Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GVU Trojaner (https://www.trojaner-board.de/120386-gvu-trojaner.html)

puckikater 25.07.2012 16:37
GVU Trojaner
 
Hallo!

Wir haben den GVU-Trojaner erwischt.
Das Malware-Progamm haben wir schon durchlaufen lassen.
Hat funktioniert unten folgt der Bericht.
Was müssen wir nun noch tun?
Danke im Voraus für schnelle Antworten.

Hier der Bericht:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.24.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19272
Annette :: ANNETTE-PC [Administrator]

Schutz: Aktiviert

25.07.2012 16:53:51
mbam-log-2012-07-25 (16-53-51).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 191250
Laufzeit: 17 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Users\Annette\AppData\Local\Temp\wpbt0.dll (Spyware.Zbot.DG) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Annette\AppData\Local\Temp\wpbt0.dll (Spyware.Zbot.DG) -> Löschen bei Neustart.
C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

t'john 25.07.2012 16:39
:hallo:

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt
Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.

puckikater 25.07.2012 17:41
So das OTL-Progra haben wir jetzt auch drüber laufen lassen.
Die Berichte folgen unten.
Müssen wir noch etwas tun oder können wir jetzt den PC wieder normal nutzen?

Hier die Berichte:


OTL.Txt - EditorOTL Logfile:
Code:
OTL logfile created on: 25.07.2012 17:48:56 - Run 1
OTL by OldTimer - Version 3.2.53.1    Folder = C:\Users\Annette\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19272)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,50 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 52,02% Memory free
5,21 Gb Paging File | 3,82 Gb Available in Paging File | 73,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 73,29 Gb Free Space | 50,88% Space Free | Partition Type: NTFS
Drive D: | 144,04 Gb Total Space | 138,71 Gb Free Space | 96,29% Space Free | Partition Type: NTFS
 
Computer Name: ANNETTE-PC | User Name: Annette | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Annette\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)
PRC - C:\ProgramData\DatacardService\DCService.exe ()
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Users\Annette\AppData\Roaming\Telekom Internet Manager\ouc.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Users\Annette\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
PRC - C:\Windows\PLFSetI.exe ()
PRC - C:\Programme\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
PRC - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
PRC - C:\Programme\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
PRC - C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Windows\System32\spool\drivers\w32x86\3\E_FATIEJE.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\ACER\Mobility Center\MobilityService.exe ()
PRC - C:\Programme\FRITZ!DSL\StCenter.exe (AVM Berlin)
PRC - C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
PRC - C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8bbcd31ecc8edc7d1f9cdd83ef2bb2d3\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Programme\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\PLFSetI.exe ()
MOD - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ShowErrMsg.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMediaLibrary.dll ()
MOD - C:\Programme\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvcPS.dll ()
MOD - C:\Windows\System32\SysHook.dll ()
MOD - C:\Programme\NewTech Infosystems\NTI Backup Now 5\BkupTrayLOC.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3006.0__3036420f80dd6947\Framework.Library.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3006.0__4df5dcab8860d239\Framework.Utility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3006.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()
SRV - (TeamViewer4) -- C:\Programme\TeamViewer\Version4\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (eDataSecurity Service) -- C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (MobilityService) -- C:\ACER\Mobility Center\MobilityService.exe ()
SRV - (IGDCTRL) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (usnjsvc) -- C:\Programme\MSN Messenger\usnsvc.exe (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (tcpipBM) -- C:\Windows\System32\drivers\tcpipBM.sys (Bytemobile, Inc.)
DRV - (BMLoad) -- C:\Windows\System32\drivers\BMLoad.sys (Bytemobile, Inc.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\Acer Arcade Deluxe\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (Ltn_stk7070P) -- C:\Windows\System32\drivers\Ltn_stk7070P.sys (LiteOn)
DRV - (int15) -- C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (NTIPPKernel) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys (Cyberlink Corp.)
DRV - (winbondcir) -- C:\Windows\System32\drivers\winbondcir.sys (Winbond Electronics Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=109868&tt=010712_4&babsrc=HP_ss&mntrId=aebfd44b0000000000000017c432b805
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109868&tt=010712_4&babsrc=SP_ss&mntrId=aebfd44b0000000000000017c432b805
IE - HKCU\..\SearchScopes\{1CA43381-C0E4-403D-9880-55D7B511147C}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKCU\..\SearchScopes\{CA78DDC1-B2CD-4DA7-9BE9-415CCBF71EEA}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_im2_test_v2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://search.babylon.com/?affID=109868&tt=010712_4&babsrc=HP_ss&mntrId=aebfd44b0000000000000017c432b805"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Annette\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.25 16:49:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 17:32:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.31 11:40:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.19 17:32:10 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.31 11:40:18 | 000,000,000 | ---D | M]
 
[2010.01.18 19:48:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Annette\AppData\Roaming\mozilla\Extensions
[2012.07.25 17:43:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Annette\AppData\Roaming\mozilla\Firefox\Profiles\pkxyjz9n.default\extensions
[2010.10.25 21:34:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Annette\AppData\Roaming\mozilla\Firefox\Profiles\pkxyjz9n.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.07.25 17:43:17 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Annette\AppData\Roaming\mozilla\Firefox\Profiles\pkxyjz9n.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.03.22 12:34:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Annette\AppData\Roaming\mozilla\Firefox\Profiles\pkxyjz9n.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}-trash
[2011.08.05 18:49:55 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Annette\AppData\Roaming\mozilla\Firefox\Profiles\pkxyjz9n.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.07.21 08:27:21 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-1.xml
[2011.11.10 09:56:01 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-10.xml
[2012.01.07 15:13:41 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-11.xml
[2012.02.01 23:33:59 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-12.xml
[2012.02.13 08:02:00 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-13.xml
[2012.02.18 18:41:21 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-14.xml
[2012.03.18 09:37:59 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-15.xml
[2012.05.06 17:46:54 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-16.xml
[2012.06.11 14:42:15 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-17.xml
[2012.06.24 16:05:40 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-18.xml
[2012.07.09 03:26:31 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-19.xml
[2011.05.27 16:31:18 | 000,000,961 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-2.xml
[2011.05.31 11:42:40 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-3.xml
[2011.06.29 10:21:31 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-4.xml
[2011.08.18 21:46:00 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-5.xml
[2011.08.31 17:42:11 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-6.xml
[2011.09.06 23:33:22 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-7.xml
[2011.10.05 19:21:24 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-8.xml
[2011.10.05 19:22:12 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-9.xml
[2012.07.24 14:48:30 | 000,000,168 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.gif
[2012.07.24 14:48:30 | 000,000,618 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.src
[2011.03.15 17:22:27 | 000,001,069 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.xml
[2010.09.12 19:07:14 | 000,002,149 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\MyStart Search.xml
[2012.02.13 08:01:48 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.02.25 16:49:35 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012.07.19 17:32:10 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.10.05 19:20:43 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.08 16:34:11 | 000,002,351 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2011.10.05 19:20:43 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.05 19:20:43 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.05 19:20:43 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.05 19:20:43 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.05 19:20:43 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DataCardMonitor] C:\Programme\Telekom\InternetManager_H\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated)
O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
O4 - HKLM..\Run: [eRecoveryService]  File not found
O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.)
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [ProductReg] C:\Program Files\Acer\WR_PopUp\ProductReg.exe (Acer)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [EPSON BX300F Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIEJE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [Facebook Update] C:\Users\Annette\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [HW_OPENEYE_OUC_Telekom Internet Manager] C:\Program Files\Telekom\InternetManager_H\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe (Macrovision Corporation)
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll ()
O4 - Startup: C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Annette\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0FCA1B5F-4EB9-4024-A9CF-4779C5809556}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C8D7BF95-F16E-40CB-AA76-5A3869E81181}: DhcpNameServer = 10.74.83.22 193.254.160.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CEE98DCD-120C-422F-B7D1-06B0732EFB77}: DhcpNameServer = 193.254.160.1 10.74.83.22
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D3984D90-6EA9-4A9C-9A04-0590B1C292EC}: DhcpNameServer = 193.254.160.1 10.74.83.22
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Annette\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Annette\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0564f21f-78da-11e0-97ea-d67de2d54660}\Shell - "" = AutoRun
O33 - MountPoints2\{0564f21f-78da-11e0-97ea-d67de2d54660}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\Shell - "" = AutoRun
O33 - MountPoints2\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\Shell - "" = AutoRun
O33 - MountPoints2\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{8e29691b-3a0a-11de-891f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8e29691b-3a0a-11de-891f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\Shell - "" = AutoRun
O33 - MountPoints2\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\Shell - "" = AutoRun
O33 - MountPoints2\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\Shell - "" = AutoRun
O33 - MountPoints2\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\Shell - "" = AutoRun
O33 - MountPoints2\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\Shell - "" = AutoRun
O33 - MountPoints2\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.25 17:47:12 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Annette\Desktop\OTL.exe
[2012.07.24 15:58:07 | 000,000,000 | ---D | C] -- C:\Users\Annette\AppData\Roaming\Malwarebytes
[2012.07.24 15:57:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.24 15:57:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.24 15:57:48 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.24 15:57:48 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.24 15:56:18 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Annette\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.24 15:45:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.07.24 15:45:37 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2012.07.24 15:45:35 | 000,137,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2012.07.24 15:45:35 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2012.07.24 15:45:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.07.24 15:45:34 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012.07.14 09:53:51 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.07.13 18:23:33 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012.07.08 16:34:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid
[2012.07.08 16:34:32 | 000,000,000 | ---D | C] -- C:\Program Files\Xvid
[2012.07.08 16:34:28 | 000,000,000 | ---D | C] -- C:\Program Files\Video Codec
[2012.07.08 16:34:21 | 000,000,000 | ---D | C] -- C:\Users\Annette\AppData\Roaming\BabylonToolbar
[2012.07.08 16:34:16 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
[2012.07.08 16:34:02 | 000,000,000 | ---D | C] -- C:\Users\Annette\AppData\Roaming\Babylon
[2012.07.08 16:34:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.25 17:50:31 | 000,042,749 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.07.25 17:47:27 | 000,042,749 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.07.25 17:47:17 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Annette\Desktop\OTL.exe
[2012.07.25 17:46:57 | 000,628,992 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.25 17:46:57 | 000,596,062 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.25 17:46:57 | 000,126,704 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.25 17:46:57 | 000,104,136 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.25 17:41:02 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml
[2012.07.25 17:40:38 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.25 17:40:38 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.25 17:40:32 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2012.07.25 17:40:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.25 17:40:15 | 2682,679,296 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.25 17:38:15 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.07.25 17:15:04 | 000,000,258 | ---- | M] () -- C:\Windows\tasks\Auf Updates für Windows Live Toolbar prüfen.job
[2012.07.25 16:59:23 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job
[2012.07.25 16:48:20 | 000,001,146 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job
[2012.07.24 15:57:53 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.24 15:56:41 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Annette\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.24 15:45:50 | 000,001,851 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2012.07.24 11:33:27 | 000,008,268 | ---- | M] () -- C:\Users\Annette\AppData\Local\d3d9caps.dat
[2012.07.14 10:12:55 | 000,321,272 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.08 16:34:20 | 000,000,249 | ---- | M] () -- C:\user.js
[2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.07.24 15:57:53 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.07.24 15:45:50 | 000,001,851 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2012.07.24 11:05:20 | 004,503,728 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2012.07.08 16:34:32 | 000,650,752 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2012.07.08 16:34:32 | 000,243,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2012.07.08 16:34:32 | 000,153,088 | ---- | C] () -- C:\Windows\System32\xvid.ax
[2012.07.08 16:34:17 | 000,000,249 | ---- | C] () -- C:\user.js
[2011.01.21 16:17:05 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2011.01.21 16:17:05 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2011.01.21 16:17:05 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2011.01.21 16:17:05 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2011.01.21 16:17:05 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2011.01.21 16:17:05 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2011.01.21 16:17:05 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2011.01.21 16:17:05 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2011.01.21 16:17:05 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2011.01.21 16:17:05 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2011.01.21 16:17:05 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2011.01.21 16:17:05 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2011.01.21 16:17:05 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2011.01.21 16:17:05 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2011.01.21 16:17:05 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2011.01.21 16:17:05 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2011.01.21 16:17:05 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2011.01.21 16:17:05 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2011.01.21 16:17:05 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2011.01.21 16:09:17 | 000,000,025 | ---- | C] () -- C:\Windows\CDEBX300DEFGIPS.ini
[2009.05.12 20:53:10 | 000,012,800 | ---- | C] () -- C:\Users\Annette\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.24 19:59:32 | 000,008,268 | ---- | C] () -- C:\Users\Annette\AppData\Local\d3d9caps.dat
[2008.10.24 21:56:50 | 000,042,749 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008.10.24 21:56:50 | 000,042,749 | ---- | C] () -- C:\ProgramData\nvModes.001
 
========== LOP Check ==========
 
[2009.04.08 19:02:49 | 000,000,000 | -HSD | M] -- C:\Users\Annette\AppData\Roaming\.#
[2008.04.01 10:35:21 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\Acer GameZone Console
[2012.07.08 16:34:02 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\Babylon
[2012.07.08 16:34:21 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\BabylonToolbar
[2012.02.03 17:29:33 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\DVDVideoSoft
[2011.08.05 18:49:51 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.07 16:57:40 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\EPSON
[2010.03.31 17:37:00 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\eSobi
[2010.12.09 16:31:40 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\FRITZ!
[2009.04.07 14:56:50 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\GrabPro
[2011.01.21 18:08:22 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\OpenOffice.org
[2009.04.07 16:10:41 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\Orbit
[2009.04.07 18:26:27 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\TeamViewer
[2011.05.07 20:33:34 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\Telekom
[2012.06.30 04:47:57 | 000,000,000 | ---D | M] -- C:\Users\Annette\AppData\Roaming\Telekom Internet Manager
[2012.07.25 17:15:04 | 000,000,258 | ---- | M] () -- C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
[2012.07.25 16:59:23 | 000,001,124 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job
[2012.07.25 16:48:20 | 000,001,146 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job
[2012.07.25 17:39:08 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:E36F5B57

< End of report >
--- --- ---


Extras.Txt - EditorOTL Logfile:
Code:
OTL Extras logfile created on: 25.07.2012 17:48:56 - Run 1
OTL by OldTimer - Version 3.2.53.1    Folder = C:\Users\Annette\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19272)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,50 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 52,02% Memory free
5,21 Gb Paging File | 3,82 Gb Available in Paging File | 73,29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,04 Gb Total Space | 73,29 Gb Free Space | 50,88% Space Free | Partition Type: NTFS
Drive D: | 144,04 Gb Total Space | 138,71 Gb Free Space | 96,29% Space Free | Partition Type: NTFS
 
Computer Name: ANNETTE-PC | User Name: Annette | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- Reg Error: Value error.
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01CEEC82-855F-455F-A872-A46AEFB6AEE0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{177A6AF1-8512-44F0-A60E-251B1DF8A924}" = rport=139 | protocol=6 | dir=out | app=system |
"{17FB7B56-DD6E-465E-A700-2E201B400123}" = rport=445 | protocol=6 | dir=out | app=system |
"{23D0342A-7D24-4D65-A08A-53ACF1A0752B}" = rport=137 | protocol=17 | dir=out | app=system |
"{37EF48FE-6E6D-4948-ABB2-31DB5293DB36}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{45829AB2-DEF0-4CAC-B3A2-A7607DC82C92}" = lport=445 | protocol=6 | dir=in | app=system |
"{5D3D6D2B-88CD-46FB-88CC-F696AEA5C8D0}" = lport=138 | protocol=17 | dir=in | app=system |
"{87DC3FA3-6025-4F30-B98C-3E9E035200D3}" = lport=137 | protocol=17 | dir=in | app=system |
"{996FDBA3-EFDB-44C4-BF73-24D1FFEF0CBD}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D8F79DE8-375C-4E9E-8A95-CCB4C169E467}" = lport=2869 | protocol=6 | dir=in | app=system |
"{DB4A988B-692F-4B46-B22E-99D4D36367D8}" = rport=138 | protocol=17 | dir=out | app=system |
"{E64C18D1-8230-4BBA-AC2A-80CCCFB4EA89}" = lport=139 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{011896AF-AC3A-4FCD-9169-1CE2CE197B2F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{029B7D1B-B435-49F1-B1A5-1064F8E55E34}" = protocol=6 | dir=in | app=c:\spiele\steam\steamapps\common\killingfloor\system\killingfloor.exe |
"{074C7C94-6FF7-4B4D-AE01-7AED89B20714}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{182C7D1D-32D0-4E2A-9402-426C3D8D78AE}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe |
"{1CBDCCD4-5B8C-4DC6-A193-A3248F60B356}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{1FF27181-BD41-4110-92AF-E44346E6BEB1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{230B3936-A5F0-41D5-95B2-7D8E8A08ACEF}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{38B38DC0-8A70-422B-AC7E-F53EEBAC0FEF}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{3B4748E6-7526-4AD8-8E93-665589042779}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{518854BE-0FFC-44B7-940B-34D9731944A5}" = protocol=17 | dir=in | app=c:\spiele\steam\steamapps\common\left 4 dead\left4dead.exe |
"{541DBBE7-71D6-4CAE-987A-E6D3CC3171A5}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\fboxupd.exe |
"{67ED9088-2D4B-4D94-9D8F-EF720417E7F7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{6B8E6EA7-DDE2-43B5-B409-9DBA2A39DB32}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{6C78907E-A3B5-4687-B69D-CA30E55EE12E}" = dir=in | app=c:\users\annette\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{6D63F165-9C70-493C-83F6-AC336BA04C6C}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{732D98B5-658B-45BD-BDE2-65345664786E}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{7558DA11-375A-427D-8205-B20AA53BE569}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{7C9B38C5-83D2-4145-9CD1-7BFF0411AFC5}" = protocol=17 | dir=in | app=c:\spiele\steam\steamapps\common\killingfloor\system\killingfloor.exe |
"{8508037C-ABA3-478C-8EE9-FDDDD52358F0}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{8CBFD48F-09A9-483F-8E30-B1D47843E5A5}" = protocol=6 | dir=in | app=c:\spiele\steam\steamapps\common\left 4 dead\left4dead.exe |
"{937DC23E-56EB-446C-8F88-5D6AACE07711}" = protocol=6 | dir=in | app=c:\program files\fritz!dsl\igdctrl.exe |
"{9D4B40B5-592C-419E-86F9-B376EDD6050D}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"{AA76B756-47AA-4C10-B142-EEA8DF1BCD95}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe |
"{ABAE7783-249A-48A1-BA6D-365EA8738C2C}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe |
"{B2E07B66-652C-495F-8183-B9EDC7FBDEB1}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{C0167C73-06A6-4B1F-9968-0E1BC76D1876}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{C3EA9D04-6BB7-46B9-B63A-92F72A258056}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{CAE9EB2B-A8BA-47AE-9E1B-DE76250DB1E3}" = protocol=17 | dir=in | app=c:\program files\fritz!dsl\webwaigd.exe |
"{CC8F1DA4-9A50-4F91-B095-D18787D5B7E7}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{D98861E1-7A13-4FFE-B4EC-F1E0CE8D184A}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13AD0F5B-FF8C-4625-851D-A83D4BE74716}" = Smart Menus (Windows Live Toolbar)
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2457326B-C110-40C3-89B0-889CC913871A}" = AVM FRITZ!DSL
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 30
"{279DB581-239C-4E13-97F8-0F48E40BE75C}" = Windows Live Messenger
"{28E151E2-A495-4C41-A94C-D3682E10F57E}" = Windows Live Toolbar
"{3A75BDE6-418E-4DB9-8601-C9E5225E0059}" = Feederkennung (Windows Live Toolbar)
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{49672EC2-171B-47B4-8CE7-50D7806360D7}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{57265292-228A-41FA-9AEC-4620CBCC2739}" = Acer eAudio Management
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5B63A470-9334-44D1-AF61-6CE2DB565AE9}" = Orion
"{6266BA75-45FA-4B1A-B21F-E04A90C273E5}" = Windows Live Toolbar-Erweiterung (Windows Live Toolbar)
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91C82FED-477B-4AF1-88FB-F967BB0D7F10}" = Winbond CIR Device Drivers
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam 2.0.8.3
"{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.0
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DEDB47A3-C988-4A43-A645-E2CEA571E680}" = Epson Easy Photo Print 2
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Acer GameZone Console_is1" = Acer GameZone Console 2.0.1.1
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AudibleManager" = AudibleManager
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"BabylonToolbar" = Babylon toolbar on IE
"CNXT_MODEM_HDA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"DivX Setup" = DivX-Setup
"EPSON BX300F Series" = EPSON BX300F Series Printer Uninstall
"EPSON Scanner" = EPSON Scan
"EPSON Stylus Office BX300F_TX300F Benutzerhandbuch" = EPSON Stylus Office BX300F_TX300F Handbuch
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.6.727
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 4" = TeamViewer 4
"Telekom Internet Manager" = Telekom Internet Manager
"Windows Live Toolbar" = Windows Live Toolbar
"Xvid_is1" = Xvid MPEG-4 Video Codec
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 28.11.2011 09:36:49 | Computer Name = Annette-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.11.2011 09:36:50 | Computer Name = Annette-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.11.2011 09:36:50 | Computer Name = Annette-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.11.2011 09:36:51 | Computer Name = Annette-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.11.2011 09:36:51 | Computer Name = Annette-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.11.2011 09:36:51 | Computer Name = Annette-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.11.2011 09:36:51 | Computer Name = Annette-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.11.2011 14:08:18 | Computer Name = Annette-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 28.11.2011 14:15:08 | Computer Name = Annette-PC | Source = ESENT | ID = 474
Description = wuaueng.dll (1084) SUS20ClientDataStore:  Bei Überprüfung der aus
Datei "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" bei Offset 14172160
 (0x0000000000d84000) (Datenbankseite 3459 (0xD83)) für 4096 (0x00001000) Bytes
gelesenen Datenbankseite ist durch eine Inkonsistenz der Seitenprüfsumme ein Fehler
 aufgetreten. Die erwartete Prüfsumme war 2048121414917409239 (0x1c6c63935105c9d7),
 die tatsächliche Prüfsumme 646557890194294439 (0x08f908f9bbc1c6a7). Fehler -1018
 (0xfffffc06) bei Leseoperation. Wenn dieser Zustand andauert, stellen Sie die Datenbank
 aus einer vorherigen Sicherung wieder her. Dieses Problem ist vermutlich durch
fehlerhafte Hardware bedingt. Wenden Sie sich für weitere Unterstützung bei der
Diagnose des Problems an Ihren Hardwarehersteller.
 
Error - 29.11.2011 02:03:56 | Computer Name = Annette-PC | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 24.07.2012 05:36:48 | Computer Name = Annette-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 24.07.2012 06:42:52 | Computer Name = Annette-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
Error - 24.07.2012 06:43:04 | Computer Name = Annette-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 24.07.2012 07:03:48 | Computer Name = Annette-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
Error - 24.07.2012 07:04:00 | Computer Name = Annette-PC | Source = Service Control Manager | ID = 7000
Description =
 
Error - 24.07.2012 19:36:27 | Computer Name = Annette-PC | Source = DCOM | ID = 10010
Description =
 
Error - 24.07.2012 19:36:32 | Computer Name = Annette-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 25.07.2012 10:45:24 | Computer Name = Annette-PC | Source = Service Control Manager | ID = 7011
Description =
 
Error - 25.07.2012 11:40:25 | Computer Name = Annette-PC | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description =
 
Error - 25.07.2012 11:41:01 | Computer Name = Annette-PC | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >
--- --- ---

t'john 25.07.2012 17:50
Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
:OTL
 
PRC - C:\Users\Annette\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
 
SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()
SRV - (ETService) -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (CLHNService) -- C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (MobilityService) -- C:\ACER\Mobility Center\MobilityService.exe ()
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=109868&tt=010712_4&babsrc=HP_ss&mntrId=aebfd44b0000000000000017c432b805
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=109868&tt=010712_4&babsrc=SP_ss&mntrId=aebfd44b0000000000000017c432b805
IE - HKCU\..\SearchScopes\{1CA43381-C0E4-403D-9880-55D7B511147C}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
IE - HKCU\..\SearchScopes\{CA78DDC1-B2CD-4DA7-9BE9-415CCBF71EEA}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com/?search={searchTerms}&loc=search_box_im2_test_v2
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "http://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=109868&tt=010712_4&babsrc=HP_ss&mntrId=aebfd44b0000000000000017c432b805"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q="
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4 - HKCU..\Run: [Facebook Update] C:\Users\Annette\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll ()
O4 - HKLM..\RunOnce: [B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll] C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll ()
O4 - Startup: C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O24 - Desktop WallPaper: C:\Users\Annette\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Annette\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{0564f21f-78da-11e0-97ea-d67de2d54660}\Shell - "" = AutoRun
O33 - MountPoints2\{0564f21f-78da-11e0-97ea-d67de2d54660}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\Shell - "" = AutoRun
O33 - MountPoints2\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\Shell - "" = AutoRun
O33 - MountPoints2\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{8e29691b-3a0a-11de-891f-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8e29691b-3a0a-11de-891f-806e6f6e6963}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\Shell - "" = AutoRun
O33 - MountPoints2\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\Shell - "" = AutoRun
O33 - MountPoints2\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\Shell - "" = AutoRun
O33 - MountPoints2\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\Shell - "" = AutoRun
O33 - MountPoints2\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\Shell - "" = AutoRun
O33 - MountPoints2\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\Shell\AutoRun\command - "" = F:\StartVMCLite.exe
O33 - MountPoints2\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\Shell - "" = AutoRun
O33 - MountPoints2\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\Shell\AutoRun\command - "" = F:\AutoRun.exe
 
[2012.07.08 16:34:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.07.25 17:50:31 | 000,042,749 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.07.25 17:47:27 | 000,042,749 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.07.25 17:38:15 | 004,503,728 | ---- | M] () -- C:\ProgramData\0tbpw.pad
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:E36F5B57
[2012.07.21 08:27:21 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-1.xml
[2011.11.10 09:56:01 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-10.xml
[2012.01.07 15:13:41 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-11.xml
[2012.02.01 23:33:59 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-12.xml
[2012.02.13 08:02:00 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-13.xml
[2012.02.18 18:41:21 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-14.xml
[2012.03.18 09:37:59 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-15.xml
[2012.05.06 17:46:54 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-16.xml
[2012.06.11 14:42:15 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-17.xml
[2012.06.24 16:05:40 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-18.xml
[2012.07.09 03:26:31 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-19.xml
[2011.05.27 16:31:18 | 000,000,961 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-2.xml
[2011.05.31 11:42:40 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-3.xml
[2011.06.29 10:21:31 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-4.xml
[2011.08.18 21:46:00 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-5.xml
[2011.08.31 17:42:11 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-6.xml
[2011.09.06 23:33:22 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-7.xml
[2011.10.05 19:21:24 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-8.xml
[2011.10.05 19:22:12 | 000,000,950 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-9.xml
[2012.07.24 14:48:30 | 000,000,168 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.gif
[2012.07.24 14:48:30 | 000,000,618 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.src
[2011.03.15 17:22:27 | 000,001,069 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.xml
[2010.09.12 19:07:14 | 000,002,149 | ---- | M] () -- C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\MyStart Search.xml
[2011.10.05 19:20:43 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.05 19:20:43 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.10.05 19:20:43 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.05 19:20:43 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.05 19:20:43 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.05 19:20:43 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
[2012.07.08 16:34:11 | 000,002,351 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

[2012.07.08 16:34:21 | 000,000,000 | ---D | C] -- C:\Users\Annette\AppData\Roaming\BabylonToolbar
[2012.07.08 16:34:16 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar
[2012.07.08 16:34:02 | 000,000,000 | ---D | C] -- C:\Users\Annette\AppData\Roaming\Babylon
[2012.07.08 16:34:20 | 000,000,249 | ---- | M] () -- C:\user.js


[2012.07.25 17:15:04 | 000,000,258 | ---- | M] () -- C:\Windows\tasks\Auf Updates für Windows Live Toolbar prüfen.job
[2012.07.25 16:59:23 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job
[2012.07.25 16:48:20 | 000,001,146 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job
:Files
C:\Users\Annette\AppData\Local\Temp\RtkBtMnt.exe

C:\autoexec.bat


C:\Users\Annette\AppData\Roaming\BabylonToolbar
C:\Program Files\BabylonToolbar
C:\Users\Annette\AppData\Roaming\Babylon
C:\ProgramData\Babylon
C:\ProgramData\nvModes.001
C:\ProgramData\nvModes.dat
C:\ProgramData\0tbpw.pad
C:\Windows\tasks\Auf Updates für Windows Live Toolbar prüfen.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job
C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job
C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
[emptyjava]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

puckikater 26.07.2012 16:45
Danke für die schnellen Antworten!
Wir haben das ganze jetzt auch mit OTL gefixt.
Müssen wir noch etwas tun?
Sorry, dass ich alles nachfrage aber wir haben da kaum Ahnung von.

Hier der Bericht:
All processes killed
========== OTL ==========
No active process named RtkBtMnt.exe was found!
Service DCService.exe stopped successfully!
Service DCService.exe deleted successfully!
C:\ProgramData\DatacardService\DCService.exe moved successfully.
Service ETService stopped successfully!
Service ETService deleted successfully!
C:\Programme\Acer\Empowering Technology\Service\ETService.exe moved successfully.
Service CLHNService stopped successfully!
Service CLHNService deleted successfully!
C:\Programme\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe moved successfully.
Service MobilityService stopped successfully!
Service MobilityService deleted successfully!
C:\ACER\Mobility Center\MobilityService.exe moved successfully.
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
File system32\DRIVERS\nwlnkfwd.sys File not found not found.
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
File system32\DRIVERS\nwlnkflt.sys File not found not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
File system32\DRIVERS\ipinip.sys File not found not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Programme\ICQ6Toolbar\ICQToolBar.dll moved successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1CA43381-C0E4-403D-9880-55D7B511147C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CA43381-C0E4-403D-9880-55D7B511147C}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CA78DDC1-B2CD-4DA7-9BE9-415CCBF71EEA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA78DDC1-B2CD-4DA7-9BE9-415CCBF71EEA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=sm&tb_ver=1.2.9&q=" removed from browser.search.defaulturl
Prefs.js: "Search the web (Babylon)" removed from browser.search.order.1
Prefs.js: "ICQ Search" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.babylon.com/?affID=109868&tt=010712_4&babsrc=HP_ss&mntrId=aebfd44b0000000000000017c432b805" removed from browser.startup.homepage
Prefs.js: {800b5000-a755-47e1-992b-48a1c1357f07}:1.2.0 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 removed from extensions.enabledItems
Prefs.js: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1 removed from extensions.enabledItems
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{5CBE3B7C-1E47-477E-A7DD-396DB0476E29} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5CBE3B7C-1E47-477E-A7DD-396DB0476E29}\ deleted successfully.
C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ deleted successfully.
C:\Programme\Windows Live Toolbar\msntb.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate deleted successfully.
C:\Programme\DivX\DivX Update\DivXUpdate.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\eRecoveryService deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\PLFSetI deleted successfully.
C:\Windows\PLFSetI.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Facebook Update deleted successfully.
C:\Users\Annette\AppData\Local\Facebook\Update\FacebookUpdate.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll deleted successfully.
C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXBannerAdPlugin.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll deleted successfully.
C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXDownloadManagerPlugin.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll deleted successfully.
C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXMediaManagerPlugin.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\B Register C:\Program Files\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll deleted successfully.
C:\Programme\DivX\DivX Plus Player\DPXPlugins\DPXPlayerPlugin.dll moved successfully.
C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk moved successfully.
C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE moved successfully.
C:\Users\Annette\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk moved successfully.
C:\Programme\OpenOffice.org 3\program\quickstart.exe moved successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General\\WallPaper deleted successfully.
C:\Users\Annette\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\General\\BackupWallPaper deleted successfully.
File C:\Users\Annette\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0564f21f-78da-11e0-97ea-d67de2d54660}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0564f21f-78da-11e0-97ea-d67de2d54660}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0564f21f-78da-11e0-97ea-d67de2d54660}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0564f21f-78da-11e0-97ea-d67de2d54660}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0564f226-78da-11e0-97ea-b65a6d83b6b7}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3bcaab1d-3931-11de-86b7-00238b0fd8f1}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b9d002a-37f0-11de-b63a-00238b0fd8f1}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b9d0031-37f0-11de-b63a-00238b0fd8f1}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69bb391c-7ba0-11e0-94c1-8f6544930cc5}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e29691b-3a0a-11de-891f-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e29691b-3a0a-11de-891f-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e29691b-3a0a-11de-891f-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e29691b-3a0a-11de-891f-806e6f6e6963}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e29693c-3a0a-11de-891f-00238b0fd8f1}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e29693d-3a0a-11de-891f-00238b0fd8f1}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3ef53f5-78d6-11e0-b286-ed131c0f03a4}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3ef5426-78d6-11e0-b286-996e1fb1b090}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae313aa4-039f-11e0-a0b2-d64220e482a7}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae313aa5-039f-11e0-a0b2-d64220e482a7}\ not found.
File F:\StartVMCLite.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f8c552a4-7b9a-11e0-80a9-8001ed673925}\ not found.
File F:\AutoRun.exe not found.
C:\ProgramData\Babylon folder moved successfully.
C:\ProgramData\nvModes.001 moved successfully.
C:\ProgramData\nvModes.dat moved successfully.
C:\ProgramData\0tbpw.pad moved successfully.
ADS C:\ProgramData\TEMP:E36F5B57 deleted successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-14.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-15.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-16.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-17.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-18.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-19.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.gif moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.src moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\icqplugin.xml moved successfully.
C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\searchplugins\MyStart Search.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\babylon.xml moved successfully.
C:\Users\Annette\AppData\Roaming\BabylonToolbar\Shared folder moved successfully.
C:\Users\Annette\AppData\Roaming\BabylonToolbar\IE folder moved successfully.
C:\Users\Annette\AppData\Roaming\BabylonToolbar\FF folder moved successfully.
C:\Users\Annette\AppData\Roaming\BabylonToolbar\CR folder moved successfully.
C:\Users\Annette\AppData\Roaming\BabylonToolbar folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar\1.5.3.17 folder moved successfully.
C:\Programme\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Users\Annette\AppData\Roaming\Babylon folder moved successfully.
C:\user.js moved successfully.
C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job moved successfully.
========== FILES ==========
C:\Users\Annette\AppData\Local\Temp\RtkBtMnt.exe moved successfully.
File\Folder C:\autoexec.bat not found.
File\Folder C:\Users\Annette\AppData\Roaming\BabylonToolbar not found.
C:\Program Files\BabylonToolbar folder moved successfully.
File\Folder C:\Users\Annette\AppData\Roaming\Babylon not found.
File\Folder C:\ProgramData\Babylon not found.
File\Folder C:\ProgramData\nvModes.001 not found.
File\Folder C:\ProgramData\nvModes.dat not found.
File\Folder C:\ProgramData\0tbpw.pad not found.
File\Folder C:\Windows\tasks\Auf Updates für Windows Live Toolbar prüfen.job not found.
File\Folder C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job not found.
File\Folder C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job not found.
File\Folder C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job not found.
File\Folder C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000Core.job not found.
File\Folder C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-176984217-4060412088-1064505286-1000UA.job not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Annette\Desktop\Virusprogramme\cmd.bat deleted successfully.
C:\Users\Annette\Desktop\Virusprogramme\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Annette
->Temp folder emptied: 4179154541 bytes
->Temporary Internet Files folder emptied: 212486347 bytes
->Java cache emptied: 31575240 bytes
->FireFox cache emptied: 969551576 bytes
->Flash cache emptied: 209688598 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 578848535 bytes
RecycleBin emptied: 3528967944 bytes

Total Files Cleaned = 9.260,00 mb


[EMPTYFLASH]

User: All Users

User: Annette
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYJAVA]

User: All Users

User: Annette
->Java cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.53.1 log created on 07252012_185452

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

t'john 26.07.2012 16:45
Sehr gut! :daumenhoc

Wie laeuft der Rechner?

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

puckikater 26.07.2012 16:48
Der Rechner läuft soweit gut.
Müssen wir jetzt wirklich nochmal nen Fullscan machen?
Den haben wir ja zu Anfang schon gemacht.

t'john 26.07.2012 16:54
Der Rechner ist immer noch verseucht.
Ja, wir muessen das machen.

puckikater 26.07.2012 16:55
OK...:kaffee:

Kommt noch was dran?

Bericht Malware:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.26.12

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19272
Annette :: ANNETTE-PC [Administrator]

Schutz: Aktiviert

26.07.2012 17:56:12
mbam-log-2012-07-26 (17-56-12).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 329869
Laufzeit: 1 Stunde(n), 46 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Bericht ADW:
# AdwCleaner v1.703 - Logfile created 07/26/2012 at 20:14:15
# Updated 20/07/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Annette - ANNETTE-PC
# Running from : C:\Users\Annette\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Annette\AppData\LocalLow\BabylonToolbar
Folder Found : C:\Users\Annette\AppData\LocalLow\boost_interprocess

***** [Registry] *****

Key Found : HKCU\Software\BabylonToolbar
Key Found : HKLM\SOFTWARE\Babylon
Key Found : HKLM\SOFTWARE\BabylonToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Found : HKLM\SOFTWARE\Classes\b
Key Found : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Key Found : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Key Found : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Key Found : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Key Found : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Found : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Found : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Found : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Key Found : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Key Found : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Key Found : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Key Found : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.19272

[HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=109868&tt=010712_4&babsrc=NT_ss&mntrId=aebfd44b0000000000000017c432b805

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\prefs.js

Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Found : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=109868&tt=010712_4&babsrc=NT_ss&mn[...]
Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Found : user_pref("extensions.BabylonToolbar_i.babExt", "");
Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109868&tt=010712_4");
Found : user_pref("extensions.BabylonToolbar_i.hardId", "aebfd44b0000000000000017c432b805");
Found : user_pref("extensions.BabylonToolbar_i.id", "aebfd44b0000000000000017c432b805");
Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15529");
Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Found : user_pref("extensions.BabylonToolbar_i.newTab", true);
Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=109868&tt=01071[...]
Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1716:34:15");
Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

*************************

AdwCleaner[R1].txt - [6676 octets] - [26/07/2012 20:14:15]

########## EOF - C:\AdwCleaner[R1].txt - [6804 octets] ##########

t'john 26.07.2012 19:56
Sehr gut! :daumenhoc


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

puckikater 30.07.2012 16:26
So... das haben wir nun auch getan.
Was folgt nun?
Wie viele Scans müssen wir denn noch insgesamt machen, bis wir fetig sind?
Ich würde gerne wissen ob wir noch am Anfang, in der Mitte oder bereits am Ende stehen...

ADW:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.26.12

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19272
Annette :: ANNETTE-PC [Administrator]

Schutz: Aktiviert

26.07.2012 17:56:12
mbam-log-2012-07-26 (17-56-12).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 329869
Laufzeit: 1 Stunde(n), 46 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


Emisoft:
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 30.07.2012 09:44:05

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn: 30.07.2012 09:44:33


Gescannt 592592
Gefunden 0

Scan Ende: 30.07.2012 11:25:05
Scan Zeit: 1:40:32

t'john 30.07.2012 18:25
Es wuerde schneller gehen, wenn du die Scans machen wuerdest, die ich anfordere ;)

  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.



danach:



Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

puckikater 31.07.2012 08:30
Das was du da als erstes geschrieben hast habe ich doch schon gemacht und auch gepostet...

Bericht:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=746842a94edc0e4a9fb338dca790c355
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-30 08:50:15
# local_time=2012-07-30 10:50:15 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 94 256721 80204828 519227 0
# compatibility_mode=5892 16776573 100 100 31010 181197135 0 0
# compatibility_mode=8192 67108863 100 0 150 150 0 0
# scanned=154965
# found=5
# cleaned=5
# scan_time=17008
C:\_OTL\MovedFiles\07252012_185452\C_Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarApp.dll a variant of Win32/Toolbar.Babylon application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\07252012_185452\C_Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarEng.dll Win32/Toolbar.Babylon application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\07252012_185452\C_Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarsrv.exe probably a variant of Win32/Toolbar.Babylon application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\07252012_185452\C_Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll Win32/Toolbar.Babylon application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTL\MovedFiles\07252012_185452\C_Programme\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll Win32/Toolbar.Babylon application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

t'john 31.07.2012 09:08
Zitat:
Das was du da als erstes geschrieben hast habe ich doch schon gemacht und auch gepostet...
Wo ist dann das Log vom ersten Teil meines Beitrags?

puckikater 31.07.2012 15:28
Der steht im vorletzten Beitrag von mir.

Hier ist er nochmal:
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 30.07.2012 09:44:05

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn: 30.07.2012 09:44:33


Gescannt 592592
Gefunden 0

Scan Ende: 30.07.2012 11:25:05
Scan Zeit: 1:40:32

Hier der Log von Combofix:
Combofix Logfile:
Code:
ComboFix 12-07-30.03 - Annette 31.07.2012  9:40.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.2557.1139 [GMT 2:00]
ausgeführt von:: c:\users\Annette\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Annette\AppData\Roaming\.#
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_usnjsvc
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-06-28 bis 2012-07-31  ))))))))))))))))))))))))))))))
.
.
2012-07-31 08:34 . 2012-07-31 08:34        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0C096432-4364-48D2-B416-8307C7746B3D}\offreg.dll
2012-07-31 08:14 . 2012-06-29 08:44        6891424        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0C096432-4364-48D2-B416-8307C7746B3D}\mpengine.dll
2012-07-31 07:52 . 2012-07-31 14:13        --------        d-----w-        c:\users\Annette\AppData\Local\temp
2012-07-31 07:52 . 2012-07-31 07:52        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-07-30 07:41 . 2012-07-30 16:03        --------        d-----w-        c:\program files\Emsisoft Anti-Malware
2012-07-25 16:54 . 2012-07-25 16:54        --------        d-----w-        C:\_OTL
2012-07-25 16:48 . 2012-07-25 16:48        --------        d-----w-        c:\users\Annette\AppData\Roaming\Avira
2012-07-24 13:58 . 2012-07-24 13:58        --------        d-----w-        c:\users\Annette\AppData\Roaming\Malwarebytes
2012-07-24 13:57 . 2012-07-24 13:57        --------        d-----w-        c:\programdata\Malwarebytes
2012-07-24 13:57 . 2012-07-24 13:57        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-07-24 13:57 . 2012-07-03 11:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-07-24 13:45 . 2012-07-25 16:49        66616        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-07-24 13:45 . 2012-07-25 16:49        138192        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-07-24 13:45 . 2012-07-24 13:45        --------        d-----w-        c:\programdata\Avira
2012-07-24 13:45 . 2012-07-24 13:45        --------        d-----w-        c:\program files\Avira
2012-07-14 07:53 . 2012-06-13 13:40        2047488        ----a-w-        c:\windows\system32\win32k.sys
2012-07-13 16:23 . 2012-06-05 16:47        708608        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll
2012-07-13 16:23 . 2012-06-05 16:47        1401856        ----a-w-        c:\windows\system32\msxml6.dll
2012-07-13 16:23 . 2012-06-05 16:47        1248768        ----a-w-        c:\windows\system32\msxml3.dll
2012-07-13 16:23 . 2012-06-04 15:26        440704        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
2012-07-13 16:23 . 2012-06-02 00:04        278528        ----a-w-        c:\windows\system32\schannel.dll
2012-07-13 16:23 . 2012-06-02 00:03        204288        ----a-w-        c:\windows\system32\ncrypt.dll
2012-07-08 14:34 . 2012-07-08 14:34        --------        d-----w-        c:\program files\Xvid
2012-07-08 14:34 . 2011-06-24 14:44        243200        ----a-w-        c:\windows\system32\xvidvfw.dll
2012-07-08 14:34 . 2011-06-24 14:28        650752        ----a-w-        c:\windows\system32\xvidcore.dll
2012-07-08 14:34 . 2011-06-24 13:58        153088        ----a-w-        c:\windows\system32\xvid.ax
2012-07-08 14:34 . 2012-07-08 14:34        --------        d-----w-        c:\program files\Video Codec
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-02 22:19 . 2012-06-24 14:09        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-24 14:09        45080        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-24 14:09        35864        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-24 14:09        577048        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2012-06-24 14:09        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 22:12 . 2012-06-24 14:09        2422272        ----a-w-        c:\windows\system32\wucltux.dll
2012-06-02 22:12 . 2012-06-24 14:09        88576        ----a-w-        c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-24 14:09        171904        ----a-w-        c:\windows\system32\wuwebv.dll
2012-06-02 13:12 . 2012-06-24 14:09        33792        ----a-w-        c:\windows\system32\wuapp.exe
2012-05-31 10:25 . 2011-05-26 00:09        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-05-15 06:37 . 2012-06-14 15:55        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-05-15 06:32 . 2012-06-14 15:55        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-05-15 06:32 . 2012-06-14 15:55        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-05-15 06:31 . 2012-06-14 15:55        109056        ----a-w-        c:\windows\system32\iesysprep.dll
2012-05-15 06:31 . 2012-06-14 15:55        71680        ----a-w-        c:\windows\system32\iesetup.dll
2012-05-15 05:01 . 2012-06-14 15:55        385024        ----a-w-        c:\windows\system32\html.iec
2012-05-15 03:26 . 2012-06-14 15:55        133632        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-05-15 03:23 . 2012-06-14 15:55        1638912        ----a-w-        c:\windows\system32\mshtml.tlb
2012-07-19 15:32 . 2011-05-31 09:39        136672        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2006-11-02 . 22BFD03DF51065A9ED8D17F8FB72296B . 8704 . . [6.0.6000.16386] . . c:\windows\System32\ctfmon.exe
[-] 2006-11-02 . 22BFD03DF51065A9ED8D17F8FB72296B . 8704 . . [6.0.6000.16386] . . c:\windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.0.6000.16386_none_9af9cad793a67953\ctfmon.exe
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-05-14 15:05        121392        ----a-w-        c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"HW_OPENEYE_OUC_Telekom Internet Manager"="c:\program files\Telekom\InternetManager_H\UpdateDog\ouc.exe" [2009-12-31 110592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-20 6144000]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-05-09 397312]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-05-14 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-05-30 544768]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-02-13 1033512]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-16 821768]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-05-12 147456]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 167936]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 167936]
"ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-17 13552160]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-17 92704]
"DataCardMonitor"="c:\program files\Telekom\InternetManager_H\DataCardMonitor.exe" [2011-05-07 253952]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Startcenter.lnk - c:\windows\Installer\{2457326B-C110-40C3-89B0-889CC913871A}\Icon2457326B4.exe [2010-11-29 29184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=1008&m=aspire_7530g
uSearchURL,(Default) = hxxp://g.msn.de/0SEDEDE/SAOS01?FORM=TOOLBR
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Free YouTube to MP3 Converter - c:\users\Annette\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.5.3&q=
pref('extensions.shownSelectionUI',true); pref('extensions.autoDisableScopes',0);FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109868&tt=010712_4
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - aebfd44b0000000000000017c432b805
FF - user.js: extensions.BabylonToolbar_i.hardId - aebfd44b0000000000000017c432b805
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15529
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1716:34
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-BabylonToolbar - c:\program files\BabylonToolbar\BabylonToolbar\1.5.3.17\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-07-31 16:13
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  DataCardMonitor = c:\program files\Telekom\InternetManager_H\DataCardMonitor.exe?????E????????????gy\eDataSecurity???D??????2?????????????????????_???????0=??????am Files\Telekom\InternetManager_H\?PM32????????c:\program files\Telekom\InternetManager_H\?PM32????????0=??????
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3760)
c:\windows\system32\NVSVC.DLL
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\sysenv.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\windows\system32\rundll32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
c:\program files\FRITZ!DSL\IGDCTRL.EXE
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\TeamViewer\Version4\TeamViewer_Service.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
c:\windows\system32\conime.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-31  16:18:17 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-31 14:18
.
Vor Suchlauf: 11 Verzeichnis(se), 89.034.276.864 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 87.738.511.360 Bytes frei
.
- - End Of File - - 5396713978558BBDD8D1240D99E89C19
--- --- ---

Entschuldige!
Aus irgendeinem Grund habe ich das Emisoft-Ding mit dem ADW-Ding verwechselt...
Unten kommt dann der Bericht.
Ist das jetzt sehr schlimm und muss ich von da nochmal anfangen?

Bericht:
# AdwCleaner v1.703 - Logfile created 07/31/2012 at 16:48:25
# Updated 20/07/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : Annette - ANNETTE-PC
# Running from : C:\Users\Annette\Desktop\Virusprogramme\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Annette\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\Annette\AppData\LocalLow\boost_interprocess

***** [Registry] *****

Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Babylon
Key Deleted : HKLM\SOFTWARE\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\b
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Deleted : HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83AA2913-C123-4146-85BD-AD8F93971D39}

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.19272

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.babylon.com/?affID=109868&tt=010712_4&babsrc=NT_ss&mntrId=aebfd44b0000000000000017c432b805 --> hxxp://www.google.com

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default
File : C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\prefs.js

C:\Users\Annette\AppData\Roaming\Mozilla\Firefox\Profiles\pkxyjz9n.default\user.js ... Deleted !

Deleted : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Deleted : user_pref("browser.newtab.url", "hxxp://search.babylon.com/?affID=109868&tt=010712_4&babsrc=NT_ss&mn[...]
Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");
Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=109868&tt=010712_4");
Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "aebfd44b0000000000000017c432b805");
Deleted : user_pref("extensions.BabylonToolbar_i.id", "aebfd44b0000000000000017c432b805");
Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15529");
Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Deleted : user_pref("extensions.BabylonToolbar_i.newTab", true);
Deleted : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=109868&tt=01071[...]
Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1716:34:15");
Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

*************************

AdwCleaner[R1].txt - [6805 octets] - [26/07/2012 20:14:15]
AdwCleaner[R2].txt - [6865 octets] - [26/07/2012 20:14:56]
AdwCleaner[S1].txt - [7136 octets] - [31/07/2012 16:48:25]

########## EOF - C:\AdwCleaner[S1].txt - [7264 octets] ##########


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:47 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19