Trojaner-Board - neuer BKA-Trojaner? (GVU)

Hallo,

seit heute Mittag wird mir mein PC gesperrt - allerdings nur, wenn ich einen Internetzugang herstelle (offline) läuft der PC. Ich habe recherchiert und festgestellt, dass es der BKA-Trojaner oder auch GVU-Trojaner ist. Allerdings habe ich diesen weder mit dem Kaspersky winunlocker 10.0 noch mit dem 10.0.3 entfernen können (Anleitung nach Chip bzw. botfrei.de). Nach einiger Suche bin ich auf diese Seite gelangt und habe die Anleitung für die "Hilfesuchenden" durchgearbeitet.
Code:
7.2012 22:15:05 - Run 1

OTL by OldTimer - Version 3.2.53.1     Folder = C:\Users\Ingo\Desktop

 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1,97 Gb Total Physical Memory | 1,31 Gb Available Physical Memory | 66,54% Memory free

3,93 Gb Paging File | 3,17 Gb Available in Paging File | 80,60% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 49,26 Gb Total Space | 15,09 Gb Free Space | 30,63% Space Free | Partition Type: NTFS

Drive D: | 62,40 Gb Total Space | 51,49 Gb Free Space | 82,51% Space Free | Partition Type: NTFS

Drive E: | 24,00 Mb Total Space | 14,24 Mb Free Space | 59,34% Space Free | Partition Type: NTFS

Drive I: | 1,92 Gb Total Space | 0,50 Gb Free Space | 25,96% Space Free | Partition Type: FAT

 

Computer Name: THINKPAD | User Name: Ingo | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2012.07.02 22:03:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Ingo\Desktop\OTL.exe

PRC - [2012.06.12 18:19:31 | 000,935,480 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe

PRC - [2012.06.12 18:19:30 | 001,196,600 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\ScriptHelperInstaller\11.1.0\ScriptHelper.exe

PRC - [2012.06.12 18:19:29 | 001,104,440 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe

PRC - [2012.05.18 01:21:54 | 000,748,664 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe

PRC - [2012.03.26 17:08:12 | 000,931,200 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\msseces.exe

PRC - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Security Client\MsMpEng.exe

PRC - [2011.12.14 13:23:34 | 001,212,224 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe

PRC - [2011.12.14 13:23:32 | 001,514,304 | ---- | M] (TuneUp Software) -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe

PRC - [2011.08.01 15:56:42 | 001,821,576 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliPoint\ipoint.exe

PRC - [2011.04.19 03:52:00 | 000,143,360 | ---- | M] () -- C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe

PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.04.23 00:16:46 | 000,128,296 | ---- | M] (Synaptics Incorporated) -- C:\Programme\Synaptics\SynTP\SynTPLpr.exe

PRC - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

PRC - [2009.08.18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

PRC - [2008.10.24 16:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

PRC - [2008.07.15 17:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\AEADISRV.EXE

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2012.07.02 15:08:59 | 000,242,336 | ---- | M] () -- C:\Users\Ingo\AppData\Local\Temp\0_0u_l.exe

MOD - [2012.06.12 18:19:32 | 000,132,664 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\SiteSafety.dll

MOD - [2012.06.12 18:19:30 | 001,196,600 | ---- | M] () -- C:\Programme\Common Files\AVG Secure Search\ScriptHelperInstaller\11.1.0\ScriptHelper.exe

MOD - [2012.06.12 18:19:29 | 001,104,440 | ---- | M] () -- C:\Programme\AVG Secure Search\vprot.exe

MOD - [2012.06.12 18:19:28 | 002,068,536 | ---- | M] () -- C:\Programme\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll

MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Programme\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

MOD - [2011.02.09 02:56:38 | 000,296,448 | ---- | M] () -- C:\Programme\MyToolsNotepad++\NppShell_04.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2012.06.24 16:41:29 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012.06.12 18:19:31 | 000,935,480 | ---- | M] () [Auto | Running] -- C:\Programme\Common Files\AVG Secure Search\vToolbarUpdater\11.1.0\ToolbarUpdater.exe -- (vToolbarUpdater11.1.0)

SRV - [2012.05.27 18:00:11 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2012.05.03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012.03.30 12:21:45 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012.03.26 17:03:40 | 000,214,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)

SRV - [2012.03.26 17:03:40 | 000,011,552 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)

SRV - [2011.12.14 13:23:32 | 001,514,304 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)

SRV - [2011.12.14 13:23:22 | 000,028,992 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)

SRV - [2011.06.12 12:15:00 | 031,125,880 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)

SRV - [2011.04.19 03:52:00 | 000,292,200 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Programme\ThinkPad\Utilities\DOZESVC.EXE -- (DozeSvc)

SRV - [2011.04.19 03:52:00 | 000,143,360 | ---- | M] () [Auto | Running] -- C:\Programme\ThinkPad\Utilities\PWMEWSVC.exe -- (PwmEWSvc)

SRV - [2011.04.19 03:52:00 | 000,083,304 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Programme\ThinkPad\Utilities\PWMDBSVC.exe -- (Power Manager DBC Service)

SRV - [2011.01.10 17:50:46 | 001,028,096 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Common Files\Lenovo\tvt_reg_monitor_svc.exe -- (ThinkVantage Registry Monitor Service)

SRV - [2010.12.03 10:57:38 | 000,099,328 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)

SRV - [2010.12.02 12:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)

SRV - [2010.11.24 16:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)

SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)

SRV - [2010.04.07 14:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Disabled | Stopped] -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)

SRV - [2010.01.09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)

SRV - [2010.01.09 21:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)

SRV - [2009.12.12 01:47:44 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)

SRV - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)

SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2008.10.24 16:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService)

SRV - [2008.07.15 17:09:52 | 000,090,112 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\AEADISRV.EXE -- (AEADIFilters)

SRV - [2007.05.31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2012.07.02 22:06:38 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8306A756-E9C7-4760-9224-E145ADD30EBC}\MpKsl183decf0.sys -- (MpKsl183decf0)

DRV - [2012.03.20 20:44:12 | 000,074,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011.09.22 18:10:46 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)

DRV - [2011.07.18 15:31:56 | 000,033,088 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\psadd.sys -- (psadd)

DRV - [2011.06.25 17:27:43 | 000,083,872 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)

DRV - [2011.06.25 17:27:43 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)

DRV - [2011.04.19 03:52:00 | 000,025,968 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\DOZEHDD.SYS -- (DozeHDD)

DRV - [2011.04.19 03:52:00 | 000,013,424 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\TPPWR32V.SYS -- (TPPWRIF)

DRV - [2011.04.18 15:43:36 | 000,009,216 | ---- | M] (MBB Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)

DRV - [2011.04.18 15:43:26 | 000,072,832 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator)

DRV - [2011.01.13 14:04:50 | 000,122,992 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ApsX86.sys -- (Shockprf)

DRV - [2011.01.13 14:02:56 | 000,020,592 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\ApsHM86.sys -- (TPDIGIMN)

DRV - [2010.12.30 13:20:22 | 000,114,688 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnet.sys -- (ZTEusbnet)

DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\zteusbvoice.sys -- (ZTEusbvoice)

DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)

DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)

DRV - [2010.12.30 13:20:22 | 000,105,856 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)

DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.09.07 14:09:06 | 000,013,680 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\System32\drivers\smiif32.sys -- (lenovo.smi)

DRV - [2009.12.12 01:48:04 | 000,025,984 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)

DRV - [2009.09.06 00:21:46 | 009,833,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2009.07.14 01:12:52 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tpm.sys -- (TPM)

DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R)

DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)

DRV - [2009.07.02 10:16:22 | 000,038,336 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tvti2c.sys -- (TVTI2C)

DRV - [2009.05.11 09:33:48 | 000,088,832 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LenovoRd.sys -- (LenovoRd)

DRV - [2008.11.28 14:34:56 | 000,035,840 | ---- | M] (CACE Technologies) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf_devolo.sys -- (NPF_devolo) NetGroup Packet Filter Driver (devolo)

DRV - [2007.02.24 15:42:00 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2007.01.23 17:40:00 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2006.11.27 17:44:52 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2006.11.14 17:35:20 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.avg.com/?cid={FDE24DCE-A0F5-43A0-B374-AB601787B7AC}&mid=db66551b62bb47d19a70d1567d5129ac-3108e389ecbbb92fd9c277b92f1f9e4fadbdef85&lang=de&ds=tt014&pr=sa&d=&v=&sap=hp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 04 6F 7F ED CB B9 CC 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={30CB5269-6515-447F-8BB2-33E14680D356}&mid=db66551b62bb47d19a70d1567d5129ac-3108e389ecbbb92fd9c277b92f1f9e4fadbdef85&lang=de&ds=tt014&pr=sa&d=2011-12-22 15:23:52&v=10.0.0.7&sap=dsp&q={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "google.de"

FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7Bec844494-319f-433c-8a66-184484e51697%7D&mid=db66551b62bb47d19a70d1567d5129ac-3108e389ecbbb92fd9c277b92f1f9e4fadbdef85&ds=tt014&v=10.2.0.3&lang=de&pr=sa&d=2011-12-22%2015%3A23%3A52&sap=ku&q="

FF - prefs.js..network.proxy.type: 4

 

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_228.dll ()

FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.1.0\\npsitesafety.dll ()

FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)

FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.04.14 21:28:05 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.24 16:41:30 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.12.14 18:09:47 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.04.14 21:28:05 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.06.24 16:41:30 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.12.14 18:09:47 | 000,000,000 | ---D | M]

 

[2011.04.13 22:03:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ingo\AppData\Roaming\mozilla\Extensions

[2012.06.29 20:03:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ingo\AppData\Roaming\mozilla\Firefox\Profiles\pczb0y18.default\extensions

[2012.04.18 23:25:48 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Ingo\AppData\Roaming\mozilla\Firefox\Profiles\pczb0y18.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2012.06.28 18:56:44 | 000,000,853 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\11-suche.xml

[2012.06.28 18:56:44 | 000,002,209 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\englische-ergebnisse.xml

[2012.06.28 18:56:44 | 000,010,506 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\gmx-suche.xml

[2012.06.28 18:56:44 | 000,002,368 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\lastminute.xml

[2012.06.28 18:56:44 | 000,005,489 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Mozilla\Firefox\Profiles\pczb0y18.default\searchplugins\webde-suche.xml

[2012.01.03 12:38:11 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2012.04.14 16:00:35 | 000,340,198 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\{A7C6CF7F-112C-4500-A7EA-39801A327E5F}.XPI

[2012.06.29 20:03:16 | 000,743,305 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

[2012.02.11 10:21:35 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI

[2012.06.28 18:56:28 | 000,578,962 | ---- | M] () (No name found) -- C:\USERS\INGO\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PCZB0Y18.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI

[2012.06.24 16:41:30 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011.12.14 12:41:14 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012.06.24 16:41:26 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012.06.12 18:19:28 | 000,003,768 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml

[2012.06.24 16:41:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012.06.24 16:41:26 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml

[2012.06.24 16:41:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml

[2012.06.24 16:41:26 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml

[2012.06.24 16:41:26 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()

O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\11.1.0.7\AVG Secure Search_toolbar.dll ()

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [nwiz] C:\Windows\System32\nwiz.exe ()

O4 - HKLM..\Run: [ROC_roc_dec12] C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe ()

O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()

O4 - Startup: C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LocalAccountTokenFilterPolicy = 1

O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O8 - Extra context menu item: Free YouTube Download - C:\Users\Ingo\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()

O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Ingo\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()

O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AB0A1241-CD6B-41F7-85AF-F5CB4E20441F}: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CAF25033-F873-4971-9454-7088B2344526}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Common Files\AVG Secure Search\ViProtocolInstaller\11.1.0\ViProtocol.dll ()

O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{c3b1f613-6c31-11e0-9af6-001c25bab085}\Shell - "" = AutoRun

O33 - MountPoints2\{c3b1f613-6c31-11e0-9af6-001c25bab085}\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence

O33 - MountPoints2\G\Shell - "" = AutoRun

O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup_vmc_lite.exe /checkApplicationPresence

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.07.02 22:11:28 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Ingo\Desktop\OTL.exe

[2012.06.28 17:26:07 | 000,000,000 | ---D | C] -- C:\Program Files\Quick Stego

[2012.06.20 20:04:42 | 000,000,000 | ---D | C] -- C:\Users\Ingo\workspace

[2012.06.15 21:15:22 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\Google

[2012.06.15 21:15:21 | 000,000,000 | ---D | C] -- C:\Program Files\Google

[2012.06.15 19:23:50 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Thunderbird

[2012.06.15 19:23:50 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\Thunderbird

[2012.06.11 19:20:41 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\Outlook-Dateien

[2012.06.08 17:26:45 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\My Photos

[2012.06.08 17:26:45 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\My Documents

[2012.06.08 17:25:02 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Outlook

[2012.06.08 17:23:16 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\ASUS

[2012.06.08 17:01:27 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\{FFFA2FB9-4857-4475-8379-F36343DA5801}

[2012.06.08 16:55:38 | 000,000,000 | ---D | C] -- C:\temp

[2012.06.08 16:53:31 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\{BA5F88F1-D2F2-4E27-85A3-42F74C7F2FC2}

[2012.06.08 16:53:26 | 000,000,000 | ---D | C] -- C:\Users\Ingo\Documents\Asus WebStorage

[2012.06.08 16:53:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASUS

[2012.06.08 16:53:22 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\ASUS WebStorage

[2012.06.08 16:53:10 | 000,000,000 | ---D | C] -- C:\ProgramData\ASUS WebStorage

[2012.06.08 16:53:04 | 000,000,000 | ---D | C] -- C:\Program Files\ASUS

[2012.06.08 16:48:54 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\eCareme

[2012.06.05 19:45:30 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tools

[2012.06.05 17:14:06 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Roaming\Skype

[2012.06.05 17:14:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

[2012.06.05 17:13:59 | 000,000,000 | R--D | C] -- C:\Program Files\Skype

[2012.06.05 17:13:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

[2012.06.03 19:22:44 | 000,000,000 | ---D | C] -- C:\Users\Ingo\AppData\Local\Microsoft_Corporation

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.07.02 22:13:44 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012.07.02 22:13:44 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012.07.02 22:12:25 | 000,000,000 | ---- | M] () -- C:\Users\Ingo\defogger_reenable

[2012.07.02 22:06:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.07.02 22:04:08 | 000,302,592 | ---- | M] () -- C:\Users\Ingo\Desktop\ez0msq3b.exe

[2012.07.02 22:03:18 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Ingo\Desktop\OTL.exe

[2012.07.02 22:02:34 | 000,050,477 | ---- | M] () -- C:\Users\Ingo\Desktop\Defogger.exe

[2012.07.02 21:47:06 | 004,503,728 | ---- | M] () -- C:\ProgramData\l_u0_0.pad

[2012.07.02 21:05:18 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012.07.02 16:55:52 | 000,656,500 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.07.02 16:55:52 | 000,618,342 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.07.02 16:55:52 | 000,131,240 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.07.02 16:55:52 | 000,107,622 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.07.02 15:12:05 | 000,000,466 | ---- | M] () -- C:\Windows\tasks\SystemToolsDailyTest.job

[2012.07.02 15:09:00 | 000,001,885 | ---- | M] () -- C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

[2012.07.01 11:34:13 | 000,003,304 | ---- | M] () -- C:\bootsqm.dat

[2012.06.29 23:06:38 | 000,034,649 | ---- | M] () -- C:\Users\Ingo\.recently-used.xbel

[2012.06.28 07:03:30 | 000,000,528 | ---- | M] () -- C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job

[2012.06.14 18:55:55 | 000,416,840 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012.06.10 20:26:17 | 000,000,046 | ---- | M] () -- C:\Users\Ingo\.prolog_console_history

 
 ========== Files Created - No Company Name ==========

 

[2012.07.02 22:12:25 | 000,000,000 | ---- | C] () -- C:\Users\Ingo\defogger_reenable

[2012.07.02 22:11:28 | 000,302,592 | ---- | C] () -- C:\Users\Ingo\Desktop\ez0msq3b.exe

[2012.07.02 22:11:28 | 000,050,477 | ---- | C] () -- C:\Users\Ingo\Desktop\Defogger.exe

[2012.07.02 15:08:59 | 004,503,728 | ---- | C] () -- C:\ProgramData\l_u0_0.pad

[2012.07.02 15:08:59 | 000,001,885 | ---- | C] () -- C:\Users\Ingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

[2012.07.01 11:34:13 | 000,003,304 | ---- | C] () -- C:\bootsqm.dat

[2012.06.29 23:06:38 | 000,034,649 | ---- | C] () -- C:\Users\Ingo\.recently-used.xbel

[2012.06.28 17:26:08 | 000,001,018 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quick Stego.lnk

[2012.06.10 20:25:14 | 000,000,046 | ---- | C] () -- C:\Users\Ingo\.prolog_console_history

[2012.03.03 00:27:17 | 000,017,985 | ---- | C] () -- C:\Windows\War3Unin.dat

[2011.12.15 17:04:52 | 000,000,154 | ---- | C] () -- C:\Users\Ingo\.appletviewer

[2011.09.05 09:19:56 | 000,000,176 | ---- | C] () -- C:\Windows\explorer.exe.config

[2011.08.21 12:11:13 | 000,000,268 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

[2011.06.25 17:25:19 | 000,083,872 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys

[2011.06.25 17:25:14 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys

[2011.04.14 21:22:27 | 000,262,652 | ---- | C] () -- C:\Windows\hpwins23.dat

[2011.04.14 21:22:27 | 000,002,075 | ---- | C] () -- C:\Windows\hpwmdl23.dat

[2011.04.13 21:36:46 | 001,731,104 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll

[2011.04.13 21:36:46 | 001,657,376 | ---- | C] () -- C:\Windows\System32\nwiz.exe

[2011.04.13 21:36:46 | 001,514,016 | ---- | C] () -- C:\Windows\System32\nView.dll

[2011.04.13 21:36:46 | 001,108,512 | ---- | C] () -- C:\Windows\System32\nvwimg.dll

[2011.04.13 21:36:46 | 000,473,632 | ---- | C] () -- C:\Windows\System32\nvShell.dll

[2011.04.13 21:36:46 | 000,449,056 | ---- | C] () -- C:\Windows\System32\nvAppBar.exe

[2011.04.13 21:36:46 | 000,267,296 | ---- | C] () -- C:\Windows\System32\nvTaskbar.exe

 
 ========== LOP Check ==========

 

[2012.06.26 19:59:47 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\.purple

[2011.06.18 13:08:25 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Ashampoo

[2012.06.29 14:39:44 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\ASUS

[2012.06.08 16:53:22 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\ASUS WebStorage

[2012.04.18 23:26:15 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\DVDVideoSoft

[2012.04.18 23:25:47 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\DVDVideoSoftIEHelpers

[2012.06.08 16:48:54 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\eCareme

[2011.04.14 08:49:41 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Foxit Software

[2012.06.29 22:25:01 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\gtk-2.0

[2011.09.02 15:51:14 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\JavaEditor

[2011.04.14 08:18:31 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Notepad++

[2012.06.08 17:25:02 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Outlook

[2011.05.03 20:23:12 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\PCDr

[2011.08.15 21:32:02 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Promethean

[2011.05.01 13:12:50 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\PwrMgr

[2011.12.04 16:21:26 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\SWI-Prolog

[2012.06.15 19:23:50 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Thunderbird

[2011.10.22 21:17:56 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\TightVNC

[2011.10.14 10:50:55 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\TuneUp Software

[2011.05.03 20:16:05 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Update

[2011.04.27 18:19:05 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Vodafone

[2011.04.23 20:02:09 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\Vodafone Mobile Broadband

[2011.08.21 12:11:47 | 000,000,000 | ---D | M] -- C:\Users\Ingo\AppData\Roaming\WinCachebox

[2012.06.28 07:03:30 | 000,000,528 | ---- | M] () -- C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job

[2012.06.12 07:01:27 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012.07.02 15:12:05 | 000,000,466 | ---- | M] () -- C:\Windows\Tasks\SystemToolsDailyTest.job

 
 ========== Purity Check ==========

 

< End of report >
Allerdings wurden bei mir nur die OTL.txt (siehe oben) und eine Extras.txt und Gmer.txt erzeugt, Die beiden gewünschten Datein dds.txt und attach.txt jedoch nicht.

Diesen Beitrag habe ich von einem 2. PC geschrieben ... der andere lies ja keinen Internetzugriff mehr zu.