        BFE - ok
20:26:44.0225 3116        BITS            (da551697e34d2b9943c8b1c8eaffe89a) C:\Windows\System32\qmgr.dll
20:26:44.0360 3116        BITS - ok
20:26:44.0385 3116        blbdrive - ok
20:26:44.0449 3116        bowser          (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys
20:26:44.0586 3116        bowser - ok
20:26:44.0657 3116        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
20:26:44.0722 3116        BrFiltLo - ok
20:26:44.0749 3116        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
20:26:44.0806 3116        BrFiltUp - ok
20:26:44.0856 3116        Browser        (beb6470532b7461d7bb426e3facb424f) C:\Windows\System32\browser.dll
20:26:44.0944 3116        Browser - ok
20:26:44.0974 3116        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
20:26:45.0031 3116        Brserid - ok
20:26:45.0065 3116        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
20:26:45.0124 3116        BrSerWdm - ok
20:26:45.0148 3116        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
20:26:45.0224 3116        BrUsbMdm - ok
20:26:45.0258 3116        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
20:26:45.0334 3116        BrUsbSer - ok
20:26:45.0370 3116        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
20:26:45.0430 3116        BTHMODEM - ok
20:26:45.0458 3116        cdfs            (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys
20:26:45.0541 3116        cdfs - ok
20:26:45.0589 3116        cdrom          (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys
20:26:45.0645 3116        cdrom - ok
20:26:45.0830 3116        CertPropSvc    (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll
20:26:45.0956 3116        CertPropSvc - ok
20:26:46.0003 3116        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
20:26:46.0072 3116        circlass - ok
20:26:46.0134 3116        CLFS            (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys
20:26:46.0155 3116        CLFS - ok
20:26:46.0235 3116        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:26:46.0249 3116        clr_optimization_v2.0.50727_32 - ok
20:26:46.0305 3116        cmdide          (59172a0724f2ab769f31d61b0571d75b) C:\Windows\system32\drivers\cmdide.sys
20:26:46.0315 3116        cmdide - ok
20:26:46.0352 3116        Compbatt        (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys
20:26:46.0362 3116        Compbatt - ok
20:26:46.0376 3116        COMSysApp - ok
20:26:46.0415 3116        crcdisk        (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
20:26:46.0424 3116        crcdisk - ok
20:26:46.0453 3116        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
20:26:46.0536 3116        Crusoe - ok
20:26:46.0601 3116        CryptSvc        (1c26fb097170a2a91066d1e3a24366e3) C:\Windows\system32\cryptsvc.dll
20:26:46.0692 3116        CryptSvc - ok
20:26:46.0809 3116        DcomLaunch      (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll
20:26:46.0912 3116        DcomLaunch - ok
20:26:46.0939 3116        DfsC            (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys
20:26:47.0066 3116        DfsC - ok
20:26:47.0225 3116        DFSR            (e0d584aa76c7d845ba9f3a788260528f) C:\Windows\system32\DFSR.exe
20:26:47.0354 3116        DFSR - ok
20:26:47.0530 3116        Dhcp            (dc45739bc22d528d2b3e50d3f6761750) C:\Windows\System32\dhcpcsvc.dll
20:26:47.0589 3116        Dhcp - ok
20:26:47.0677 3116        disk            (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys
20:26:47.0696 3116        disk - ok
20:26:47.0748 3116        Dnscache        (eecba1dd142bf8693c476be8f32fe253) C:\Windows\System32\dnsrslvr.dll
20:26:47.0823 3116        Dnscache - ok
20:26:47.0891 3116        dot3svc        (1f795d214820e496bf1124434a6db546) C:\Windows\System32\dot3svc.dll
20:26:47.0997 3116        dot3svc - ok
20:26:48.0062 3116        DPS            (032c90ad677bf7b7a8013d6087c7a921) C:\Windows\system32\dps.dll
20:26:48.0149 3116        DPS - ok
20:26:48.0201 3116        drmkaud        (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys
20:26:48.0294 3116        drmkaud - ok
20:26:48.0359 3116        DXGKrnl        (a2b160c1bb13ee3303c342e551373c59) C:\Windows\System32\drivers\dxgkrnl.sys
20:26:48.0435 3116        DXGKrnl - ok
20:26:48.0553 3116        E1G60          (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
20:26:48.0644 3116        E1G60 - ok
20:26:48.0722 3116        EapHost        (90a0a875642e18618010645311b4e89e) C:\Windows\System32\eapsvc.dll
20:26:48.0784 3116        EapHost - ok
20:26:48.0825 3116        Ecache          (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys
20:26:48.0838 3116        Ecache - ok
20:26:48.0888 3116        elxstor        (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
20:26:48.0907 3116        elxstor - ok
20:26:48.0973 3116        EMDMgmt        (3226fda08988526e819e364e8cce4cee) C:\Windows\system32\emdmgmt.dll
20:26:49.0117 3116        EMDMgmt - ok
20:26:49.0203 3116        EventSystem    (7b4971c3d43525175a4ea0d143e0412e) C:\Windows\system32\es.dll
20:26:49.0303 3116        EventSystem - ok
20:26:49.0342 3116        fastfat        (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys
20:26:49.0462 3116        fastfat - ok
20:26:49.0514 3116        fdc            (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
20:26:49.0584 3116        fdc - ok
20:26:49.0610 3116        fdPHost        (e43bce1a77d6fd4ed5f8e0482b9e7df1) C:\Windows\system32\fdPHost.dll
20:26:49.0713 3116        fdPHost - ok
20:26:49.0728 3116        FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
20:26:49.0796 3116        FDResPub - ok
20:26:49.0823 3116        FileInfo        (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys
20:26:49.0834 3116        FileInfo - ok
20:26:49.0869 3116        Filetrace      (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys
20:26:49.0937 3116        Filetrace - ok
20:26:49.0972 3116        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
20:26:50.0044 3116        flpydisk - ok
20:26:50.0064 3116        FltMgr          (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys
20:26:50.0076 3116        FltMgr - ok
20:26:50.0198 3116        FontCache3.0.0.0 (c9be08664611ddaf98e2331e9288b00b) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:26:50.0209 3116        FontCache3.0.0.0 - ok
20:26:50.0256 3116        Fs_Rec          (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys
20:26:50.0346 3116        Fs_Rec - ok
20:26:50.0375 3116        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
20:26:50.0387 3116        gagp30kx - ok
20:26:50.0476 3116        gpsvc          (bcf6589c42d8f6a20f33ef133ffe0524) C:\Windows\System32\gpsvc.dll
20:26:50.0623 3116        gpsvc - ok
20:26:50.0753 3116        gusvc          (751c1d2ca2abf4a9f5a6b8d7d45b907c) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
20:26:50.0782 3116        gusvc - ok
20:26:50.0930 3116        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
20:26:51.0070 3116        HdAudAddService - ok
20:26:51.0135 3116        HDAudBus        (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:26:51.0210 3116        HDAudBus - ok
20:26:51.0240 3116        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
20:26:51.0323 3116        HidBth - ok
20:26:51.0353 3116        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
20:26:51.0432 3116        HidIr - ok
20:26:51.0474 3116        hidserv        (8fa640195279ace21bea91396a0054fc) C:\Windows\system32\hidserv.dll
20:26:51.0553 3116        hidserv - ok
20:26:51.0590 3116        HidUsb          (3c64042b95e583b366ba4e5d2450235e) C:\Windows\system32\DRIVERS\hidusb.sys
20:26:51.0673 3116        HidUsb - ok
20:26:51.0717 3116        hkmsvc          (d40aa05e29bf6ed29b139f044b461e9b) C:\Windows\system32\kmsvc.dll
20:26:51.0774 3116        hkmsvc - ok
20:26:51.0808 3116        HpCISSs        (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
20:26:51.0819 3116        HpCISSs - ok
20:26:51.0881 3116        HTTP            (3c3cba3ce1a66439a960d4531a167c39) C:\Windows\system32\drivers\HTTP.sys
20:26:52.0029 3116        HTTP - ok
20:26:52.0069 3116        i2omp          (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
20:26:52.0087 3116        i2omp - ok
20:26:52.0163 3116        i8042prt        (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys
20:26:52.0242 3116        i8042prt - ok
20:26:52.0294 3116        iaStorV        (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
20:26:52.0324 3116        iaStorV - ok
20:26:52.0450 3116        idsvc          (7b630acaed64fef0c3e1cf255cb56686) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:26:52.0518 3116        idsvc - ok
20:26:52.0559 3116        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
20:26:52.0568 3116        iirsp - ok
20:26:52.0637 3116        IKEEXT          (35662fe4d8622f667aa5a5568f7f1b40) C:\Windows\System32\ikeext.dll
20:26:52.0733 3116        IKEEXT - ok
20:26:52.0797 3116        intelide        (e5ea1c17da5065032e346591ff64f3af) C:\Windows\system32\drivers\intelide.sys
20:26:52.0808 3116        intelide - ok
20:26:52.0839 3116        intelppm        (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
20:26:52.0916 3116        intelppm - ok
20:26:52.0972 3116        IPBusEnum      (88cf5281ed9880d74dc9011cf8b5262d) C:\Windows\system32\ipbusenum.dll
20:26:53.0059 3116        IPBusEnum - ok
20:26:53.0095 3116        IpFilterDriver  (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:26:53.0167 3116        IpFilterDriver - ok
20:26:53.0228 3116        iphlpsvc        (ecc9ad72cfc4ab41cf6a9bcc11f9fef6) C:\Windows\System32\iphlpsvc.dll
20:26:53.0325 3116        iphlpsvc - ok
20:26:53.0348 3116        IpInIp - ok
20:26:53.0385 3116        IPMIDRV        (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
20:26:53.0495 3116        IPMIDRV - ok
20:26:53.0519 3116        IPNAT          (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys
20:26:53.0571 3116        IPNAT - ok
20:26:53.0586 3116        IRENUM          (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys
20:26:53.0636 3116        IRENUM - ok
20:26:53.0669 3116        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
20:26:53.0679 3116        isapnp - ok
20:26:53.0788 3116        iScsiPrt        (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys
20:26:53.0815 3116        iScsiPrt - ok
20:26:53.0844 3116        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
20:26:53.0854 3116        iteatapi - ok
20:26:53.0904 3116        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
20:26:53.0914 3116        iteraid - ok
20:26:53.0991 3116        JRAID          (222e263cc06e47bda386fe19b88e8583) C:\Windows\system32\drivers\jraid.sys
20:26:54.0075 3116        JRAID - ok
20:26:54.0124 3116        kbdclass        (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys
20:26:54.0135 3116        kbdclass - ok
20:26:54.0191 3116        kbdhid          (ed61dbc6603f612b7338283edbacbc4b) C:\Windows\system32\DRIVERS\kbdhid.sys
20:26:54.0247 3116        kbdhid - ok
20:26:54.0301 3116        KeyIso          (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:26:54.0386 3116        KeyIso - ok
20:26:54.0422 3116        KSecDD          (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys
20:26:54.0454 3116        KSecDD - ok
20:26:54.0527 3116        KtmRm          (45c537fe5dde9a0146aeff76e615737d) C:\Windows\system32\msdtckrm.dll
20:26:54.0678 3116        KtmRm - ok
20:26:54.0738 3116        LanmanServer    (53d1482fc1aa36ac015a85e6cf2146bd) C:\Windows\system32\srvsvc.dll
20:26:54.0828 3116        LanmanServer - ok
20:26:54.0896 3116        LanmanWorkstation (435f0f6dc87a4b5da78f1fa309884189) C:\Windows\System32\wkssvc.dll
20:26:54.0979 3116        LanmanWorkstation - ok
20:26:55.0033 3116        lltdio          (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys
20:26:55.0125 3116        lltdio - ok
20:26:55.0179 3116        lltdsvc        (7450dbcf754391dd6363fffd5ef0e789) C:\Windows\System32\lltdsvc.dll
20:26:55.0261 3116        lltdsvc - ok
20:26:55.0286 3116        lmhosts        (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
20:26:55.0351 3116        lmhosts - ok
20:26:55.0390 3116        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
20:26:55.0408 3116        LSI_FC - ok
20:26:55.0434 3116        LSI_SAS        (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
20:26:55.0445 3116        LSI_SAS - ok
20:26:55.0494 3116        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
20:26:55.0505 3116        LSI_SCSI - ok
20:26:55.0537 3116        luafv          (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys
20:26:55.0594 3116        luafv - ok
20:26:55.0645 3116        MBAMProtector  (fb097bbc1a18f044bd17bd2fccf97865) C:\Windows\system32\drivers\mbam.sys
20:26:55.0658 3116        MBAMProtector - ok
20:26:55.0758 3116        MBAMService    (ba400ed640bca1eae5c727ae17c10207) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
20:26:55.0833 3116        MBAMService - ok
20:26:55.0884 3116        megasas        (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
20:26:55.0902 3116        megasas - ok
20:26:56.0106 3116        MIINPazX        (5e5024d9e2351db2563b30912b4c4146) C:\PROGRA~1\COMMON~1\MARMIK~1\MInfraIS\MIINPazX.SYS
20:26:56.0151 3116        MIINPazX ( UnsignedFile.Multi.Generic ) - warning
20:26:56.0152 3116        MIINPazX - detected UnsignedFile.Multi.Generic (1)
20:26:56.0211 3116        MMCSS          (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll
20:26:56.0338 3116        MMCSS - ok
20:26:56.0389 3116        Modem          (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys
20:26:56.0509 3116        Modem - ok
20:26:56.0576 3116        monitor        (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys
20:26:56.0598 3116        monitor - ok
20:26:56.0639 3116        mouclass        (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys
20:26:56.0650 3116        mouclass - ok
20:26:56.0700 3116        mouhid          (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys
20:26:56.0714 3116        mouhid - ok
20:26:56.0763 3116        MountMgr        (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys
20:26:56.0778 3116        MountMgr - ok
20:26:56.0825 3116        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
20:26:56.0837 3116        mpio - ok
20:26:56.0884 3116        mpsdrv          (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys
20:26:56.0948 3116        mpsdrv - ok
20:26:56.0986 3116        MpsSvc          (563ed845885c6a7c09a7715d8bd0585c) C:\Windows\system32\mpssvc.dll
20:26:57.0103 3116        MpsSvc - ok
20:26:57.0142 3116        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
20:26:57.0160 3116        Mraid35x - ok
20:26:57.0233 3116        MRxDAV          (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys
20:26:57.0336 3116        MRxDAV - ok
20:26:57.0401 3116        mrxsmb          (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:26:57.0499 3116        mrxsmb - ok
20:26:57.0548 3116        mrxsmb10        (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:26:57.0619 3116        mrxsmb10 - ok
20:26:57.0671 3116        mrxsmb20        (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:26:57.0728 3116        mrxsmb20 - ok
20:26:57.0796 3116        msahci          (86068b8b54a5eb092f51657f00b2222a) C:\Windows\system32\drivers\msahci.sys
20:26:57.0814 3116        msahci - ok
20:26:57.0867 3116        msdsm          (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
20:26:57.0887 3116        msdsm - ok
20:26:57.0937 3116        MSDTC          (bc64a92d821efea8bab8e8caf1b668bc) C:\Windows\System32\msdtc.exe
20:26:57.0968 3116        MSDTC - ok
20:26:58.0017 3116        Msfs            (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys
20:26:58.0104 3116        Msfs - ok
20:26:58.0155 3116        msisadrv        (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys
20:26:58.0165 3116        msisadrv - ok
20:26:58.0221 3116        MSiSCSI        (8acf956d9154e893e789881430c12632) C:\Windows\system32\iscsiexe.dll
20:26:58.0302 3116        MSiSCSI - ok
20:26:58.0316 3116        msiserver - ok
20:26:58.0348 3116        MSKSSRV        (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys
20:26:58.0418 3116        MSKSSRV - ok
20:26:58.0457 3116        MSPCLOCK        (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys
20:26:58.0521 3116        MSPCLOCK - ok
20:26:58.0549 3116        MSPQM          (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys
20:26:58.0637 3116        MSPQM - ok
20:26:58.0682 3116        MsRPC          (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys
20:26:58.0697 3116        MsRPC - ok
20:26:58.0736 3116        mssmbios        (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys
20:26:58.0746 3116        mssmbios - ok
20:26:58.0781 3116        MSTEE          (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys
20:26:58.0837 3116        MSTEE - ok
20:26:59.0008 3116        MTOnlPktAlyX    (493138c4f4119e938427da02486f09cb) C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS
20:26:59.0038 3116        MTOnlPktAlyX ( UnsignedFile.Multi.Generic ) - warning
20:26:59.0038 3116        MTOnlPktAlyX - detected UnsignedFile.Multi.Generic (1)
20:26:59.0101 3116        Mup            (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys
20:26:59.0110 3116        Mup - ok
20:26:59.0169 3116        napagent        (1cdbb5d002fe2bc5300aa20550d8a52e) C:\Windows\system32\qagentRT.dll
20:26:59.0273 3116        napagent - ok
20:26:59.0339 3116        NativeWifiP    (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys
20:26:59.0402 3116        NativeWifiP - ok
20:26:59.0492 3116        NDIS            (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys
20:26:59.0533 3116        NDIS - ok
20:26:59.0606 3116        NdisTapi        (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys
20:26:59.0656 3116        NdisTapi - ok
20:26:59.0696 3116        Ndisuio        (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys
20:26:59.0752 3116        Ndisuio - ok
20:26:59.0793 3116        NdisWan        (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys
20:26:59.0850 3116        NdisWan - ok
20:26:59.0887 3116        NDProxy        (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys
20:26:59.0901 3116        NDProxy - ok
20:26:59.0919 3116        NetBIOS        (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys
20:26:59.0995 3116        NetBIOS - ok
20:27:00.0035 3116        netbt          (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys
20:27:00.0123 3116        netbt - ok
20:27:00.0176 3116        Netlogon        (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:27:00.0196 3116        Netlogon - ok
20:27:00.0259 3116        Netman          (90a4dae28b94497f83bea0f2a3b77092) C:\Windows\System32\netman.dll
20:27:00.0336 3116        Netman - ok
20:27:00.0379 3116        netprofm        (7c5c3d9ceee838856b828ab6f98a2857) C:\Windows\System32\netprofm.dll
20:27:00.0470 3116        netprofm - ok
20:27:00.0548 3116        NetTcpPortSharing (0ad5876ef4e9eb77c8f93eb5b2fff386) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:27:00.0560 3116        NetTcpPortSharing - ok
20:27:00.0599 3116        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
20:27:00.0617 3116        nfrd960 - ok
20:27:00.0675 3116        NlaSvc          (c424117a562f2de37a42266894c79aeb) C:\Windows\System32\nlasvc.dll
20:27:00.0763 3116        NlaSvc - ok
20:27:00.0842 3116        nmwcd          (cfe3462a9e94a57dcd9676f6b7fe7f67) C:\Windows\system32\drivers\ccdcmb.sys
20:27:00.0924 3116        nmwcd - ok
20:27:00.0982 3116        nmwcdc          (8f2a94f991f8c73cec26b4b5620d1edc) C:\Windows\system32\drivers\ccdcmbo.sys
20:27:01.0016 3116        nmwcdc - ok
20:27:01.0058 3116        Npfs            (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys
20:27:01.0137 3116        Npfs - ok
20:27:01.0213 3116        nsi            (23b8201a363de0e649fc75ee9874dee2) C:\Windows\system32\nsisvc.dll
20:27:01.0286 3116        nsi - ok
20:27:01.0332 3116        nsiproxy        (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys
20:27:01.0424 3116        nsiproxy - ok
20:27:01.0575 3116        Ntfs            (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys
20:27:01.0666 3116        Ntfs - ok
20:27:01.0701 3116        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
20:27:01.0777 3116        ntrigdigi - ok
20:27:01.0801 3116        Null            (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys
20:27:01.0880 3116        Null - ok
20:27:01.0960 3116        NVENETFD        (1657f3fbd9061526c14ff37e79306f98) C:\Windows\system32\DRIVERS\nvm60x32.sys
20:27:02.0103 3116        NVENETFD - ok
20:27:02.0375 3116        nvlddmkm        (cfddedc1151839dd71f78472645214a5) C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:27:02.0659 3116        nvlddmkm - ok
20:27:02.0842 3116        nvraid          (6f785db62a6d8f3fafd3e5695277e849) C:\Windows\system32\drivers\nvraid.sys
20:27:02.0897 3116        nvraid - ok
20:27:02.0917 3116        nvstor          (4a5fcab82d9bf6af8a023a66802fe9e9) C:\Windows\system32\drivers\nvstor.sys
20:27:02.0954 3116        nvstor - ok
20:27:02.0973 3116        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
20:27:02.0984 3116        nv_agp - ok
20:27:02.0998 3116        NwlnkFlt - ok
20:27:03.0011 3116        NwlnkFwd - ok
20:27:03.0046 3116        ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys
20:27:03.0113 3116        ohci1394 - ok
20:27:03.0221 3116        ose            (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:27:03.0232 3116        ose - ok
20:27:03.0330 3116        p2pimsvc        (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:27:03.0433 3116        p2pimsvc - ok
20:27:03.0458 3116        p2psvc          (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:27:03.0486 3116        p2psvc - ok
20:27:03.0548 3116        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
20:27:03.0636 3116        Parport - ok
20:27:03.0671 3116        partmgr        (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys
20:27:03.0682 3116        partmgr - ok
20:27:03.0737 3116        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
20:27:03.0838 3116        Parvdm - ok
20:27:03.0872 3116        PcaSvc          (d8c5c215c932233a4f1d7f368f4e4e65) C:\Windows\System32\pcasvc.dll
20:27:03.0891 3116        PcaSvc - ok
20:27:03.0962 3116        pccsmcfd        (fd2041e9ba03db7764b2248f02475079) C:\Windows\system32\DRIVERS\pccsmcfd.sys
20:27:04.0003 3116        pccsmcfd - ok
20:27:04.0069 3116        pci            (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys
20:27:04.0099 3116        pci - ok
20:27:04.0160 3116        pciide          (b2fc76090ef1003463ccb07cabb35cff) C:\Windows\system32\drivers\pciide.sys
20:27:04.0193 3116        pciide - ok
20:27:04.0263 3116        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
20:27:04.0296 3116        pcmcia - ok
20:27:04.0408 3116        pcouffin        (5b6c11de7e839c05248ced8825470fef) C:\Windows\system32\Drivers\pcouffin.sys
20:27:04.0460 3116        pcouffin - ok
20:27:04.0597 3116        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
20:27:04.0728 3116        PEAUTH - ok
20:27:04.0971 3116        PID_PEPI        (dd184d9adfe2a8a21741dbdfe9e22f5c) C:\Windows\system32\DRIVERS\LV302V32.SYS
20:27:05.0258 3116        PID_PEPI - ok
20:27:05.0522 3116        pla            (cd05a38d166beade18030bafc0c0a939) C:\Windows\system32\pla.dll
20:27:05.0655 3116        pla - ok
20:27:05.0712 3116        PlugPlay        (747bb4c31f3b6e8d1b5ed0ad61518cb5) C:\Windows\system32\umpnpmgr.dll
20:27:05.0736 3116        PlugPlay - ok
20:27:05.0819 3116        PNRPAutoReg    (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:27:05.0888 3116        PNRPAutoReg - ok
20:27:05.0920 3116        PNRPsvc        (016d01d3b8fb976a193c7434bed8dccf) C:\Windows\system32\p2psvc.dll
20:27:05.0966 3116        PNRPsvc - ok
20:27:06.0042 3116        PolicyAgent    (5ebdec613bd377ce9a85382be5c6b83b) C:\Windows\System32\ipsecsvc.dll
20:27:06.0098 3116        PolicyAgent - ok
20:27:06.0184 3116        PptpMiniport    (6c359ac71d7b550a0d41f9db4563ce05) C:\Windows\system32\DRIVERS\raspptp.sys
20:27:06.0265 3116        PptpMiniport - ok
20:27:06.0397 3116        Processor      (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
20:27:06.0524 3116        Processor - ok
20:27:06.0606 3116        ProfSvc        (213112e152e68f0e4705e36f052a2880) C:\Windows\system32\profsvc.dll
20:27:06.0738 3116        ProfSvc - ok
20:27:06.0807 3116        ProtectedStorage (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:27:06.0840 3116        ProtectedStorage - ok
20:27:06.0901 3116        PSched          (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys
20:27:06.0923 3116        PSched - ok
20:27:06.0980 3116        PxHelp20        (86724469cd077901706854974cd13c3e) C:\Windows\system32\Drivers\PxHelp20.sys
20:27:06.0987 3116        PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
20:27:06.0987 3116        PxHelp20 - detected UnsignedFile.Multi.Generic (1)
20:27:07.0085 3116        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
20:27:07.0165 3116        ql2300 - ok
20:27:07.0183 3116        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
20:27:07.0197 3116        ql40xx - ok
20:27:07.0250 3116        QWAVE          (ca61bdfd3713a7ce75f2812afc431594) C:\Windows\system32\qwave.dll
20:27:07.0277 3116        QWAVE - ok
20:27:07.0298 3116        QWAVEdrv        (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys
20:27:07.0315 3116        QWAVEdrv - ok
20:27:07.0339 3116        RasAcd          (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys
20:27:07.0421 3116        RasAcd - ok
20:27:07.0465 3116        RasAuto        (f14f4aab9f54d099fe99192bdb100ac9) C:\Windows\System32\rasauto.dll
20:27:07.0552 3116        RasAuto - ok
20:27:07.0609 3116        Rasl2tp        (88587dd843e2059848995b407b67f6cf) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:27:07.0665 3116        Rasl2tp - ok
20:27:07.0699 3116        RasMan          (11d65e29bc9d1e4114d18fe68194394c) C:\Windows\System32\rasmans.dll
20:27:07.0791 3116        RasMan - ok
20:27:07.0851 3116        RasPppoe        (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys
20:27:07.0963 3116        RasPppoe - ok
20:27:08.0012 3116        rdbss          (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys
20:27:08.0073 3116        rdbss - ok
20:27:08.0093 3116        RDPCDD          (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:27:08.0143 3116        RDPCDD - ok
20:27:08.0201 3116        rdpdr          (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
20:27:08.0281 3116        rdpdr - ok
20:27:08.0293 3116        RDPENCDD        (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys
20:27:08.0383 3116        RDPENCDD - ok
20:27:08.0410 3116        RDPWD          (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys
20:27:08.0470 3116        RDPWD - ok
20:27:08.0546 3116        RemoteAccess    (6c1a43c589ee8011a1ebfd51c01b77ce) C:\Windows\System32\mprdim.dll
20:27:08.0633 3116        RemoteAccess - ok
20:27:08.0691 3116        RemoteRegistry  (9a043808667c8c1893da7275af373f0e) C:\Windows\system32\regsvc.dll
20:27:08.0781 3116        RemoteRegistry - ok
20:27:08.0866 3116        RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
20:27:08.0893 3116        RpcLocator - ok
20:27:08.0987 3116        RpcSs          (7b981222a257d076885bffb66f19b7ce) C:\Windows\system32\rpcss.dll
20:27:09.0066 3116        RpcSs - ok
20:27:09.0116 3116        rspndr          (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys
20:27:09.0178 3116        rspndr - ok
20:27:09.0225 3116        SamSs          (c731b1fe449d4e9cea358c9d55b69be9) C:\Windows\system32\lsass.exe
20:27:09.0240 3116        SamSs - ok
20:27:09.0284 3116        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
20:27:09.0295 3116        sbp2port - ok
20:27:09.0340 3116        SCardSvr        (565b4b9e5ad2f2f18a4f8aafa6c06bbb) C:\Windows\System32\SCardSvr.dll
20:27:09.0463 3116        SCardSvr - ok
20:27:09.0554 3116        Schedule        (886cec884b5be29ab9828b8ab46b11f7) C:\Windows\system32\schedsvc.dll
20:27:09.0639 3116        Schedule - ok
20:27:09.0777 3116        SCPolicySvc    (0600e04315fe543802a379d5d23c8be0) C:\Windows\System32\certprop.dll
20:27:09.0832 3116        SCPolicySvc - ok
20:27:09.0893 3116        SDRSVC          (f7b6bf02240d0a764adf8c8966735552) C:\Windows\System32\SDRSVC.dll
20:27:09.0921 3116        SDRSVC - ok
20:27:09.0978 3116        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:27:10.0051 3116        secdrv - ok
20:27:10.0078 3116        seclogon        (8388c4133ddbe62ad7bc3ec9f14271ed) C:\Windows\system32\seclogon.dll
20:27:10.0133 3116        seclogon - ok
20:27:10.0153 3116        SENS            (34350ae2c1d33d21c7305f861bd8dad8) C:\Windows\System32\sens.dll
20:27:10.0238 3116        SENS - ok
20:27:10.0279 3116        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys
20:27:10.0340 3116        Serenum - ok
20:27:10.0368 3116        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys
20:27:10.0452 3116        Serial - ok
20:27:10.0506 3116        sermouse        (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys
20:27:10.0521 3116        sermouse - ok
20:27:10.0675 3116        ServiceLayer    (8c1f87f5fdd92229d1754b98f073913f) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
20:27:10.0732 3116        ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
20:27:10.0732 3116        ServiceLayer - detected UnsignedFile.Multi.Generic (1)
20:27:10.0828 3116        SessionEnv      (78878235da4df0d116e86837a0a21df8) C:\Windows\system32\sessenv.dll
20:27:10.0911 3116        SessionEnv - ok
20:27:10.0937 3116        sffdisk        (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
20:27:10.0986 3116        sffdisk - ok
20:27:11.0020 3116        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
20:27:11.0071 3116        sffp_mmc - ok
20:27:11.0083 3116        sffp_sd        (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
20:27:11.0153 3116        sffp_sd - ok
20:27:11.0167 3116        sfloppy        (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
20:27:11.0220 3116        sfloppy - ok
20:27:11.0281 3116        SharedAccess    (9a82bf4c90b00a63150a606a1e2fd82b) C:\Windows\System32\ipnathlp.dll
20:27:11.0329 3116        SharedAccess - ok
20:27:11.0381 3116        ShellHWDetection (b264dfa21677728613267fe63802b332) C:\Windows\System32\shsvcs.dll
20:27:11.0432 3116        ShellHWDetection - ok
20:27:11.0461 3116        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
20:27:11.0470 3116        sisagp - ok
20:27:11.0519 3116        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
20:27:11.0531 3116        SiSRaid2 - ok
20:27:11.0578 3116        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
20:27:11.0590 3116        SiSRaid4 - ok
20:27:11.0774 3116        slsvc          (a1dcd30534835cb67733ad00175125a6) C:\Windows\system32\SLsvc.exe
20:27:11.0967 3116        slsvc - ok
20:27:12.0154 3116        SLUINotify      (56da296e7b376a727e7bdc5ac7fbee02) C:\Windows\system32\SLUINotify.dll
20:27:12.0183 3116        SLUINotify - ok
20:27:12.0257 3116        Smb            (ac0d90738adb51a6fd12ff00874a2162) C:\Windows\system32\DRIVERS\smb.sys
20:27:12.0358 3116        Smb - ok
20:27:12.0434 3116        SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
20:27:12.0449 3116        SNMPTRAP - ok
20:27:12.0465 3116        spldr          (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys
20:27:12.0475 3116        spldr - ok
20:27:12.0501 3116        Spooler        (da612ef2556776df2630b68bf2d48935) C:\Windows\System32\spoolsv.exe
20:27:12.0518 3116        Spooler - ok
20:27:12.0579 3116        srv            (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys
20:27:12.0648 3116        srv - ok
20:27:12.0729 3116        srv2            (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys
20:27:12.0778 3116        srv2 - ok
20:27:12.0876 3116        srvnet          (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys
20:27:12.0922 3116        srvnet - ok
20:27:13.0038 3116        SSDPSRV        (8d3e4baff8b3997138c38eb1b600519a) C:\Windows\System32\ssdpsrv.dll
20:27:13.0137 3116        SSDPSRV - ok
20:27:13.0205 3116        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
20:27:13.0213 3116        ssmdrv - ok
20:27:13.0305 3116        stisvc          (a941e099ef46e3cc12f898cbe1c39910) C:\Windows\System32\wiaservc.dll
20:27:13.0365 3116        stisvc - ok
20:27:13.0429 3116        swenum          (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys
20:27:13.0438 3116        swenum - ok
20:27:13.0475 3116        swprv          (749ada8d6c18a08adfede69cbf5db2e0) C:\Windows\System32\swprv.dll
20:27:13.0552 3116        swprv - ok
20:27:13.0588 3116        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
20:27:13.0598 3116        Symc8xx - ok
20:27:13.0618 3116        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
20:27:13.0630 3116        Sym_hi - ok
20:27:13.0655 3116        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
20:27:13.0665 3116        Sym_u3 - ok
20:27:13.0742 3116        SysMain        (8f2b5fede18bd3c4c926cbf88e6f1264) C:\Windows\system32\sysmain.dll
20:27:13.0855 3116        SysMain - ok
20:27:13.0895 3116        TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
20:27:13.0940 3116        TabletInputService - ok
20:27:14.0030 3116        TapiSrv        (ef3dd33c740fc2f82e7e4622f1c49289) C:\Windows\System32\tapisrv.dll
20:27:14.0092 3116        TapiSrv - ok
20:27:14.0123 3116        TBS            (68fa52794ae9acc61bde16fe0956b414) C:\Windows\System32\tbssvc.dll
20:27:14.0201 3116        TBS - ok
20:27:14.0284 3116        Tcpip          (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\drivers\tcpip.sys
20:27:14.0327 3116        Tcpip - ok
20:27:14.0347 3116        Tcpip6          (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\DRIVERS\tcpip.sys
20:27:14.0392 3116        Tcpip6 - ok
20:27:14.0453 3116        tcpipreg        (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys
20:27:14.0543 3116        tcpipreg - ok
20:27:14.0580 3116        TDPIPE          (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys
20:27:14.0655 3116        TDPIPE - ok
20:27:14.0679 3116        TDTCP          (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys
20:27:14.0734 3116        TDTCP - ok
20:27:14.0779 3116        tdx            (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys
20:27:14.0847 3116        tdx - ok
20:27:14.0876 3116        TermDD          (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys
20:27:14.0887 3116        TermDD - ok
20:27:14.0958 3116        TermService    (fad71c1e8e4047b154e899ae31eb8caa) C:\Windows\System32\termsrv.dll
20:27:15.0087 3116        TermService - ok
20:27:15.0190 3116        Themes          (b264dfa21677728613267fe63802b332) C:\Windows\system32\shsvcs.dll
20:27:15.0209 3116        Themes - ok
20:27:15.0285 3116        THREADORDER    (9dfa3a459af0954aa85b4f7622ad87bb) C:\Windows\system32\mmcss.dll
20:27:15.0336 3116        THREADORDER - ok
20:27:15.0389 3116        TrkWks          (6bba0582c0025d43729a1112d3b57897) C:\Windows\System32\trkwks.dll
20:27:15.0478 3116        TrkWks - ok
20:27:15.0569 3116        TrustedInstaller (34e388a395fedba1d0511ed39bbf4074) C:\Windows\servicing\TrustedInstaller.exe
20:27:15.0609 3116        TrustedInstaller - ok
20:27:15.0669 3116        tssecsrv        (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:27:15.0782 3116        tssecsrv - ok
20:27:15.0835 3116        tunmp          (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys
20:27:15.0848 3116        tunmp - ok
20:27:15.0862 3116        tunnel          (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys
20:27:15.0907 3116        tunnel - ok
20:27:15.0931 3116        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
20:27:15.0941 3116        uagp35 - ok
20:27:15.0991 3116        udfs            (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys
20:27:16.0051 3116        udfs - ok
20:27:16.0107 3116        UI0Detect      (24a333f4f14dcfb6ff6d5a1b9e5d79dd) C:\Windows\system32\UI0Detect.exe
20:27:16.0122 3116        UI0Detect - ok
20:27:16.0163 3116        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
20:27:16.0174 3116        uliagpkx - ok
20:27:16.0198 3116        uliahci        (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
20:27:16.0215 3116        uliahci - ok
20:27:16.0248 3116        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
20:27:16.0261 3116        UlSata - ok
20:27:16.0305 3116        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
20:27:16.0319 3116        ulsata2 - ok
20:27:16.0358 3116        umbus          (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys
20:27:16.0441 3116        umbus - ok
20:27:16.0492 3116        upnphost        (8eb871a3deb6b3d5a85eb6ddfc390b59) C:\Windows\System32\upnphost.dll
20:27:16.0557 3116        upnphost - ok
20:27:16.0626 3116        upperdev        (ec01da44b090d2651fc032c8b9257232) C:\Windows\system32\DRIVERS\usbser_lowerflt.sys
20:27:16.0764 3116        upperdev - ok
20:27:16.0864 3116        usbaudio        (f6bf998ae33e3fb6c7d27f0560f1173f) C:\Windows\system32\drivers\usbaudio.sys
20:27:16.0944 3116        usbaudio - ok
20:27:16.0984 3116        usbccgp        (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\DRIVERS\usbccgp.sys
20:27:17.0063 3116        usbccgp - ok
20:27:17.0084 3116        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
20:27:17.0148 3116        usbcir - ok
20:27:17.0197 3116        usbehci        (63fe924d8a1113c3ba6750693fbec7d3) C:\Windows\system32\DRIVERS\usbehci.sys
20:27:17.0261 3116        usbehci - ok
20:27:17.0287 3116        usbhub          (5edec5510592c905e91817707dce62a2) C:\Windows\system32\DRIVERS\usbhub.sys
20:27:17.0376 3116        usbhub - ok
20:27:17.0413 3116        usbohci        (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\DRIVERS\usbohci.sys
20:27:17.0490 3116        usbohci - ok
20:27:17.0516 3116        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys
20:27:17.0587 3116        usbprint - ok
20:27:17.0658 3116        usbscan        (b1f95285c08ddfe00c0b955462637ec7) C:\Windows\system32\DRIVERS\usbscan.sys
20:27:17.0710 3116        usbscan - ok
20:27:17.0749 3116        usbser          (c0488cc01a1c686b08a3d360c7f50324) C:\Windows\system32\DRIVERS\usbser.sys
20:27:17.0809 3116        usbser - ok
20:27:17.0855 3116        UsbserFilt      (4abd37cfbd710e64f01f9da8710c73f7) C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys
20:27:17.0904 3116        UsbserFilt - ok
20:27:17.0960 3116        USBSTOR        (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:27:17.0976 3116        USBSTOR - ok
20:27:18.0023 3116        usbuhci        (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
20:27:18.0079 3116        usbuhci - ok
20:27:18.0130 3116        UxSms          (f79d0d7c9004474cb42746d9b2c30a2b) C:\Windows\System32\uxsms.dll
20:27:18.0187 3116        UxSms - ok
20:27:18.0226 3116        vds            (c9d0bafee0d0a2681f048ca61bc0da96) C:\Windows\System32\vds.exe
20:27:18.0258 3116        vds - ok
20:27:18.0294 3116        vga            (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
20:27:18.0366 3116        vga - ok
20:27:18.0393 3116        VgaSave        (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys
20:27:18.0473 3116        VgaSave - ok
20:27:18.0512 3116        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
20:27:18.0523 3116        viaagp - ok
20:27:18.0555 3116        ViaC7          (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
20:27:18.0619 3116        ViaC7 - ok
20:27:18.0648 3116        viaide          (7aa7ec9a08dc2c39649c413b1a26e298) C:\Windows\system32\drivers\viaide.sys
20:27:18.0658 3116        viaide - ok
20:27:18.0675 3116        volmgr          (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys
20:27:18.0687 3116        volmgr - ok
20:27:18.0728 3116        volmgrx        (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys
20:27:18.0772 3116        volmgrx - ok
20:27:18.0815 3116        volsnap        (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys
20:27:18.0831 3116        volsnap - ok
20:27:18.0875 3116        vsmraid        (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
20:27:18.0888 3116        vsmraid - ok
20:27:18.0995 3116        VSS            (e0e29d9ef2524abd11749c7c2fd7f607) C:\Windows\system32\vssvc.exe
20:27:19.0086 3116        VSS - ok
20:27:19.0144 3116        W32Time        (62b0d0f6f5580d9d0dfa5e0b466ff2ed) C:\Windows\system32\w32time.dll
20:27:19.0214 3116        W32Time - ok
20:27:19.0257 3116        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
20:27:19.0329 3116        WacomPen - ok
20:27:19.0389 3116        Wanarp          (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
20:27:19.0455 3116        Wanarp - ok
20:27:19.0466 3116        Wanarpv6        (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys
20:27:19.0481 3116        Wanarpv6 - ok
20:27:19.0512 3116        wcncsvc        (c1b19162e0509ceab4cdf664e139d956) C:\Windows\System32\wcncsvc.dll
20:27:19.0538 3116        wcncsvc - ok
20:27:19.0560 3116        WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
20:27:19.0636 3116        WcsPlugInService - ok
20:27:19.0651 3116        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
20:27:19.0663 3116        Wd - ok
20:27:19.0733 3116        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
20:27:19.0763 3116        Wdf01000 - ok
20:27:19.0811 3116        WdiServiceHost  (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll
20:27:19.0831 3116        WdiServiceHost - ok
20:27:19.0844 3116        WdiSystemHost  (2a424b89b14ef17a3d06bcb5a8f79601) C:\Windows\system32\wdi.dll
20:27:19.0865 3116        WdiSystemHost - ok
20:27:19.0925 3116        WebClient      (01e41c264eedcb827820a1909162579f) C:\Windows\System32\webclnt.dll
20:27:19.0980 3116        WebClient - ok
20:27:20.0007 3116        Wecsvc          (9cf67ff7f8d34cbf115d0c278b9f74aa) C:\Windows\system32\wecsvc.dll
20:27:20.0085 3116        Wecsvc - ok
20:27:20.0114 3116        wercplsupport  (b68cab45db1dab59d92acadfad6364a8) C:\Windows\System32\wercplsupport.dll
20:27:20.0172 3116        wercplsupport - ok
20:27:20.0205 3116        WerSvc          (36ba0707680ef4236fd752bee982cc25) C:\Windows\System32\WerSvc.dll
20:27:20.0273 3116        WerSvc - ok
20:27:20.0399 3116        WinDefend      (0d5ad0e71ff5ddac5dd2f443b499abd0) C:\Program Files\Windows Defender\mpsvc.dll
20:27:20.0421 3116        WinDefend - ok
20:27:20.0439 3116        WinHttpAutoProxySvc - ok
20:27:20.0553 3116        Winmgmt        (38a7b89de4e3417c122317949667fdd8) C:\Windows\system32\wbem\WMIsvc.dll
20:27:20.0617 3116        Winmgmt - ok
20:27:20.0661 3116        WinRM          (3f6823040030c3e4da1cf11cd40b7534) C:\Windows\system32\WsmSvc.dll
20:27:20.0762 3116        WinRM - ok
20:27:21.0069 3116        Wlansvc        (7640acea41348bfef34b76e245501261) C:\Windows\System32\wlansvc.dll
20:27:21.0155 3116        Wlansvc - ok
20:27:21.0268 3116        WmiAcpi        (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
20:27:21.0369 3116        WmiAcpi - ok
20:27:21.0546 3116        wmiApSrv        (a279323bee5fffafda222910bce92132) C:\Windows\system32\wbem\WmiApSrv.exe
20:27:21.0585 3116        wmiApSrv - ok
20:27:21.0755 3116        WMPNetworkSvc  (acb2e63d50157e3ea7140f29d9e76a48) C:\Program Files\Windows Media Player\wmpnetwk.exe
20:27:21.0845 3116        WMPNetworkSvc - ok
20:27:22.0004 3116        WPCSvc          (3d3b3b80c12abe506f56930c46422c28) C:\Windows\System32\wpcsvc.dll
20:27:22.0076 3116        WPCSvc - ok
20:27:22.0113 3116        WPDBusEnum      (c24844a1d0d9528b19d5bc266b8cd572) C:\Windows\system32\wpdbusenum.dll
20:27:22.0190 3116        WPDBusEnum - ok
20:27:22.0241 3116        WpdUsb          (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys
20:27:22.0317 3116        WpdUsb - ok
20:27:22.0370 3116        ws2ifsl        (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys
20:27:22.0426 3116        ws2ifsl - ok
20:27:22.0467 3116        wscsvc          (f97cbb919af6d0a6643d1a59c15014d1) C:\Windows\System32\wscsvc.dll
20:27:22.0486 3116        wscsvc - ok
20:27:22.0501 3116        WSearch - ok
20:27:22.0649 3116        wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
20:27:22.0746 3116        wuauserv - ok
20:27:22.0927 3116        WUDFRd          (a2aafcc8a204736296d937c7c545b53f) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:27:23.0065 3116        WUDFRd - ok
20:27:23.0129 3116        wudfsvc        (db5bf5aab72b1b99b5331231d09ebb26) C:\Windows\System32\WUDFSvc.dll
20:27:23.0193 3116        wudfsvc - ok
20:27:23.0230 3116        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
20:27:23.0597 3116        \Device\Harddisk0\DR0 - ok
20:27:23.0615 3116        Boot (0x1200)  (0045e68c5d03d9dafe4031bb29aab74a) \Device\Harddisk0\DR0\Partition0
20:27:23.0617 3116        \Device\Harddisk0\DR0\Partition0 - ok
20:27:23.0625 3116        ============================================================
20:27:23.0627 3116        Scan finished
20:27:23.0627 3116        ============================================================
20:27:23.0662 3432        Detected object count: 4
20:27:23.0663 3432        Actual detected object count: 4
20:27:52.0268 3432        MIINPazX ( UnsignedFile.Multi.Generic ) - skipped by user
20:27:52.0268 3432        MIINPazX ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:27:52.0268 3432        MTOnlPktAlyX ( UnsignedFile.Multi.Generic ) - skipped by user
20:27:52.0268 3432        MTOnlPktAlyX ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:27:52.0268 3432        PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
20:27:52.0268 3432        PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:27:52.0269 3432        ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
20:27:52.0269 3432        ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 25.06.2012 10:10
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

012 055-0 25.06.2012 19:40
Hallo,

anbei die neuesten Daten.
Danke + Grüße
Helmut

[code]
Combofix Logfile:
Code:
ComboFix 12-06-25.03 - Helmut 25.06.2012  20:16:22.1.1 - x86
Microsoft® Windows Vista™ Home Basic  6.0.6000.0.1252.49.1031.18.958.336 [GMT 2:00]
ausgeführt von:: c:\users\Helmut\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Helmut.Helmut-PC\Desktop\Internet Explorer.lnk
c:\windows\system32\explorer.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-25 bis 2012-06-25  ))))))))))))))))))))))))))))))
.
.
2012-06-25 18:27 . 2012-06-25 18:27        --------        d-----w-        c:\users\Rita\AppData\Local\temp
2012-06-25 18:27 . 2012-06-25 18:27        --------        d-----w-        c:\users\Helmut.Helmut-PC\AppData\Local\temp
2012-06-25 18:27 . 2012-06-25 18:27        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-06-21 19:43 . 2012-06-21 19:43        --------        d-----w-        c:\program files\ESET
2012-06-18 16:48 . 2012-06-18 16:48        --------        d-----w-        c:\users\Helmut\AppData\Roaming\Malwarebytes
2012-06-18 16:48 . 2012-06-18 16:48        --------        d-----w-        c:\programdata\Malwarebytes
2012-06-18 16:48 . 2012-06-18 16:48        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-06-18 16:48 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-06-18 12:52 . 2012-06-18 12:52        --------        d-----w-        C:\T-Online
2012-06-11 21:32 . 2012-06-11 21:32        --------        d-----w-        c:\users\Rita\AppData\Roaming\PC Suite
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-08 15:45 . 2012-03-28 13:49        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-05-08 15:45 . 2012-03-28 13:49        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2008-04-08 11:59 . 2008-04-08 11:59        2808832        ----a-w-        c:\program files\Common FilesDDBACSetup.msi
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-03-28 171448]
"BrowserChoice"="c:\windows\System32\browserchoice.exe" [2010-02-12 293376]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2011-09-01 966712]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"ToADiMon.exe"="c:\program files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe" [2007-02-15 282624]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-12-22 67752]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"InfoCockpit"="c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-01-16 176128]
.
c:\users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ctfmon.lnk - c:\windows\System32\rundll32.exe [2006-11-2 44544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
S2 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork        REG_MULTI_SZ          PLA DPS BFE mpssvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.drehscheibe-online.de/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Save YouTube Video as MP3 - c:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm
Trusted Zone: drehscheibe-online.de\www
Trusted Zone: olb.de\www
Trusted Zone: privatbahnforum.de\www
TCP: DhcpNameServer = 192.168.2.1
DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} - hxxps://www.olb.de/olb_fb3_1867b/plugin/AXFOAM.CAB
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-ESET Online Scanner - c:\program files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-25 20:28
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-06-25  20:33:17
ComboFix-quarantined-files.txt  2012-06-25 18:33
.
Vor Suchlauf: 8 Verzeichnis(se), 71.704.715.264 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 72.238.333.952 Bytes frei
.
- - End Of File - - B1E25AE2AA6D036C6B9830D03E94A5EC
--- --- ---

cosinus 25.06.2012 20:50
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

012 055-0 25.06.2012 22:05
Hallo,

so, Gmer habe ich schon mal parat...

Grüße
Helmut

[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-25 23:00:12
Windows 6.0.6000  Harddisk0\DR0 -> \Device\00000047 WDC_WD16 rev.05.0
Running: vnwfey1h.exe; Driver: C:\Users\Helmut\AppData\Local\Temp\pwlyrpoc.sys


---- System - GMER 1.0.15 ----

SSDT  8968350C                                                                                            ZwClose
SSDT  89683516                                                                                            ZwCreateSection
SSDT  89683507                                                                                            ZwDuplicateObject
SSDT  896834A8                                                                                            ZwOpenProcess
SSDT  896834AD                                                                                            ZwOpenThread
SSDT  89683520                                                                                            ZwRequestWaitReplyPort
SSDT  8968351B                                                                                            ZwSetContextThread
SSDT  89683525                                                                                            ZwSetSecurityObject
SSDT  8968352A                                                                                            ZwSystemDebugControl
SSDT  896834B7                                                                                            ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text  ntkrnlpa.exe!ZwCallbackReturn + 368                                                                  81C80874 4 Bytes  CALL E9FD14FA
.text  ntkrnlpa.exe!ZwCallbackReturn + 3D4                                                                  81C808E0 4 Bytes  JMP E9FD1F66
.text  ntkrnlpa.exe!ZwCallbackReturn + 73C                                                                  81C80C48 4 Bytes  CALL E9FD27CE
.text  C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                            section is writeable [0x88DC8340, 0x28B977, 0xE8000020]

---- User IAT/EAT - GMER 1.0.15 ----

IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                [74A3FBC8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]            [74A0B9AA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]      [749FA31F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]        [749FCBFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [749F8AB2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]    [74A0CF28] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]            [749F7D98] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [749F7CFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]              [749F6A64] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]      [74A8C1D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [74A17F56] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]            [749F90CD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                      [74A02179] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [74A021A4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [74A07F1C] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                [74A07D3E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[2456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [74A383D5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
--- --- ---


Hallo,

so, Osam auch noch, nun ist erst mal Feierabend - muss in die Koje - morgen arbeiten.

GN8
Helmut

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 23:23:56 on 25.06.2012

OS: Windows Vista Home Basic Edition (Build 6000), 32-bit
Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.16386

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"Ddbaccpl.cpl" - "DataDesign AG" - C:\Windows\system32\Ddbaccpl.cpl
"ddBACCTM.cpl" - "DataDesign AG" - C:\Windows\system32\ddBACCTM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"ToSysCnf" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToSysCnf.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\Helmut\AppData\Local\Temp\catchme.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"MIINPazX NDIS Protocol Driver" (MIINPazX) - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\COMMON~1\MARMIK~1\MInfraIS\MIINPazX.SYS
"MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS
"pwlyrpoc" (pwlyrpoc) - ? - C:\Users\Helmut\AppData\Local\Temp\pwlyrpoc.sys  (Hidden registry entry, rootkit activity | File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Google" - "Google Germany GmbH" - c:\program files\google\googletoolbar2.dll
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{271A3CF5-5A54-447B-A08F-BE805F0DA60B} "B+S Banksysteme AG DDBAC Plug-In" - "B+S Banksysteme AG" - C:\Windows\system32\AXFOAM.DLL / https://www.olb.de/olb_fb3_1867b/plugin/AXFOAM.CAB
{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - ? - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX  (File not found) / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -  (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype add-on for Internet Explorer" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Google" - "Google Germany GmbH" - c:\program files\google\googletoolbar2.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Germany GmbH" - c:\program files\google\googletoolbar2.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype add-on for Internet Explorer" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"NokiaOviSuite2" - "Nokia" - C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe -tray
"swg" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Photo Downloader" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"CanonSolutionMenu" - "CANON INC." - C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"NokiaMServer" - "Nokia" - C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
"OpwareSE4" - "Nuance Communications, Inc." - "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
"SSBkgdUpdate" - "Nuance Communications, Inc." - "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
"ToADiMon.exe" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
"WrtMon.exe" - ? - C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AAV UpdateService" (AAV UpdateService) - ? - C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
"Adobe Active File Monitor V5" (AdobeActiveFileMonitor5.0) - ? - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
...und nun doch noch den Rest:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-25 23:43:21
-----------------------------
23:43:21.766    OS Version: Windows 6.0.6000
23:43:21.766    Number of processors: 1 586 0x4F02
23:43:21.766    ComputerName: HELMUT-PC  UserName: Helmut
23:44:08.633    Initialize success
23:45:02.660    AVAST engine defs: 12062500
23:45:19.565    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000048
23:45:19.574    Disk 0 Vendor: WDC_WD16 05.0 Size: 152627MB BusType: 8
23:45:19.602    Disk 0 MBR read successfully
23:45:19.612    Disk 0 MBR scan
23:45:19.704    Disk 0 Windows VISTA default MBR code
23:45:19.729    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        2049 MB offset 12678
23:45:19.792    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      150569 MB offset 4212732
23:45:19.847    Disk 0 scanning sectors +312579760
23:45:20.015    Disk 0 scanning C:\Windows\system32\drivers
23:45:51.365    Service scanning
23:46:33.717    Modules scanning
23:46:47.758    Disk 0 trace - called modules:
23:46:47.797    ntkrnlpa.exe CLASSPNP.SYS disk.sys hal.dll acpi.sys storport.sys nvstor.sys partmgr.sys volmgr.sys ecache.sys volsnap.sys Ntfs.sys dxgkrnl.sys nvlddmkm.sys
23:46:48.162    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84ca2818]
23:46:48.173    3 ntkrnlpa.exe[81cb07e2] -> nt!IofCallDriver -> [0x836ef978]
23:46:48.185    5 acpi.sys[804d632a] -> nt!IofCallDriver -> \Device\00000048[0x836f19d0]
23:46:48.197    7 ntkrnlpa.exe[81cb07e2] -> nt!IofCallDriver -> [0x836ef978]
23:46:48.208    9 acpi.sys[804d632a] -> nt!IofCallDriver -> \Device\00000048[0x836f19d0]
23:46:48.221    Scan finished successfully
23:47:11.855    Disk 0 MBR has been saved successfully to "C:\Users\Helmut\Desktop\MBR.dat"
23:47:11.867    The log file has been saved successfully to "C:\Users\Helmut\Desktop\aswMBR.txt"

cosinus 26.06.2012 11:32
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

012 055-0 26.06.2012 17:58
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo,

anbei die Superspyware.
Habe als Bild noch die run.dll beigefügt.

DANKE + Malewarebytes folgt.

Gruß
Helmut

Code:
Core Rules Database Version : 8798
Trace Rules Database Version: 6610

Scan type      : Quick Scan
Total Scan Time : 00:07:01

Operating System Information
Windows Vista Home Basic 32-bit (Build 6.00.6000)
UAC On - Limited User (Administrator User)

Memory items scanned      : 698
Memory threats detected  : 0
Registry items scanned    : 26854
Registry threats detected : 0
File items scanned        : 7133
File threats detected    : 108

Adware.Tracking Cookie
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\helmut@atdmt[1].txt [ Cookie:helmut@atdmt.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\helmut@windowsmedia[1].txt [ Cookie:helmut@windowsmedia.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@doubleclick[2].txt [ Cookie:helmut@doubleclick.net/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@imrworldwide[2].txt [ Cookie:helmut@imrworldwide.com/cgi-bin ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@mediaplex[1].txt [ Cookie:helmut@mediaplex.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@casalemedia[2].txt [ Cookie:helmut@casalemedia.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@2o7[2].txt [ Cookie:helmut@2o7.net/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@adultfriendfinder[1].txt [ Cookie:helmut@adultfriendfinder.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@partners.webmasterplan[1].txt [ Cookie:helmut@partners.webmasterplan.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@komtrack[2].txt [ Cookie:helmut@komtrack.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adtech[1].txt [ Cookie:rita@adtech.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@bs.serving-sys[2].txt [ Cookie:rita@bs.serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@zedo[2].txt [ Cookie:rita@zedo.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tribalfusion[2].txt [ Cookie:rita@tribalfusion.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@zanox-affiliate[2].txt [ Cookie:rita@zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@accounts.google[1].txt [ Cookie:rita@accounts.google.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@atdmt[2].txt [ Cookie:rita@atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@imrworldwide[2].txt [ Cookie:rita@imrworldwide.com/cgi-bin ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@www.active-tracking[1].txt [ Cookie:rita@www.active-tracking.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@serving-sys[2].txt [ Cookie:rita@serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tracking.quisma[2].txt [ Cookie:rita@tracking.quisma.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@track.effiliation[2].txt [ Cookie:rita@track.effiliation.com/servlet/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@fastclick[1].txt [ Cookie:rita@fastclick.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adfarm1.adition[1].txt [ Cookie:rita@adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@track.adform[2].txt [ Cookie:rita@track.adform.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adformdsp[1].txt [ Cookie:rita@adformdsp.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@microsoftwllivemkt.112.2o7[1].txt [ Cookie:rita@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tacoda.at.atwola[1].txt [ Cookie:rita@tacoda.at.atwola.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tradedoubler[2].txt [ Cookie:rita@tradedoubler.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@www.google[1].txt [ Cookie:rita@www.google.de/accounts ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@www.zanox-affiliate[1].txt [ Cookie:rita@www.zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@server.adform[2].txt [ Cookie:rita@server.adform.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@h.atdmt[2].txt [ Cookie:rita@h.atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@smartadserver[2].txt [ Cookie:rita@smartadserver.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@invitemedia[2].txt [ Cookie:rita@invitemedia.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@ad1.adfarm1.adition[2].txt [ Cookie:rita@ad1.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@apmebf[2].txt [ Cookie:rita@apmebf.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@msnportal.112.2o7[1].txt [ Cookie:rita@msnportal.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@zanox[2].txt [ Cookie:rita@zanox.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@advertising[1].txt [ Cookie:rita@advertising.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@ar.atwola[1].txt [ Cookie:rita@ar.atwola.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@ad2.adfarm1.adition[1].txt [ Cookie:rita@ad2.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adform[1].txt [ Cookie:rita@adform.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@webmasterplan[2].txt [ Cookie:rita@webmasterplan.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@adtech[1].txt [ Cookie:rita@adtech.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@bs.serving-sys[2].txt [ Cookie:rita@bs.serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@zanox-affiliate[2].txt [ Cookie:rita@zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@atdmt[2].txt [ Cookie:rita@atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@revsci[2].txt [ Cookie:rita@revsci.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@content.yieldmanager[2].txt [ Cookie:rita@content.yieldmanager.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@imrworldwide[2].txt [ Cookie:rita@imrworldwide.com/cgi-bin ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@serving-sys[2].txt [ Cookie:rita@serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@rotator.adjuggler[1].txt [ Cookie:rita@rotator.adjuggler.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@tracking.quisma[2].txt [ Cookie:rita@tracking.quisma.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@2o7[1].txt [ Cookie:rita@2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@adfarm1.adition[2].txt [ Cookie:rita@adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@microsoftwllivemkt.112.2o7[1].txt [ Cookie:rita@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@de.sitestat[1].txt [ Cookie:rita@de.sitestat.com/ing-diba/de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@unitymedia[1].txt [ Cookie:rita@unitymedia.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@tradedoubler[1].txt [ Cookie:rita@tradedoubler.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@weborama[1].txt [ Cookie:rita@weborama.fr/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@www.zanox-affiliate[1].txt [ Cookie:rita@www.zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@h.atdmt[2].txt [ Cookie:rita@h.atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@invitemedia[2].txt [ Cookie:rita@invitemedia.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@ad1.adfarm1.adition[2].txt [ Cookie:rita@ad1.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@msnportal.112.2o7[1].txt [ Cookie:rita@msnportal.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@vdwp.solution.weborama[2].txt [ Cookie:rita@vdwp.solution.weborama.fr/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@zanox[2].txt [ Cookie:rita@zanox.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@microsoftwlsearchcrm.112.2o7[1].txt [ Cookie:rita@microsoftwlsearchcrm.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@ad.adition[1].txt [ Cookie:rita@ad.adition.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@adsrv.admediate[1].txt [ Cookie:rita@adsrv.admediate.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@ad2.adfarm1.adition[2].txt [ Cookie:rita@ad2.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@webmasterplan[1].txt [ Cookie:rita@webmasterplan.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@apmebf[1].txt [ Cookie:rita@apmebf.com/ ]
        C:\USERS\RITA\Cookies\rita@adtech[1].txt [ Cookie:rita@adtech.de/ ]
        C:\USERS\RITA\Cookies\rita@bs.serving-sys[2].txt [ Cookie:rita@bs.serving-sys.com/ ]
        C:\USERS\RITA\Cookies\rita@zedo[2].txt [ Cookie:rita@zedo.com/ ]
        C:\USERS\RITA\Cookies\rita@tribalfusion[2].txt [ Cookie:rita@tribalfusion.com/ ]
        C:\USERS\RITA\Cookies\rita@zanox-affiliate[2].txt [ Cookie:rita@zanox-affiliate.de/ ]
        C:\USERS\RITA\Cookies\rita@accounts.google[1].txt [ Cookie:rita@accounts.google.com/ ]
        C:\USERS\RITA\Cookies\rita@atdmt[2].txt [ Cookie:rita@atdmt.com/ ]
        C:\USERS\RITA\Cookies\rita@imrworldwide[2].txt [ Cookie:rita@imrworldwide.com/cgi-bin ]
        C:\USERS\RITA\Cookies\rita@www.active-tracking[1].txt [ Cookie:rita@www.active-tracking.de/ ]
        C:\USERS\RITA\Cookies\rita@serving-sys[2].txt [ Cookie:rita@serving-sys.com/ ]
        C:\USERS\RITA\Cookies\rita@tracking.quisma[2].txt [ Cookie:rita@tracking.quisma.com/ ]
        C:\USERS\RITA\Cookies\rita@track.effiliation[2].txt [ Cookie:rita@track.effiliation.com/servlet/ ]
        C:\USERS\RITA\Cookies\rita@fastclick[1].txt [ Cookie:rita@fastclick.net/ ]
        C:\USERS\RITA\Cookies\rita@adfarm1.adition[1].txt [ Cookie:rita@adfarm1.adition.com/ ]
        C:\USERS\RITA\Cookies\rita@track.adform[2].txt [ Cookie:rita@track.adform.net/ ]
        C:\USERS\RITA\Cookies\rita@adformdsp[1].txt [ Cookie:rita@adformdsp.net/ ]
        C:\USERS\RITA\Cookies\rita@microsoftwllivemkt.112.2o7[1].txt [ Cookie:rita@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\RITA\Cookies\rita@tacoda.at.atwola[1].txt [ Cookie:rita@tacoda.at.atwola.com/ ]
        C:\USERS\RITA\Cookies\rita@tradedoubler[2].txt [ Cookie:rita@tradedoubler.com/ ]
        C:\USERS\RITA\Cookies\rita@www.google[1].txt [ Cookie:rita@www.google.de/accounts ]
        C:\USERS\RITA\Cookies\rita@www.zanox-affiliate[1].txt [ Cookie:rita@www.zanox-affiliate.de/ ]
        C:\USERS\RITA\Cookies\rita@server.adform[2].txt [ Cookie:rita@server.adform.net/ ]
        C:\USERS\RITA\Cookies\rita@h.atdmt[2].txt [ Cookie:rita@h.atdmt.com/ ]
        C:\USERS\RITA\Cookies\rita@smartadserver[2].txt [ Cookie:rita@smartadserver.com/ ]
        C:\USERS\RITA\Cookies\rita@invitemedia[2].txt [ Cookie:rita@invitemedia.com/ ]
        C:\USERS\RITA\Cookies\rita@ad1.adfarm1.adition[2].txt [ Cookie:rita@ad1.adfarm1.adition.com/ ]
        C:\USERS\RITA\Cookies\rita@apmebf[2].txt [ Cookie:rita@apmebf.com/ ]
        C:\USERS\RITA\Cookies\rita@msnportal.112.2o7[1].txt [ Cookie:rita@msnportal.112.2o7.net/ ]
        C:\USERS\RITA\Cookies\rita@zanox[2].txt [ Cookie:rita@zanox.com/ ]
        C:\USERS\RITA\Cookies\rita@advertising[1].txt [ Cookie:rita@advertising.com/ ]
        C:\USERS\RITA\Cookies\rita@ar.atwola[1].txt [ Cookie:rita@ar.atwola.com/ ]
        C:\USERS\RITA\Cookies\rita@ad2.adfarm1.adition[1].txt [ Cookie:rita@ad2.adfarm1.adition.com/ ]
        C:\USERS\RITA\Cookies\rita@adform[1].txt [ Cookie:rita@adform.net/ ]
        C:\USERS\RITA\Cookies\rita@webmasterplan[2].txt [ Cookie:rita@webmasterplan.com/ ]

cosinus 26.06.2012 18:21
Code:
Scan type      : Quick Scan
Das war leider KEIN Vollscan (Complete Scan) mit superantispyware ...

012 055-0 26.06.2012 19:02
OK, mache ich.
Nach Superspyware Anleitung sollte es ein Quickscan sein, Du wolltest Vollscan.
Männer können nur eines gleichzeitig ;-) ...

...anbei MWB Scan.

Grüße
Helmut

Code:

Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.26.07

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.17037
Helmut :: HELMUT-PC [Administrator]

Schutz: Aktiviert

26.06.2012 19:03:16
mbam-log-2012-06-26 (19-03-16).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 239245
Laufzeit: 5 Minute(n), 33 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 26.06.2012 19:22
Ich wollte vollständig Kontrollscans sehen! Mit SASW und Malwarebytes!
Was soll ich denn jetzt mit dem Quickscan von Malwarebytes?
Mit beiden Programmen bitte Vollscans machen!

012 055-0 26.06.2012 21:10
Ja, sorry, hatte es einfach überlesen und nach den Einzelanleitungen gearbeitet; da steht Quickscan.

Hier schon mal einer
Code:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/26/2012 at 10:06 PM

Application Version : 5.1.1002

Core Rules Database Version : 8798
Trace Rules Database Version: 6610

Scan type      : Complete Scan
Total Scan Time : 02:01:05

Operating System Information
Windows Vista Home Basic 32-bit (Build 6.00.6000)
UAC On - Limited User (Administrator User)

Memory items scanned      : 674
Memory threats detected  : 0
Registry items scanned    : 33118
Registry threats detected : 0
File items scanned        : 111106
File threats detected    : 219

Adware.Tracking Cookie
        C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Cookies\helmut@apmebf[1].txt [ /apmebf ]
        C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Cookies\helmut@doubleclick[1].txt [ /doubleclick ]
        C:\USERS\HELMUT\Cookies\helmut@doubleclick[1].txt [ Cookie:helmut@doubleclick.net/ ]
        C:\USERS\HELMUT\Cookies\helmut@apmebf[1].txt [ Cookie:helmut@apmebf.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\helmut@atdmt[1].txt [ Cookie:helmut@atdmt.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\helmut@windowsmedia[1].txt [ Cookie:helmut@windowsmedia.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@doubleclick[2].txt [ Cookie:helmut@doubleclick.net/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@imrworldwide[2].txt [ Cookie:helmut@imrworldwide.com/cgi-bin ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@mediaplex[1].txt [ Cookie:helmut@mediaplex.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@casalemedia[2].txt [ Cookie:helmut@casalemedia.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@2o7[2].txt [ Cookie:helmut@2o7.net/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@adultfriendfinder[1].txt [ Cookie:helmut@adultfriendfinder.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@partners.webmasterplan[1].txt [ Cookie:helmut@partners.webmasterplan.com/ ]
        C:\USERS\HELMUT.HELMUT-PC\AppData\Roaming\Microsoft\Windows\Cookies\Low\helmut@komtrack[2].txt [ Cookie:helmut@komtrack.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adtech[1].txt [ Cookie:rita@adtech.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@bs.serving-sys[2].txt [ Cookie:rita@bs.serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@zedo[2].txt [ Cookie:rita@zedo.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tribalfusion[2].txt [ Cookie:rita@tribalfusion.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@zanox-affiliate[2].txt [ Cookie:rita@zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@accounts.google[1].txt [ Cookie:rita@accounts.google.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@atdmt[2].txt [ Cookie:rita@atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@imrworldwide[2].txt [ Cookie:rita@imrworldwide.com/cgi-bin ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@www.active-tracking[1].txt [ Cookie:rita@www.active-tracking.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@serving-sys[2].txt [ Cookie:rita@serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tracking.quisma[2].txt [ Cookie:rita@tracking.quisma.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@track.effiliation[2].txt [ Cookie:rita@track.effiliation.com/servlet/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@fastclick[1].txt [ Cookie:rita@fastclick.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adfarm1.adition[1].txt [ Cookie:rita@adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@track.adform[2].txt [ Cookie:rita@track.adform.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adformdsp[1].txt [ Cookie:rita@adformdsp.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@microsoftwllivemkt.112.2o7[1].txt [ Cookie:rita@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tacoda.at.atwola[1].txt [ Cookie:rita@tacoda.at.atwola.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@tradedoubler[2].txt [ Cookie:rita@tradedoubler.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@www.google[1].txt [ Cookie:rita@www.google.de/accounts ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@www.zanox-affiliate[1].txt [ Cookie:rita@www.zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@server.adform[2].txt [ Cookie:rita@server.adform.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@h.atdmt[2].txt [ Cookie:rita@h.atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@smartadserver[2].txt [ Cookie:rita@smartadserver.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@invitemedia[2].txt [ Cookie:rita@invitemedia.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@ad1.adfarm1.adition[2].txt [ Cookie:rita@ad1.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@apmebf[2].txt [ Cookie:rita@apmebf.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@msnportal.112.2o7[1].txt [ Cookie:rita@msnportal.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@zanox[2].txt [ Cookie:rita@zanox.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@advertising[1].txt [ Cookie:rita@advertising.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@ar.atwola[1].txt [ Cookie:rita@ar.atwola.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@ad2.adfarm1.adition[1].txt [ Cookie:rita@ad2.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@adform[1].txt [ Cookie:rita@adform.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\rita@webmasterplan[2].txt [ Cookie:rita@webmasterplan.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@adtech[1].txt [ Cookie:rita@adtech.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@bs.serving-sys[2].txt [ Cookie:rita@bs.serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@zanox-affiliate[2].txt [ Cookie:rita@zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@atdmt[2].txt [ Cookie:rita@atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@revsci[2].txt [ Cookie:rita@revsci.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@content.yieldmanager[2].txt [ Cookie:rita@content.yieldmanager.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@imrworldwide[2].txt [ Cookie:rita@imrworldwide.com/cgi-bin ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@serving-sys[2].txt [ Cookie:rita@serving-sys.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@rotator.adjuggler[1].txt [ Cookie:rita@rotator.adjuggler.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@tracking.quisma[2].txt [ Cookie:rita@tracking.quisma.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@2o7[1].txt [ Cookie:rita@2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@adfarm1.adition[2].txt [ Cookie:rita@adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@microsoftwllivemkt.112.2o7[1].txt [ Cookie:rita@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@de.sitestat[1].txt [ Cookie:rita@de.sitestat.com/ing-diba/de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@unitymedia[1].txt [ Cookie:rita@unitymedia.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@tradedoubler[1].txt [ Cookie:rita@tradedoubler.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@weborama[1].txt [ Cookie:rita@weborama.fr/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@www.zanox-affiliate[1].txt [ Cookie:rita@www.zanox-affiliate.de/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@h.atdmt[2].txt [ Cookie:rita@h.atdmt.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@invitemedia[2].txt [ Cookie:rita@invitemedia.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@ad1.adfarm1.adition[2].txt [ Cookie:rita@ad1.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@msnportal.112.2o7[1].txt [ Cookie:rita@msnportal.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@vdwp.solution.weborama[2].txt [ Cookie:rita@vdwp.solution.weborama.fr/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@zanox[2].txt [ Cookie:rita@zanox.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@microsoftwlsearchcrm.112.2o7[1].txt [ Cookie:rita@microsoftwlsearchcrm.112.2o7.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@ad.adition[1].txt [ Cookie:rita@ad.adition.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@adsrv.admediate[1].txt [ Cookie:rita@adsrv.admediate.net/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@ad2.adfarm1.adition[2].txt [ Cookie:rita@ad2.adfarm1.adition.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@webmasterplan[1].txt [ Cookie:rita@webmasterplan.com/ ]
        C:\USERS\RITA\AppData\Roaming\Microsoft\Windows\Cookies\Low\rita@apmebf[1].txt [ Cookie:rita@apmebf.com/ ]
        C:\USERS\RITA\Cookies\rita@adtech[1].txt [ Cookie:rita@adtech.de/ ]
        C:\USERS\RITA\Cookies\rita@bs.serving-sys[2].txt [ Cookie:rita@bs.serving-sys.com/ ]
        C:\USERS\RITA\Cookies\rita@zedo[2].txt [ Cookie:rita@zedo.com/ ]
        C:\USERS\RITA\Cookies\rita@tribalfusion[2].txt [ Cookie:rita@tribalfusion.com/ ]
        C:\USERS\RITA\Cookies\rita@zanox-affiliate[2].txt [ Cookie:rita@zanox-affiliate.de/ ]
        C:\USERS\RITA\Cookies\rita@accounts.google[1].txt [ Cookie:rita@accounts.google.com/ ]
        C:\USERS\RITA\Cookies\rita@atdmt[2].txt [ Cookie:rita@atdmt.com/ ]
        C:\USERS\RITA\Cookies\rita@imrworldwide[2].txt [ Cookie:rita@imrworldwide.com/cgi-bin ]
        C:\USERS\RITA\Cookies\rita@www.active-tracking[1].txt [ Cookie:rita@www.active-tracking.de/ ]
        C:\USERS\RITA\Cookies\rita@serving-sys[2].txt [ Cookie:rita@serving-sys.com/ ]
        C:\USERS\RITA\Cookies\rita@tracking.quisma[2].txt [ Cookie:rita@tracking.quisma.com/ ]
        C:\USERS\RITA\Cookies\rita@track.effiliation[2].txt [ Cookie:rita@track.effiliation.com/servlet/ ]
        C:\USERS\RITA\Cookies\rita@fastclick[1].txt [ Cookie:rita@fastclick.net/ ]
        C:\USERS\RITA\Cookies\rita@adfarm1.adition[1].txt [ Cookie:rita@adfarm1.adition.com/ ]
        C:\USERS\RITA\Cookies\rita@track.adform[2].txt [ Cookie:rita@track.adform.net/ ]
        C:\USERS\RITA\Cookies\rita@adformdsp[1].txt [ Cookie:rita@adformdsp.net/ ]
        C:\USERS\RITA\Cookies\rita@microsoftwllivemkt.112.2o7[1].txt [ Cookie:rita@microsoftwllivemkt.112.2o7.net/ ]
        C:\USERS\RITA\Cookies\rita@tacoda.at.atwola[1].txt [ Cookie:rita@tacoda.at.atwola.com/ ]
        C:\USERS\RITA\Cookies\rita@tradedoubler[2].txt [ Cookie:rita@tradedoubler.com/ ]
        C:\USERS\RITA\Cookies\rita@www.google[1].txt [ Cookie:rita@www.google.de/accounts ]
        C:\USERS\RITA\Cookies\rita@www.zanox-affiliate[1].txt [ Cookie:rita@www.zanox-affiliate.de/ ]
        C:\USERS\RITA\Cookies\rita@server.adform[2].txt [ Cookie:rita@server.adform.net/ ]
        C:\USERS\RITA\Cookies\rita@h.atdmt[2].txt [ Cookie:rita@h.atdmt.com/ ]
        C:\USERS\RITA\Cookies\rita@smartadserver[2].txt [ Cookie:rita@smartadserver.com/ ]
        C:\USERS\RITA\Cookies\rita@invitemedia[2].txt [ Cookie:rita@invitemedia.com/ ]
        C:\USERS\RITA\Cookies\rita@ad1.adfarm1.adition[2].txt [ Cookie:rita@ad1.adfarm1.adition.com/ ]
        C:\USERS\RITA\Cookies\rita@apmebf[2].txt [ Cookie:rita@apmebf.com/ ]
        C:\USERS\RITA\Cookies\rita@msnportal.112.2o7[1].txt [ Cookie:rita@msnportal.112.2o7.net/ ]
        C:\USERS\RITA\Cookies\rita@zanox[2].txt [ Cookie:rita@zanox.com/ ]
        C:\USERS\RITA\Cookies\rita@advertising[1].txt [ Cookie:rita@advertising.com/ ]
        C:\USERS\RITA\Cookies\rita@ar.atwola[1].txt [ Cookie:rita@ar.atwola.com/ ]
        C:\USERS\RITA\Cookies\rita@ad2.adfarm1.adition[1].txt [ Cookie:rita@ad2.adfarm1.adition.com/ ]
        C:\USERS\RITA\Cookies\rita@adform[1].txt [ Cookie:rita@adform.net/ ]
        C:\USERS\RITA\Cookies\rita@webmasterplan[2].txt [ Cookie:rita@webmasterplan.com/ ]
        C:\USERS\HELMUT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\HELMUT@ADFARM1.ADITION[2].TXT [ /ADFARM1.ADITION ]
        C:\USERS\HELMUT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\HELMUT@APMEBF[2].TXT [ /APMEBF ]
        C:\USERS\HELMUT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\HELMUT@MEDIAPLEX[2].TXT [ /MEDIAPLEX ]
        C:\USERS\HELMUT\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\HELMUT@AD1.ADFARM1.ADITION[1].TXT [ /AD1.ADFARM1.ADITION ]
        banners.securedataimages.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        bc.youporn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        bigtitsporn.sluthaven.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        cdn.pornsharia.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        cdn1.static.pornhub.phncdn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        cdn1.static1.pornrabbit.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        chat.hornypharaoh.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        data-ero-advertising.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        delivery.ibanner.de [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        eu.flash.xxxbunker.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        files.youporn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        flash.xxxbunker.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        flv.pornhoc.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        flvtools.spacash.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        fuckvidzpro.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        googleads.g.doubleclick.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        img.porncitadel.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        ledfuck.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        macromedia.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        media.adxpansion.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        media.tattomedia.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        media1.shufuni.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        s.hotpornshow.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        static.eporner.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        static.youporn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        staticedge.hardsextube.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        theclassicporn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        videos.allelitepass.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        vidii.hardsextube.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        watch2porn.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.adserv3.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.adservercentral.info [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.ahairytube.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.azpornstars.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.bangpornvideos.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.dearsex.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.deutschsexfilme.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.directporntube.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.free-pornvideo.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.freepornsexx.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.germansexvideo.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.germanypornos.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.hdgratisporno.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.homesexdaily.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.hornypharaoh.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.lozporn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.maxpornsite.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.mofosex.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.naiadsystems.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.nakedonthestreets.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.oosex.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.plug-media.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornative.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornbangs.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornerbros.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornkiste.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornme.in [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornscreen.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornstv.org [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.porntubefeed.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornvideowatch.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornvix.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornxix.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.pornyeah.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.realgfporn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.sextube.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.theclassicporn.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.tubexxxtra.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.worldsexvideos.net [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.xxxpornoworld.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.xxxymovies.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.youpornvid.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        www.yourpornjizz.com [ C:\USERS\HELMUT\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\TBFEBB9Y ]
        C:\USERS\HELMUT.HELMUT-PC\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\HELMUT@SEXLIST[1].TXT [ /SEXLIST ]
        imagesrv.adition.com [ C:\USERS\RITA\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\QCFC4PDH ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@SPECIFICCLICK[1].TXT [ /SPECIFICCLICK ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@MEDIAPLEX[1].TXT [ /MEDIAPLEX ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@WWW.ETRACKER[1].TXT [ /WWW.ETRACKER ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@AD.AD-SRV[1].TXT [ /AD.AD-SRV ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@AD3.ADFARM1.ADITION[1].TXT [ /AD3.ADFARM1.ADITION ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@MEDIA6DEGREES[2].TXT [ /MEDIA6DEGREES ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@AD.WSOD[2].TXT [ /AD.WSOD ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@AD.DYNTRACKER[1].TXT [ /AD.DYNTRACKER ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@AD.ZANOX[2].TXT [ /AD.ZANOX ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\LOW\RITA@TRAFFICTRACK[1].TXT [ /TRAFFICTRACK ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@MEDIAPLEX[1].TXT [ /MEDIAPLEX ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@AD.DYNTRACKER[1].TXT [ /AD.DYNTRACKER ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@WWW.ETRACKER[1].TXT [ /WWW.ETRACKER ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@AD.YIELDMANAGER[2].TXT [ /AD.YIELDMANAGER ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@ADS.PUBMATIC[1].TXT [ /ADS.PUBMATIC ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@AT.ATWOLA[2].TXT [ /AT.ATWOLA ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@TRAFFICTRACK[1].TXT [ /TRAFFICTRACK ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@AD.AD-SRV[1].TXT [ /AD.AD-SRV ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@AD.ZANOX[1].TXT [ /AD.ZANOX ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@C.ATDMT[2].TXT [ /C.ATDMT ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@DOUBLECLICK[1].TXT [ /DOUBLECLICK ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@INSIGHTEXPRESSAI[1].TXT [ /INSIGHTEXPRESSAI ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@QUESTIONMARKET[2].TXT [ /QUESTIONMARKET ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@SERVER.ADFORMDSP[1].TXT [ /SERVER.ADFORMDSP ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@TRACK.EFFILIATION[1].TXT [ /TRACK.EFFILIATION ]
        C:\USERS\RITA\APPDATA\ROAMING\MICROSOFT\WINDOWS\COOKIES\RITA@TRACKING.MLSAT02[1].TXT [ /TRACKING.MLSAT02 ]
Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.26.07

Windows Vista x86 NTFS
Internet Explorer 7.0.6000.17037
Helmut :: HELMUT-PC [Administrator]

Schutz: Aktiviert

26.06.2012 22:12:32
mbam-log-2012-06-26 (22-12-32).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 339573
Laufzeit: 50 Minute(n), 23 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus 27.06.2012 12:33
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

012 055-0 27.06.2012 14:18
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo,

bis auf die "run.dll" (siehe Bild) kann ich nichts Weiteres feststellen.
Vielen Dank schon mal.

Was soll ich denn mit der ganzen Software, die ich jetzt geladen habe, weiterhin machen? MWB läuft ja in 5 Tagen ab.
Eines ist klar, Antivir alleine reicht nach der Erfahrung ja nicht aus...
...und wenns möglich ist, die run.dll nervt halt ein bisschen, andererseits ist sie eine gute Mahnung, also....

Viele Grüße
Helmut

cosinus 28.06.2012 09:36
Das ist nur ein verwaister Eintrag, machen wir mit OTL weg

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

012 055-0 28.06.2012 21:32
Hallo,
so, hier ist das OTL Log.
Was mache ich denn mit den Schädlingen, die bei einigen Programmen in Quarantäne geschickt wurden?

Noch mal danke + Grüße
Helmut

OTL Logfile:
Code:
OTL logfile created on: 28.06.2012 21:51:46 - Run 3
OTL by OldTimer - Version 3.2.53.0    Folder = C:\Users\Helmut\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
958,06 Mb Total Physical Memory | 214,92 Mb Available Physical Memory | 22,43% Memory free
2,12 Gb Paging File | 1,07 Gb Available in Paging File | 50,25% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 147,04 Gb Total Space | 65,82 Gb Free Space | 44,76% Space Free | Partition Type: NTFS
 
Computer Name: HELMUT-PC | User Name: Helmut | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.28 21:48:45 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
PRC - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 17:45:46 | 000,613,328 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\update.exe
PRC - [2012.05.08 17:45:46 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 17:45:46 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.08 17:45:46 | 000,047,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\updrgui.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.09.01 14:39:54 | 000,966,712 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
PRC - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe
PRC - [2011.06.16 14:09:48 | 000,135,168 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe
PRC - [2011.06.14 17:42:26 | 001,540,096 | ---- | M] (Nokia) -- C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe
PRC - [2011.06.08 14:49:48 | 000,159,744 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
PRC - [2008.03.28 15:39:26 | 000,171,448 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
PRC - [2007.02.15 11:04:56 | 000,282,624 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
PRC - [2007.02.04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Programme\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
PRC - [2006.12.22 07:29:56 | 000,067,752 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Elements 5.0\apdproxy.exe
PRC - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2006.11.02 14:34:59 | 000,201,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.01 14:38:32 | 000,931,896 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Maps Service API.dll
MOD - [2011.09.01 14:37:50 | 010,837,504 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtWebKit4.dll
MOD - [2011.09.01 14:37:50 | 000,913,920 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtNetwork4.dll
MOD - [2011.09.01 14:37:50 | 000,416,256 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\sqldrivers\qsqlite4.dll
MOD - [2011.09.01 14:37:50 | 000,196,608 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qjpeg4.dll
MOD - [2011.09.01 14:37:50 | 000,026,624 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qgif4.dll
MOD - [2011.09.01 14:37:48 | 008,166,912 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtGui4.dll
MOD - [2011.09.01 14:37:48 | 002,551,296 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXmlPatterns4.dll
MOD - [2011.09.01 14:37:48 | 002,282,496 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtCore4.dll
MOD - [2011.09.01 14:37:48 | 002,246,656 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtDeclarative4.dll
MOD - [2011.09.01 14:37:48 | 001,288,192 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtScript4.dll
MOD - [2011.09.01 14:37:48 | 000,676,864 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtOpenGL4.dll
MOD - [2011.09.01 14:37:48 | 000,340,480 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXml4.dll
MOD - [2011.09.01 14:37:48 | 000,266,752 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\phonon4.dll
MOD - [2011.09.01 14:37:48 | 000,190,464 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtSql4.dll
MOD - [2011.09.01 14:08:58 | 000,508,416 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtMultimediaKit1.dll
MOD - [2011.09.01 14:08:56 | 000,109,568 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\mediaservice\dsengine.dll
MOD - [2011.09.01 14:08:18 | 000,378,880 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtCore.dll
MOD - [2011.09.01 14:08:18 | 000,159,232 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtWeb.dll
MOD - [2011.09.01 14:08:16 | 000,089,088 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\qjson.dll
MOD - [2011.09.01 14:08:14 | 000,392,080 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\ssoengine.dll
MOD - [2011.09.01 14:08:14 | 000,387,976 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\OviShareLib.dll
MOD - [2011.09.01 14:08:14 | 000,058,768 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\securestorage.dll
MOD - [2011.09.01 14:07:04 | 000,727,552 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\CommonUpdateChecker.dll
MOD - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
MOD - [2005.07.20 11:48:10 | 000,059,904 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\zlib1.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
SRV - [2008.01.02 23:31:09 | 000,265,912 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0)
SRV - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Helmut\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.05.08 17:45:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 17:45:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011.05.18 10:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011.05.18 10:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011.05.18 10:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011.05.18 10:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007.05.09 17:33:00 | 000,048,640 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006.10.14 05:04:33 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.10.09 15:03:56 | 000,017,152 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX)
DRV - [2006.10.09 14:46:44 | 000,017,536 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.drehscheibe-online.de/
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.09.08 20:25:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.09.08 20:25:51 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2012.06.25 20:28:50 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O3 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\.DEFAULT..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-18..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [BrowserChoice] C:\Windows\System32\browserchoice.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: drehscheibe-online.de ([www] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: olb.de ([www] * in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: privatbahnforum.de ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} https://www.olb.de/olb_fb3_1867b/plugin/AXFOAM.CAB (B+S Banksysteme AG DDBAC Plug-In)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E45CACCA-FE12-4220-A739-E4ECD74A176F}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: !SASCORE - C:\Programme\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.26 16:33:58 | 000,000,000 | ---D | C] -- C:\Users\Helmut\AppData\Roaming\SUPERAntiSpyware.com
[2012.06.26 16:33:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.06.26 16:33:43 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.06.26 16:33:43 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.06.26 16:31:40 | 017,963,072 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\Helmut\Desktop\SUPERAntiSpyware.exe
[2012.06.25 23:40:45 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.06.25 23:28:29 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Helmut\Desktop\aswMBR.exe
[2012.06.25 23:18:24 | 000,000,000 | ---D | C] -- C:\Users\Helmut\Desktop\osam_autorun_manager_5_0_portable
[2012.06.25 23:13:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.06.25 23:13:47 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.06.25 20:33:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.06.25 20:33:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.06.25 20:12:37 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.06.25 20:12:37 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.06.25 20:12:37 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2012.06.25 20:12:37 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.06.25 20:12:25 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.06.25 20:12:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.06.25 20:11:45 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.06.25 20:08:08 | 004,568,224 | R--- | C] (Swearware) -- C:\Users\Helmut\Desktop\ComboFix.exe
[2012.06.24 20:23:57 | 002,128,472 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Helmut\Desktop\tdsskiller.exe
[2012.06.21 21:43:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.18 20:16:20 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.18 18:48:48 | 000,000,000 | ---D | C] -- C:\Users\Helmut\AppData\Roaming\Malwarebytes
[2012.06.18 18:48:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.18 18:48:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.18 18:48:38 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.18 18:48:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.18 14:52:54 | 000,000,000 | ---D | C] -- C:\T-Online
[2009.01.04 18:54:39 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Helmut\AppData\Roaming\pcouffin.sys
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.28 21:48:45 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.28 21:44:30 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 21:44:29 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 21:44:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.28 21:44:15 | 1005,244,416 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.27 15:21:36 | 000,651,112 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.27 15:21:36 | 000,618,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.27 15:21:36 | 000,120,908 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.27 15:21:36 | 000,107,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.26 16:33:48 | 000,001,806 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.06.26 16:32:17 | 017,963,072 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Helmut\Desktop\SUPERAntiSpyware.exe
[2012.06.26 16:25:38 | 000,002,517 | ---- | M] () -- C:\Users\Helmut\Desktop\Microsoft Office Picture Manager.lnk
[2012.06.25 23:47:11 | 000,000,512 | ---- | M] () -- C:\Users\Helmut\Desktop\MBR.dat
[2012.06.25 23:40:45 | 269,741,338 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.06.25 23:28:37 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Helmut\Desktop\aswMBR.exe
[2012.06.25 23:07:06 | 004,272,474 | ---- | M] () -- C:\Users\Helmut\Desktop\osam_autorun_manager_5_0_portable.rar
[2012.06.25 20:28:50 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.06.25 20:08:09 | 004,568,224 | R--- | M] (Swearware) -- C:\Users\Helmut\Desktop\ComboFix.exe
[2012.06.24 20:24:04 | 002,128,472 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Helmut\Desktop\tdsskiller.exe
[2012.06.22 12:44:29 | 000,002,609 | ---- | M] () -- C:\Users\Helmut\Desktop\Microsoft Office Word 2003.lnk
[2012.06.18 20:44:51 | 000,302,592 | ---- | M] () -- C:\Users\Helmut\Desktop\vnwfey1h.exe
[2012.06.18 20:14:08 | 000,000,000 | ---- | M] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 18:48:40 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:31:47 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.06.18 15:30:07 | 000,000,680 | ---- | M] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
 
========== Files Created - No Company Name ==========
 
[2012.06.26 16:33:48 | 000,001,806 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.06.25 23:47:11 | 000,000,512 | ---- | C] () -- C:\Users\Helmut\Desktop\MBR.dat
[2012.06.25 23:39:54 | 269,741,338 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.06.25 23:06:32 | 004,272,474 | ---- | C] () -- C:\Users\Helmut\Desktop\osam_autorun_manager_5_0_portable.rar
[2012.06.25 20:12:37 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.06.25 20:12:37 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.06.25 20:12:37 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.06.25 20:12:37 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.06.25 20:12:37 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.06.18 20:44:50 | 000,302,592 | ---- | C] () -- C:\Users\Helmut\Desktop\vnwfey1h.exe
[2012.06.18 20:14:08 | 000,000,000 | ---- | C] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 18:48:40 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:28:44 | 1005,244,416 | -HS- | C] () -- C:\hiberfil.sys
[2012.06.18 13:43:00 | 000,000,680 | ---- | C] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.06.18 13:39:08 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2010.10.01 20:01:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.11.29 15:23:21 | 000,008,313 | ---- | C] () -- C:\Users\Helmut\.recently-used.xbel
[2009.05.28 20:30:32 | 000,020,531 | -H-- | C] () -- C:\ProgramData\R49LW
[2009.02.25 16:01:54 | 022,200,867 | ---- | C] () -- C:\Users\Helmut\Streckenkarte_A0_Rastedt.jpg
[2009.02.25 16:00:53 | 000,235,911 | ---- | C] () -- C:\Users\Helmut\Streckenkarte NW.jpg
[2009.01.11 21:48:08 | 000,087,608 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\inst.exe
[2009.01.04 18:54:39 | 000,087,608 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\ezpinst.exe
[2009.01.04 18:54:39 | 000,007,887 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\pcouffin.cat
[2009.01.04 18:54:39 | 000,001,144 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\pcouffin.inf
[2008.05.24 11:01:49 | 000,049,152 | ---- | C] () -- C:\Users\Helmut\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.08 13:59:15 | 002,808,832 | ---- | C] () -- C:\Program Files\Common FilesDDBACSetup.msi
[2008.01.01 20:18:41 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.01.01 19:56:20 | 000,000,094 | ---- | C] () -- C:\Users\Helmut\AppData\Local\fusioncache.dat
 
========== LOP Check ==========
 
[2009.05.28 22:08:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Canon
[2008.01.01 20:43:47 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\DataDesign
[2009.11.29 15:23:21 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\gtk-2.0
[2009.07.12 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Lasersoft Imaging
[2009.08.25 22:20:31 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\NewSoft
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia Ovi Suite
[2009.05.28 21:38:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Opera
[2011.10.15 22:25:53 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Packnet
[2011.09.08 21:55:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\PC Suite
[2009.05.28 19:37:02 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ScanSoft
[2008.01.01 19:52:30 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\T-Online
[2009.01.11 21:48:09 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Vso
[2009.05.11 19:50:41 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Zoner
[2008.01.01 19:12:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\DataDesign
[2007.12.29 18:32:34 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\PeerNetworking
[2008.01.01 19:12:40 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\T-Online
[2011.06.12 02:24:46 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\DataDesign
[2009.07.29 11:03:30 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\NewSoft
[2012.06.11 23:32:15 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\PC Suite
[2009.07.29 11:02:46 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\T-Online
[2012.06.27 15:46:30 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.07.01 15:24:06 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Adobe
[2009.05.28 20:27:46 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ArcSoft
[2012.03.31 20:10:50 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Avira
[2009.01.11 18:10:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\AVS4YOU
[2009.05.28 22:08:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Canon
[2008.01.01 20:43:47 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\DataDesign
[2008.01.01 20:21:39 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Google
[2009.11.29 15:23:21 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\gtk-2.0
[2008.01.01 18:50:37 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Identities
[2009.07.12 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Lasersoft Imaging
[2008.01.01 20:02:36 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Macromedia
[2012.06.18 18:48:48 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Malwarebytes
[2011.01.09 00:11:50 | 000,000,000 | --SD | M] -- C:\Users\Helmut\AppData\Roaming\Microsoft
[2009.08.25 22:20:31 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\NewSoft
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia Ovi Suite
[2009.05.28 21:38:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Opera
[2011.10.15 22:25:53 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Packnet
[2011.09.08 21:55:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\PC Suite
[2009.05.28 19:37:02 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ScanSoft
[2010.10.15 15:39:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Skype
[2010.10.15 15:38:52 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\skypePM
[2012.06.26 16:33:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\SUPERAntiSpyware.com
[2008.01.01 19:52:30 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\T-Online
[2008.07.29 17:29:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\vlc
[2009.01.11 21:48:09 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Vso
[2009.05.11 19:50:41 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Zoner
 
< %APPDATA%\*.exe /s >
[2009.01.04 18:54:39 | 000,087,608 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\ezpinst.exe
[2009.01.11 21:48:08 | 000,087,608 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\inst.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\erdnt\cache\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007.05.30 18:21:58 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c2a1b5ae\atapi.sys
[2007.05.30 18:21:58 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=78620BDA3EC87816E5D1FA86F920BC3A -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20518_none_dbd8b4d73d81c9d0\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\erdnt\cache\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\drivers\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2008.02.14 22:48:16 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\erdnt\cache\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\erdnt\cache\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\drivers\nvstor.sys
[2007.01.05 22:59:42 | 000,035,920 | ---- | M] (NVIDIA Corporation) MD5=4A5FCAB82D9BF6AF8A023A66802FE9E9 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_45f67928\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2006.12.22 21:07:10 | 000,093,696 | ---- | M] (NVIDIA Corporation) MD5=5FBF62A83B551F757112B4A0C27432EC -- C:\Fujitsu Siemens Computers\Driver Pool\3\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\erdnt\cache\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.02 23:12:58 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\erdnt\cache\user32.dll
[2008.01.02 23:12:59 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2008.01.02 23:12:58 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.02 23:12:58 | 000,633,856 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\erdnt\cache\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\erdnt\cache\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\erdnt\cache\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\System32\drivers\ws2ifsl.sys
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >

< End of report >
--- --- ---

Hallo,

die "run.dll" ist nach Neustart immer noch da.

Grüße
Helmut

cosinus 29.06.2012 12:03
Zitat:
Was mache ich denn mit den Schädlingen, die bei einigen Programmen in Quarantäne geschickt wurden?
Überleg doch mal was eine Quarantäne ist. Ob da die schädliche Datei drinbleibt oder nicht, das hat keine Auswirkungen. Schädlinge in der Quarantäne können nichts mehr anrichten, sie sind dort isoliert. Du solltest grundsätzlich mit der Quarantäne arbeiten, denn falls der Virenscanner durch einen Fehlalarm was wichtiges löscht, kannst Du notfalls noch über die Quarantäne an die Datei ran.


So richtig seh ich den entsrpechenden Eintrag nicht, mach aber nochmal hiermit einen OTL-Fix

Code:
:OTL
[2012.06.18 13:39:09 | 000,001,722 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.06.18 13:39:08 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2009.05.28 20:30:32 | 000,020,531 | -H-- | C] () -- C:\ProgramData\R49LW
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

012 055-0 02.07.2012 13:33
Hallo,

bin erst jetzt zum Lesen gekommen;
habe neues OTL laut Anweisung gemacht.

Grüße
Helmut

Edit: Nach Neustart ist die "run.dll" immer noch da :-(


Code:
OTL logfile created on: 02.07.2012 14:21:58 - Run 4
OTL by OldTimer - Version 3.2.53.0    Folder = C:\Users\Helmut\Desktop
Windows Vista Home Basic Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
958,06 Mb Total Physical Memory | 292,55 Mb Available Physical Memory | 30,54% Memory free
2,12 Gb Paging File | 1,28 Gb Available in Paging File | 60,22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 147,04 Gb Total Space | 64,44 Gb Free Space | 43,83% Space Free | Partition Type: NTFS
 
Computer Name: HELMUT-PC | User Name: Helmut | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.28 21:48:45 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
PRC - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 17:45:46 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 17:45:46 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.09.01 14:39:54 | 000,966,712 | ---- | M] (Nokia) -- C:\Programme\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe
PRC - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe
PRC - [2011.06.16 14:09:48 | 000,135,168 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclMSBTSrv.exe
PRC - [2011.06.14 17:42:26 | 001,540,096 | ---- | M] (Nokia) -- C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe
PRC - [2011.06.08 14:49:48 | 000,159,744 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
PRC - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
PRC - [2008.03.28 15:39:26 | 000,171,448 | ---- | M] (Google Inc.) -- C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
PRC - [2008.02.22 05:25:21 | 000,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre1.6.0_05\bin\jusched.exe
PRC - [2007.02.15 11:04:56 | 000,282,624 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe
PRC - [2007.02.04 12:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Programme\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
PRC - [2006.12.22 07:29:56 | 000,067,752 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Photoshop Elements 5.0\apdproxy.exe
PRC - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2006.11.02 14:34:59 | 000,201,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
PRC - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.09.01 14:38:32 | 000,931,896 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Maps Service API.dll
MOD - [2011.09.01 14:37:50 | 010,837,504 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtWebKit4.dll
MOD - [2011.09.01 14:37:50 | 000,913,920 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtNetwork4.dll
MOD - [2011.09.01 14:37:50 | 000,416,256 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\sqldrivers\qsqlite4.dll
MOD - [2011.09.01 14:37:50 | 000,196,608 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qjpeg4.dll
MOD - [2011.09.01 14:37:50 | 000,026,624 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\Imageformats\qgif4.dll
MOD - [2011.09.01 14:37:48 | 008,166,912 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtGui4.dll
MOD - [2011.09.01 14:37:48 | 002,551,296 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXmlPatterns4.dll
MOD - [2011.09.01 14:37:48 | 002,282,496 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtCore4.dll
MOD - [2011.09.01 14:37:48 | 002,246,656 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtDeclarative4.dll
MOD - [2011.09.01 14:37:48 | 001,288,192 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtScript4.dll
MOD - [2011.09.01 14:37:48 | 000,676,864 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtOpenGL4.dll
MOD - [2011.09.01 14:37:48 | 000,340,480 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtXml4.dll
MOD - [2011.09.01 14:37:48 | 000,266,752 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\phonon4.dll
MOD - [2011.09.01 14:37:48 | 000,190,464 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtSql4.dll
MOD - [2011.09.01 14:08:58 | 000,508,416 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QtMultimediaKit1.dll
MOD - [2011.09.01 14:08:56 | 000,109,568 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\mediaservice\dsengine.dll
MOD - [2011.09.01 14:08:18 | 000,378,880 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtCore.dll
MOD - [2011.09.01 14:08:18 | 000,159,232 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\QxtWeb.dll
MOD - [2011.09.01 14:08:16 | 000,089,088 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\qjson.dll
MOD - [2011.09.01 14:08:14 | 000,392,080 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\ssoengine.dll
MOD - [2011.09.01 14:08:14 | 000,387,976 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\OviShareLib.dll
MOD - [2011.09.01 14:08:14 | 000,058,768 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\securestorage.dll
MOD - [2011.09.01 14:07:04 | 000,727,552 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\CommonUpdateChecker.dll
MOD - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
MOD - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
MOD - [2005.07.20 11:48:10 | 000,059,904 | ---- | M] () -- C:\Programme\Nokia\Nokia Ovi Suite\zlib1.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.05.08 17:45:47 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 17:45:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE)
SRV - [2011.06.08 13:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Running] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
SRV - [2008.01.02 23:31:09 | 000,265,912 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.12.22 07:31:50 | 000,108,712 | ---- | M] () [Auto | Running] -- C:\Programme\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor5.0)
SRV - [2006.11.02 14:34:59 | 000,895,488 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2003.07.28 13:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Helmut\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.05.08 17:45:47 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 17:45:47 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011.05.18 10:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011.05.18 10:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011.05.18 10:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011.05.18 10:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.08.26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007.05.09 17:33:00 | 000,048,640 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006.10.14 05:04:33 | 004,422,560 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006.10.09 15:03:56 | 000,017,152 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX)
DRV - [2006.10.09 14:46:44 | 000,017,536 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.drehscheibe-online.de/
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SUNA
IE - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.09.08 20:25:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.09.08 20:25:51 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2012.06.25 20:28:50 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O3 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Programme\Google\GoogleToolbar2.dll (Google Germany GmbH)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ToADiMon.exe] C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ()
O4 - HKU\.DEFAULT..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-18..\Run: [InfoCockpit] C:\Program Files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE (Deutsche Telekom AG, T-Com)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [BrowserChoice] C:\Windows\System32\browserchoice.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [NokiaOviSuite2] C:\Program Files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: drehscheibe-online.de ([www] http in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: olb.de ([www] * in Vertrauenswürdige Sites)
O15 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\..Trusted Domains: privatbahnforum.de ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} https://www.olb.de/olb_fb3_1867b/plugin/AXFOAM.CAB (B+S Banksysteme AG DDBAC Plug-In)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E45CACCA-FE12-4220-A739-E4ECD74A176F}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.26 16:33:58 | 000,000,000 | ---D | C] -- C:\Users\Helmut\AppData\Roaming\SUPERAntiSpyware.com
[2012.06.26 16:33:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012.06.26 16:33:43 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012.06.26 16:33:43 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012.06.26 16:31:40 | 017,963,072 | ---- | C] (SUPERAntiSpyware.com) -- C:\Users\Helmut\Desktop\SUPERAntiSpyware.exe
[2012.06.25 23:40:45 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.06.25 23:28:29 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Helmut\Desktop\aswMBR.exe
[2012.06.25 23:18:24 | 000,000,000 | ---D | C] -- C:\Users\Helmut\Desktop\osam_autorun_manager_5_0_portable
[2012.06.25 23:13:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2012.06.25 23:13:47 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2012.06.25 20:33:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.06.25 20:33:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.06.25 20:12:37 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.06.25 20:12:37 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.06.25 20:12:37 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2012.06.25 20:12:37 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.06.25 20:12:25 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012.06.25 20:12:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.06.25 20:11:45 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012.06.25 20:08:08 | 004,568,224 | R--- | C] (Swearware) -- C:\Users\Helmut\Desktop\ComboFix.exe
[2012.06.24 20:23:57 | 002,128,472 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Helmut\Desktop\tdsskiller.exe
[2012.06.21 21:43:01 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.18 20:16:20 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.18 18:48:48 | 000,000,000 | ---D | C] -- C:\Users\Helmut\AppData\Roaming\Malwarebytes
[2012.06.18 18:48:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.18 18:48:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.18 18:48:38 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.18 18:48:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.18 14:52:54 | 000,000,000 | ---D | C] -- C:\T-Online
[2009.01.04 18:54:39 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\Helmut\AppData\Roaming\pcouffin.sys
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.02 14:05:00 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.02 14:05:00 | 000,003,456 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.02 14:04:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.02 14:04:45 | 1005,244,416 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.28 21:48:45 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Helmut\Desktop\OTL.exe
[2012.06.27 15:21:36 | 000,651,112 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.27 15:21:36 | 000,618,272 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.27 15:21:36 | 000,120,908 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.27 15:21:36 | 000,107,416 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.26 16:33:48 | 000,001,806 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.06.26 16:32:17 | 017,963,072 | ---- | M] (SUPERAntiSpyware.com) -- C:\Users\Helmut\Desktop\SUPERAntiSpyware.exe
[2012.06.26 16:25:38 | 000,002,517 | ---- | M] () -- C:\Users\Helmut\Desktop\Microsoft Office Picture Manager.lnk
[2012.06.25 23:47:11 | 000,000,512 | ---- | M] () -- C:\Users\Helmut\Desktop\MBR.dat
[2012.06.25 23:40:45 | 269,741,338 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.06.25 23:28:37 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Helmut\Desktop\aswMBR.exe
[2012.06.25 23:07:06 | 004,272,474 | ---- | M] () -- C:\Users\Helmut\Desktop\osam_autorun_manager_5_0_portable.rar
[2012.06.25 20:28:50 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.06.25 20:08:09 | 004,568,224 | R--- | M] (Swearware) -- C:\Users\Helmut\Desktop\ComboFix.exe
[2012.06.24 20:24:04 | 002,128,472 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Helmut\Desktop\tdsskiller.exe
[2012.06.22 12:44:29 | 000,002,609 | ---- | M] () -- C:\Users\Helmut\Desktop\Microsoft Office Word 2003.lnk
[2012.06.18 20:44:51 | 000,302,592 | ---- | M] () -- C:\Users\Helmut\Desktop\vnwfey1h.exe
[2012.06.18 20:14:08 | 000,000,000 | ---- | M] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 18:48:40 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:31:47 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.06.18 15:30:07 | 000,000,680 | ---- | M] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | M] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
 
========== Files Created - No Company Name ==========
 
[2012.06.26 16:33:48 | 000,001,806 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012.06.25 23:47:11 | 000,000,512 | ---- | C] () -- C:\Users\Helmut\Desktop\MBR.dat
[2012.06.25 23:39:54 | 269,741,338 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.06.25 23:06:32 | 004,272,474 | ---- | C] () -- C:\Users\Helmut\Desktop\osam_autorun_manager_5_0_portable.rar
[2012.06.25 20:12:37 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.06.25 20:12:37 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.06.25 20:12:37 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.06.25 20:12:37 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.06.25 20:12:37 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.06.18 20:44:50 | 000,302,592 | ---- | C] () -- C:\Users\Helmut\Desktop\vnwfey1h.exe
[2012.06.18 20:14:08 | 000,000,000 | ---- | C] () -- C:\Users\Helmut\defogger_reenable
[2012.06.18 18:48:40 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.18 18:28:44 | 1005,244,416 | -HS- | C] () -- C:\hiberfil.sys
[2012.06.18 13:43:00 | 000,000,680 | ---- | C] () -- C:\Users\Helmut\AppData\Local\d3d9caps.dat
[2012.06.18 13:39:09 | 000,001,722 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.06.18 13:39:08 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2010.10.01 20:01:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.11.29 15:23:21 | 000,008,313 | ---- | C] () -- C:\Users\Helmut\.recently-used.xbel
[2009.05.28 20:30:32 | 000,020,531 | -H-- | C] () -- C:\ProgramData\R49LW
[2009.02.25 16:01:54 | 022,200,867 | ---- | C] () -- C:\Users\Helmut\Streckenkarte_A0_Rastedt.jpg
[2009.02.25 16:00:53 | 000,235,911 | ---- | C] () -- C:\Users\Helmut\Streckenkarte NW.jpg
[2009.01.11 21:48:08 | 000,087,608 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\inst.exe
[2009.01.04 18:54:39 | 000,087,608 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\ezpinst.exe
[2009.01.04 18:54:39 | 000,007,887 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\pcouffin.cat
[2009.01.04 18:54:39 | 000,001,144 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\pcouffin.inf
[2008.05.24 11:01:49 | 000,049,152 | ---- | C] () -- C:\Users\Helmut\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.04.08 13:59:15 | 002,808,832 | ---- | C] () -- C:\Program Files\Common FilesDDBACSetup.msi
[2008.01.01 20:18:41 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.01.01 19:56:20 | 000,000,094 | ---- | C] () -- C:\Users\Helmut\AppData\Local\fusioncache.dat
 
========== LOP Check ==========
 
[2009.05.28 22:08:42 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Canon
[2008.01.01 20:43:47 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\DataDesign
[2009.11.29 15:23:21 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\gtk-2.0
[2009.07.12 19:50:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Lasersoft Imaging
[2009.08.25 22:20:31 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\NewSoft
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia
[2011.10.04 13:30:58 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Nokia Ovi Suite
[2009.05.28 21:38:00 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Opera
[2011.10.15 22:25:53 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Packnet
[2011.09.08 21:55:23 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\PC Suite
[2009.05.28 19:37:02 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\ScanSoft
[2008.01.01 19:52:30 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\T-Online
[2009.01.11 21:48:09 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Vso
[2009.05.11 19:50:41 | 000,000,000 | ---D | M] -- C:\Users\Helmut\AppData\Roaming\Zoner
[2008.01.01 19:12:24 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\DataDesign
[2007.12.29 18:32:34 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\PeerNetworking
[2008.01.01 19:12:40 | 000,000,000 | ---D | M] -- C:\Users\Helmut.Helmut-PC\AppData\Roaming\T-Online
[2011.06.12 02:24:46 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\DataDesign
[2009.07.29 11:03:30 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\NewSoft
[2012.06.11 23:32:15 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\PC Suite
[2009.07.29 11:02:46 | 000,000,000 | ---D | M] -- C:\Users\Rita\AppData\Roaming\T-Online
[2012.06.28 22:56:02 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< :OTL >
 
< [2012.06.18 13:39:09 | 000,001,722 | ---- | C] () -- C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk >
 
< [2012.06.18 13:39:08 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad >
 
< [2009.05.28 20:30:32 | 000,020,531 | -H-- | C] () -- C:\ProgramData\R49LW >
 
< O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present >
 
========== Drive Information ==========
 
Physical Drives
---------------
 
Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: WDC WD16 00AAJS-07PSA SCSI Disk Device
Partitions: 2
Status: OK
Status Info: 0
 
Partitions
---------------
 
DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 2,00GB
Starting Offset: 6491136
Hidden sectors: 0
 
 
DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 147,00GB
Starting Offset: 2156918784
Hidden sectors: 0
 
 
< O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present >
 
< O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present >
 
< O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present >
 
< O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present >
 
< O7 - HKU\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present >
 
========== Drive Information ==========
 
Physical Drives
---------------
 
Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: WDC WD16 00AAJS-07PSA SCSI Disk Device
Partitions: 2
Status: OK
Status Info: 0
 
Partitions
---------------
 
DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 2,00GB
Starting Offset: 6491136
Hidden sectors: 0
 
 
DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 147,00GB
Starting Offset: 2156918784
Hidden sectors: 0
 
 
<          >

< End of report >

cosinus 02.07.2012 14:18
Das ist aber nicht das Log vom Fix
Wie ich bereits sagte, finde ich den entsprechenden Eintrag der für die Meldung sorgt leider nicht

012 055-0 05.07.2012 15:57
Hallo,

jetzt aber der OTL - Fix

Grüße + Danke
Helmut

Edit: Run.DLL jetzt nach Neustart weg...!


Code:
========== OTL ==========
C:\Users\Helmut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk moved successfully.
C:\ProgramData\0tbpw.pad moved successfully.
C:\ProgramData\R49LW moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-3080631581-2879162188-20154992-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3080631581-2879162188-20154992-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
 
OTL by OldTimer - Version 3.2.53.0 log created on 07052012_165428

cosinus 05.07.2012 16:12
Zitat:
Edit: Run.DLL jetzt nach Neustart weg...!
yipieee :Boogie:

Sind noch Probleme offen?

012 055-0 05.07.2012 18:41
:applaus:

Hallo,

was ich als Laie ekennen kann, ist alles OK.
Wie geht es jetzt wohl weiter...?

cosinus 05.07.2012 20:20
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

012 055-0 08.07.2012 18:15
DANKE ! ! !

Grüße

Helmut


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:13 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131