Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Cyber Crime Investigation Department Virus (https://www.trojaner-board.de/123490-cyber-crime-investigation-department-virus.html)

Raphael3006 04.09.2012 17:22
Cyber Crime Investigation Department Virus
 
Habe mich so eben in diesem Forum registriert, da ich wie der Titel des Threads schon verrät ein Problem mit dem Virus des Cyber Crime Investigation Departments Austria habe.

Am betroffenen PC, von welchem ich auch aus gerade schreibe (verschiedene Benutzerkonten und nur meines ist betroffen) tritt dieser Virus nun seit gestern auf.
Sobald ich mich auf meinem Benutzerkonto anmelde verschwindet der Desktop und weicht einer Meldung des "Cyber Crime Investigation Departments Austria".
Die Meldung verschwindet nicht mehr und der Computer kann nur durch drücken des Power Knopfes wieder hinuntergefahren werden.

Da ich aber nun absolut keine Ahnung von EDV, Computer, Computerbegriffen und dergleichen habe, wende ich mich nun an euch und wollte ich bitten mit vielleicht auch für mich verständlich zu erklären was für Lösungen es da gibt.


Vielen Dank schon im Vorraus!
LG

t'john 04.09.2012 20:42
:hallo:

geht der abgesicherte Modus?


ansonsten:


Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:


Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.
  • Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

Raphael3006 04.09.2012 20:56
Danke für deine Antwort!
Ja der abgesicherte Modus funktioniert!
Gibt es deshalb noch eine weitere Möglichkeit?
LG

t'john 05.09.2012 14:01
Von einem sauberen PC OTL.exe runterladen auf USB Stick.
Infizierten Rechner ohne Internet starten. OTL.exe auf Desktop kopieren und Log erstellen.
Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.

Raphael3006 06.09.2012 11:55
OTL Logfile:
Code:
OTL logfile created on: 06.09.2012 12:33:42 - Run 1
OTL by OldTimer - Version 3.2.61.0    Folder = E:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 65,21% Memory free
3,35 Gb Paging File | 2,51 Gb Available in Paging File | 75,09% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 155,06 Gb Free Space | 66,58% Space Free | Partition Type: NTFS
Drive E: | 7,50 Gb Total Space | 7,50 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: HAMARASA | User Name: Raphael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - E:\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Programme\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)
PRC - C:\Programme\Microsoft\BingBar\7.1.391.0\BBSvc.EXE (Microsoft Corporation.)
PRC - C:\Programme\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Kaspersky Lab ZAO)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Programme\AutoInstall\ZD1211B_Auto_Install_CD_Only_Gen_0ACE20FF\AutoEJCD.EXE ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\WLAN_Software\ZD1211B\ZDWLan.EXE ()
PRC - C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
PRC - C:\Programme\Steam\Steam.exe (Valve Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\WINDOWS\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
PRC - C:\Programme\SEC\MagicTune3.6\GammaTray.exe ()
PRC - C:\Programme\SEC\Natural Color Pro\NCProTray.exe (Samsung)
PRC - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
PRC - C:\Programme\CASIO\Photo Loader\Plauto.exe (CASIO COMPUTER CO.,LTD.)
PRC - C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe ()
PRC - C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe (Hewlett-Packard)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Alwil Software\Avast5\defs\12090600\algo.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
MOD - C:\Programme\AutoInstall\ZD1211B_Auto_Install_CD_Only_Gen_0ACE20FF\AutoEJCD.EXE ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SkinuxCmp.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SkinuxCommon.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SkinuxBase.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SkinuxXML2.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SkinuxIm.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocVistaControls.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SkinuxProc.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SkinuxFF.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocVistaCDBackup.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocVistaPrintOnLine.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\MEshim.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\areaifdll.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\ESSkin.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\ESEmail.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\ESCom.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\KFx.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\Atlas.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\AppCore.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\VistaControls.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\Pcd.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocESEmail.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\kpries40.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\keml40.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\UpdateChecker.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\DibLibIP.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocCamBack.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocVistaAdapter.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\bin\locPcd.dll ()
MOD - C:\Programme\WLAN_Software\ZD1211B\ZDWLan.EXE ()
MOD - C:\Programme\WLAN_Software\ZD1211B\ZDWlan.DLL ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\AddIn\VistaPCD.cyx ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\AddIn\VPCD.dll ()
MOD - C:\Programme\Kodak\Kodak EasyShare software\AddIn\LocVistaPCD.dll ()
MOD - C:\Programme\SEC\MagicTune3.6\GammaTray.exe ()
MOD - C:\Programme\WLAN_Software\ZD1211B\dot1x_dll.dll ()
MOD - C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
MOD - C:\Programme\Kodak\KODAK Software Updater\7288971\6.3.2.62-7288971L\Program\bwfiles.dll ()
MOD - C:\Programme\Kodak\KODAK Software Updater\7288971\6.3.2.62-7288971L\Program\FrExt.dll ()
MOD - C:\Programme\Kodak\KODAK Software Updater\7288971\6.3.2.62-7288971L\Program\clntutil.dll ()
MOD - C:\Programme\Kodak\KODAK Software Updater\7288971\Program\BWTargetInf.dll ()
MOD - C:\Programme\Kodak\KODAK Software Updater\7288971\Program\frext-7288971.dll ()
MOD - C:\Programme\Kodak\KODAK Software Updater\7288971\Program\BWfiles-7288971.dll ()
MOD - C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnfps.dll ()
MOD - C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe ()
 
 
========== Services (SafeList) ==========
 
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (Skype C2C Service) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (BBUpdate) -- C:\Programme\Microsoft\BingBar\7.1.391.0\SeaPort.EXE (Microsoft Corporation.)
SRV - (BBSvc) -- C:\Programme\Microsoft\BingBar\7.1.391.0\BBSvc.EXE (Microsoft Corporation.)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (KSS) -- C:\Programme\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Kaspersky Lab ZAO)
SRV - (Steam Client Service) -- C:\Programme\Gemeinsame Dateien\Steam\SteamService.exe (Valve Corporation)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (UPnPService) -- C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe (Magix AG)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (LightScribeService) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Pml Driver HPH11) -- C:\WINDOWS\system32\hphipm11.exe (HP)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (AtiHdmiService) -- C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (ZDPSp50) -- C:\WINDOWS\system32\drivers\ZDPSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ZD1211BU(Atheros) -- C:\WINDOWS\system32\drivers\ZD1211BU.sys (Atheros Technology Corporation)
DRV - (PAC207) -- C:\WINDOWS\system32\drivers\PFC027.SYS (PixArt Imaging Inc.)
DRV - (atksgt) -- C:\WINDOWS\system32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\WINDOWS\system32\drivers\lirsgt.sys ()
DRV - (AFS2K) -- C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (cusbohcn) -- C:\Dokumente und Einstellungen\Harald\Lokale Einstellungen\Temp\cusbohcn.sys ()
DRV - (NCPro) -- C:\WINDOWS\system32\drivers\MTiCtwl.sys ()
DRV - (MagicTune) -- C:\WINDOWS\system32\drivers\MTiCtwl.sys ()
DRV - (xfilt) -- C:\WINDOWS\system32\drivers\xfilt.sys (VIA Technologies,Inc)
DRV - (videX32) -- C:\WINDOWS\system32\drivers\videX32.sys (VIA Technologies, Inc.)
DRV - (SenFiltService) -- C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (Afc) -- C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (netrcacm) -- C:\WINDOWS\system32\drivers\netrcacm.sys (Thomson Inc.)
DRV - (Dot4 HPH11) -- C:\WINDOWS\system32\drivers\hphid411.sys (HP)
DRV - (Dot4Storage HPH11) -- C:\WINDOWS\system32\drivers\hphs2k11.sys (Hewlett-Packard)
DRV - (Dot4Usb HPH11) -- C:\WINDOWS\system32\drivers\hphius11.sys (HP)
DRV - (Dot4Print HPH11) -- C:\WINDOWS\system32\drivers\hphipr11.sys (HP)
DRV - (QV2KUX) -- C:\WINDOWS\system32\drivers\qv2kux.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://eu.ask.com/web?l=dis&o=APN10020&gct=hp&apn_dtid=^YYYYYY^YY^AT&apn_ptnrs=^A4G &apn_uid=3023599007924021&p2=^A4G ^YYYYYY^YY^AT
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8D 21 77 5F 3A CC CA 01  [binary data]
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {cd8812d4-e5b8-41c6-94d4-59872a484bf1} - C:\Programme\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll ()
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKCU\..\SearchScopes\{AE5E0ACB-8C76-4BA0-B302-AA9097CF7E13}: "URL" = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}: "URL" = hxxp://eu.ask.com/web?l=dis&o=APN10020&gct=sb&qsrc=2869&apn_dtid=^YYYYYY^YY^AT&apn_ptnrs=^A4G &apn_uid=3023599007924021&p2=^A4G ^YYYYYY^YY^AT&q={searchTerms}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = hxxp://search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://go.microsoft.com/fwlink/?LinkId=69157"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.16749
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.8
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.5&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Programme\Alwil Software\Avast5\WebRep\FF [2012.09.04 08:15:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.08.30 18:09:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.06.12 08:27:13 | 000,000,000 | ---D | M]
 
[2011.03.13 13:10:44 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Extensions
[2012.05.02 18:44:24 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions
[2011.03.25 14:54:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008.02.26 22:10:47 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2012.04.01 04:59:59 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.07.06 16:05:22 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.02.20 13:29:39 | 000,000,000 | ---D | M] (DVD Video Soft Toolbar) -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\{cd8812d4-e5b8-41c6-94d4-59872a484bf1}
[2012.06.22 13:54:52 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com
[2012.08.28 11:56:00 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-1.xml
[2011.09.29 15:28:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-10.xml
[2011.10.03 13:50:49 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-11.xml
[2011.11.17 11:30:41 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-12.xml
[2011.11.24 22:02:36 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-13.xml
[2011.12.01 13:11:03 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-14.xml
[2011.12.24 13:49:58 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-15.xml
[2012.01.02 09:32:44 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-16.xml
[2012.01.04 18:42:18 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-17.xml
[2011.03.25 15:44:17 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-2.xml
[2011.05.02 18:58:46 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-3.xml
[2011.06.23 12:59:50 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-4.xml
[2011.06.24 14:38:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-5.xml
[2011.08.17 13:15:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-6.xml
[2011.08.19 16:20:36 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-7.xml
[2011.09.05 14:56:11 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-8.xml
[2011.09.09 11:17:59 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-9.xml
[2011.03.21 14:05:33 | 000,000,947 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin.xml
[2012.02.21 14:45:34 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.08.28 14:02:00 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.08.30 18:09:48 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.20 13:30:02 | 000,002,276 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\ask.xml
[2012.08.30 18:09:37 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2009.01.12 09:34:07 | 000,002,384 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\seekeen.xml
[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 13:02:53 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Programme\Google\Chrome\Application\20.0.1132.47\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\20.0.1132.47\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\20.0.1132.47\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Programme\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.230.5 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U23 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Programme\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Programme\Microsoft\Office Live\npOLW.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Programme\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Programme\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\WINDOWS\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Programme\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google-Suche = C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Skype Click to Call = C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\
CHR - Extension: Skype Click to Call = C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.0.0.10297_0\
CHR - Extension: Google Mail = C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,795 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7529.1424\swg.dll (Google Inc.)
O2 - BHO: (DVD Video Soft Toolbar) - {cd8812d4-e5b8-41c6-94d4-59872a484bf1} - C:\Programme\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll ()
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\Microsoft\BingBar\7.1.391.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (DVD Video Soft Toolbar) - {cd8812d4-e5b8-41c6-94d4-59872a484bf1} - C:\Programme\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AutoEJCD_0ACE20FF] C:\Programme\AutoInstall\ZD1211B_Auto_Install_CD_Only_Gen_0ACE20FF\AutoEJCD.EXE ()
O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
O4 - HKLM..\Run: [HPHUPD04] C:\Programme\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Monitor] C:\WINDOWS\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZDWLan_Utility] C:\Programme\WLAN_Software\ZD1211B\ZDWLan.EXE ()
O4 - HKCU..\Run: [Power2GoExpress]  File not found
O4 - HKCU..\Run: [Steam] C:\Programme\Steam\Steam.exe (Valve Corporation)
O4 - HKLM..\RunOnceEx: []  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Color Calibration.lnk = C:\Programme\SEC\MagicTune3.6\GammaTray.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Kodak EasyShare Software.lnk = C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\KODAK Software Updater.lnk = C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\MagicTune 3.6.lnk = C:\Programme\SEC\MagicTune3.6\MagicTuneTray.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\NCProTray.lnk = C:\Programme\SEC\Natural Color Pro\NCProTray.exe (Samsung)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Photo Loader resident.lnk = C:\Programme\CASIO\Photo Loader\Plauto.exe (CASIO COMPUTER CO.,LTD.)
O4 - Startup: C:\Dokumente und Einstellungen\Raphael\Startmenü\Programme\Autostart\autobit.lnk =  File not found
O4 - Startup: C:\Dokumente und Einstellungen\Raphael\Startmenü\Programme\Autostart\Xfire.lnk = C:\Programme\Xfire\Xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Windows &Live Favorites - hxxp://favorites.live.com/quickadd.aspx File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/OAS/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase2895.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1188927710585 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5257/mcfscan.cab (McFreeScan Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 195.34.133.21 212.186.211.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9DB90D99-E87B-4D6D-9378-4633E00A2CD3}: DhcpNameServer = 195.34.133.21 212.186.211.21
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Programme\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.11.17 09:33:53 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.03 10:42:41 | 000,000,000 | ---D | C] -- C:\Programme\Kaspersky Lab
[2012.09.03 10:42:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Kaspersky Lab
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.06 12:44:02 | 000,000,230 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.09.06 12:40:53 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.09.06 12:37:03 | 001,862,389 | ---- | M] () -- C:\logfile
[2012.09.06 12:32:42 | 000,000,274 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Desktop\Verknüpfung mit OTL.lnk
[2012.09.06 12:30:35 | 000,001,374 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.09.06 12:23:25 | 000,000,266 | ---- | M] () -- C:\WINDOWS\tasks\HP Usg Login.job
[2012.09.06 12:23:25 | 000,000,266 | ---- | M] () -- C:\WINDOWS\tasks\HP Usg Daily.job
[2012.09.06 12:23:18 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012.09.06 12:21:06 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.06 12:20:53 | 000,000,400 | ---- | M] () -- C:\WINDOWS\tasks\PCConfidential.job
[2012.09.06 12:20:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.09.06 12:20:38 | 2145,898,496 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.05 22:04:00 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.09.05 21:54:02 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.05 19:03:05 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{CD5C12A5-37FB-4AE3-AEC9-3C7C0184EB36}.job
[2012.09.05 15:21:11 | 000,001,984 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.09.05 11:00:03 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2012.09.04 18:07:04 | 000,512,792 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.09.04 18:07:04 | 000,465,402 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.09.04 18:07:04 | 000,081,684 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.09.04 18:07:03 | 000,106,978 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.09.04 13:17:26 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nud0repor.pad
[2012.09.04 08:15:11 | 000,003,002 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012.09.03 10:47:27 | 000,002,409 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk
[2012.09.01 12:30:53 | 001,328,128 | R--- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mb
[2012.09.01 12:30:52 | 002,660,352 | R--- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\ESBK.mbb
[2012.08.29 13:13:37 | 000,219,248 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.08.29 12:06:50 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.08.28 12:04:09 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012.08.28 12:04:09 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.08.28 11:07:12 | 000,000,561 | ---- | M] () -- C:\hpfr5550.xml
[2012.08.21 11:13:15 | 000,729,752 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012.08.21 11:13:15 | 000,355,632 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012.08.21 11:13:15 | 000,054,232 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012.08.21 11:13:14 | 000,097,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012.08.21 11:13:14 | 000,089,624 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012.08.21 11:13:14 | 000,035,928 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012.08.21 11:13:13 | 000,025,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012.08.21 11:13:13 | 000,021,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012.08.21 11:12:33 | 000,041,224 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012.08.21 11:12:23 | 000,227,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.09.06 12:32:47 | 000,000,274 | ---- | C] () -- C:\Dokumente und Einstellungen\Raphael\Desktop\Verknüpfung mit OTL.lnk
[2012.09.06 12:23:03 | 000,000,266 | ---- | C] () -- C:\WINDOWS\tasks\HP Usg Login.job
[2012.09.06 12:22:58 | 000,000,266 | ---- | C] () -- C:\WINDOWS\tasks\HP Usg Daily.job
[2012.09.04 18:02:55 | 2145,898,496 | -HS- | C] () -- C:\hiberfil.sys
[2012.09.04 08:15:10 | 000,000,310 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012.09.03 01:16:32 | 004,503,728 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nud0repor.pad
[2012.02.18 15:48:00 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.10.16 12:36:40 | 000,000,525 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2011.08.16 23:33:11 | 000,003,087 | ---- | C] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\PData.MMM
[2011.08.16 23:33:11 | 000,003,087 | ---- | C] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\PData.MM1
[2011.03.24 10:57:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.06.24 07:41:43 | 018,499,623 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vlc-1.0.5-win32.exe
[2009.12.19 15:41:20 | 018,030,130 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vlc-1.0.3-win32.exe
[2008.03.20 22:23:12 | 000,033,792 | ---- | C] () -- C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.01.06 18:40:40 | 000,001,755 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2007.01.15 19:52:51 | 000,000,000 | -H-- | C] () -- C:\Dokumente und Einstellungen\Raphael\hpothb07.tif
[2007.01.15 19:52:51 | 000,000,000 | -H-- | C] () -- C:\Dokumente und Einstellungen\Raphael\hpothb07.dat
[2007.01.15 19:52:43 | 000,000,253 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\hpothb07.tif
[2007.01.15 19:52:43 | 000,000,169 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\hpothb07.dat
[2007.01.15 14:10:46 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

< End of report >
--- --- ---










OTL Logfile:
Code:
OTL Extras logfile created on: 06.09.2012 12:33:42 - Run 1
OTL by OldTimer - Version 3.2.61.0    Folder = E:\
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,30 Gb Available Physical Memory | 65,21% Memory free
3,35 Gb Paging File | 2,51 Gb Available in Paging File | 75,09% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,88 Gb Total Space | 155,06 Gb Free Space | 66,58% Space Free | Partition Type: NTFS
Drive E: | 7,50 Gb Total Space | 7,50 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
 
Computer Name: HAMARASA | User Name: Raphael | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"6112:TCP" = 6112:TCP:*:Enabled:wc3
"6112:UDP" = 6112:UDP:*:Enabled:wc3
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Dokumente und Einstellungen\Harald\Eigene Dateien\Downloads\Xfire\Xfire.exe" = C:\Dokumente und Einstellungen\Harald\Eigene Dateien\Downloads\Xfire\Xfire.exe:*:Enabled:Xfire
"C:\Programme\QuickTime\QuickTimePlayer.exe" = C:\Programme\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Ressourcendatei -- (Apple Inc.)
"C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" = C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Enabled:Kodak Software Updater -- ()
"C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- (Eastman Kodak Company)
"C:\Programme\Die Gilde 2\GuildII.exe" = C:\Programme\Die Gilde 2\GuildII.exe:*:Disabled:Anwendung GuildII -- (4HEAD Studios)
"C:\Games\Fussball Challenge 2008 (ORF)\Game.exe" = C:\Games\Fussball Challenge 2008 (ORF)\Game.exe:*:Disabled:Game
"C:\Programme\GameSpy Arcade\Aphex.exe" = C:\Programme\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade
"C:\Programme\Sierra\Empire Earth II\EE2.exe" = C:\Programme\Sierra\Empire Earth II\EE2.exe:*:Enabled:Empire Earth II -- (Mad Doc Software)
"C:\Programme\LimeWire\LimeWire.exe" = C:\Programme\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Programme\Outlook Express\msimn.exe" = C:\Programme\Outlook Express\msimn.exe:*:Enabled:Outlook Express -- (Microsoft Corporation)
"C:\Programme\Poker.com\client.exe" = C:\Programme\Poker.com\client.exe:*:Enabled:PDC Poker Client -- ()
"C:\Dokumente und Einstellungen\All Users\Dokumente\Spiele\Warcraft III\Warcraft III.exe" = C:\Dokumente und Einstellungen\All Users\Dokumente\Spiele\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- (Blizzard Entertainment)
"C:\Programme\Warcraft III\Warcraft III.exe" = C:\Programme\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III -- ()
"C:\Programme\DotAlicious Gaming Client\client.exe" = C:\Programme\DotAlicious Gaming Client\client.exe:*:Enabled:client -- ()
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Dokumente und Einstellungen\Raphael\Eigene Dateien\My Games\Meine empfangenen Dateien\World Series of Poker TOC\WSOPTOC.exe" = C:\Dokumente und Einstellungen\Raphael\Eigene Dateien\My Games\Meine empfangenen Dateien\World Series of Poker TOC\WSOPTOC.exe:*:Enabled:WSOPTOC -- ()
"C:\Programme\dvdvideosofttoolbar\dtUser.exe" = C:\Programme\dvdvideosofttoolbar\dtUser.exe:*:Enabled:DVD Video Soft Toolbar DTX Broker -- (Visicom Media Inc.)
"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Programme\Steam\Steam.exe" = C:\Programme\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Programme\Steam\SteamApps\common\dota 2 beta\dota.exe" = C:\Programme\Steam\SteamApps\common\dota 2 beta\dota.exe:*:Enabled:Dota 2 -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier
"{01A717F7-9223-438C-9343-775E61021386}" = Playway 3 Übungs-CD-ROM Units 1 bis 3
"{02B244A2-7F6A-42E8-A36F-8C385D7A1625}" = Gothic III
"{03EDED24-8375-407D-A721-4643D9768BE1}" = kgchlwn
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{0D396571-7BBD-44CE-ABB3-518BF86B72F7}" = HP Photo and Imaging 2.0 - Photosmart Printer Series
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{11F3F858-4131-4FFA-A560-3FE282933B6E}" = kgchday
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{12DCDE3D-5C8E-4C5E-A7E4-CEF30F578179}" = Dogz 5
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}" = Bing Bar
"{1C04D433-2EDF-4AFB-B31B-C0B13065092F}" = MagicTune3.6
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{244E21B9-164C-4EC1-AED8-9BD64161E66D}" = ArcSoft VideoImpression 2
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 23
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{30837A37-8F9F-4817-8B52-C501B67DC3BE}" = Trust WB-1400T Webcam
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F50AF3B-8997-4916-0095-99D63DDB785A}" = Harry Potter TM
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 4.0
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{544FB392-069D-4BA5-9DC7-FFD47230AEE5}" = Photohands 1.0G
"{56009CA3-423B-41F8-884A-E5B049534F15}" = Kaspersky Security Scan
"{56AB063D-1450-4BDE-9F0D-E9C693429C51}" = netbrdg
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate
"{5A9AA2C0-972F-4239-AA41-E409434194D5}" = MobileMe Control Panel
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{65D85050-5610-4A91-A3B1-D5C744291AD4}" = PCDADDIN
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{693C08A7-9E76-43FF-B11E-9A58175474C4}" = kgckids
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{70B45586-B51E-4947-A258-A895596C5CED}" = Photo Loader 2.1G
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{831ADB7A-8882-41B1-82F7-2746FEC3FA91}" = Crazy Taxi 3
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8A8664E1-84C8-4936-891C-BC1F07797549}" = kgcvday
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90AF0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9BD54685-1496-46A5-AB62-357CD140ED8B}" = kgcinvt
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A1588373-1D86-4D44-86C9-78ABD190F9CC}" = kgcmove
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe® Photoshop® Album Starter Edition 3.2
"{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Speicher-Disc
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint 1.0
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C99DCDA4-7407-4F72-A77E-C81C551D0C4E}" = PCDHELP
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare Software
"{D5A9B7C0-8751-11D8-9D75-000129760D75}" = MediaShow 3.0
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{D755C7A3-C03E-4460-8C00-AC6E55505FB5}" = LightScribe  1.4.74.1
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E18B549C-5D15-45DA-8D8F-8FD2BD946344}" = kgcbaby
"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}" = tooltips
"{EDE721EC-870A-11D8-9D75-000129760D75}" = PowerDirector Express
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FC2C7405-BC58-4E11-8F51-29671BEAC06B}" = Natural Color Pro
"{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe® Photoshop® Album Starter Edition 3.2" = Adobe® Photoshop® Album Starter Edition 3.2
"ATI Display Driver" = ATI Display Driver
"avast" = avast! Free Antivirus
"Barbie(tm) Strandurlaub" = Barbie(tm) Strandurlaub
"DotAlicious Gaming Client" = DotAlicious Gaming Client
"dvdvideosofttoolbar" = DVD Video Soft Toolbar
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.15.1228
"Google Chrome" = Google Chrome
"hphuni04" = Photosmart 130,230,7150,7345,7350,7550 (nur entfernen)
"ICQToolbar" = ICQ Toolbar
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{30837A37-8F9F-4817-8B52-C501B67DC3BE}" = Trust WB-1400T Webcam
"InstallShield_{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45}" = Age of Empires III
"InstallWIX_{56009CA3-423B-41F8-884A-E5B049534F15}" = Kaspersky Security Scan
"LimeWire" = LimeWire 4.18.6
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"MTK3" = Meine Tierklinik in Australien
"Mufin MusicFinder Base D" = Mufin MusicFinder Base 1.5.3.250 (D)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Seekeen" = Seekeen 1.0 build 126
"TheGuild2" = Die Gilde 2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.2
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"Warcraft III" = Warcraft III
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WIC" = Windows Imaging Component
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar
"Zoo Tycoon 1.0" = Zoo Tycoon-Erweiterungen
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Warcraft III" = Warcraft III
 
========== Last 20 Event Log Errors ==========
 
[ Antivirus Events ]
Error - 18.06.2010 15:05:41 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 19.06.2010 03:12:22 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 23.06.2010 10:43:31 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 24.06.2010 11:47:35 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 25.06.2010 06:44:42 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 25.06.2010 06:44:42 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 25.06.2010 06:44:50 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 01.07.2010 15:22:57 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 02.07.2010 03:46:10 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
Error - 18.07.2010 09:40:34 | Computer Name = HAMARASA | Source = avast! | ID = 33554522
Description =
 
[ Application Events ]
Error - 04.09.2012 01:08:33 | Computer Name = HAMARASA | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11138563
 
Error - 04.09.2012 01:08:35 | Computer Name = HAMARASA | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 04.09.2012 01:08:35 | Computer Name = HAMARASA | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11140531
 
Error - 04.09.2012 01:08:35 | Computer Name = HAMARASA | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11140531
 
Error - 04.09.2012 07:13:34 | Computer Name = HAMARASA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 04.09.2012 12:03:45 | Computer Name = HAMARASA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 05.09.2012 04:21:33 | Computer Name = HAMARASA | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
 nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
 
Error - 05.09.2012 06:03:48 | Computer Name = HAMARASA | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung Skype.exe, Version 5.10.0.116, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 05.09.2012 06:40:41 | Computer Name = HAMARASA | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung dota.exe, Version 0.0.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 05.09.2012 06:43:12 | Computer Name = HAMARASA | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ System Events ]
Error - 04.09.2012 11:55:05 | Computer Name = HAMARASA | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "WSearch"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
Error - 04.09.2012 11:55:31 | Computer Name = HAMARASA | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 04.09.2012 11:57:44 | Computer Name = HAMARASA | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "netman"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {BA126AE5-2166-11D1-B1D0-00805FC1270E}
 
Error - 04.09.2012 12:01:46 | Computer Name = HAMARASA | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 04.09.2012 12:05:14 | Computer Name = HAMARASA | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  NCPro
 
Error - 05.09.2012 04:23:06 | Computer Name = HAMARASA | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  NCPro
 
Error - 05.09.2012 04:23:41 | Computer Name = HAMARASA | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1053" aufgetreten, als der Dienst "iPod
Service" mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:
{063D34A4-BF84-4B8D-B699-E8CA06504DDE}
 
Error - 05.09.2012 04:24:23 | Computer Name = HAMARASA | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst iPod-Dienst.
 
Error - 05.09.2012 04:24:23 | Computer Name = HAMARASA | Source = Service Control Manager | ID = 7000
Description = Der Dienst "iPod-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
  %%1053
 
Error - 06.09.2012 06:22:51 | Computer Name = HAMARASA | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  NCPro
 
 
< End of report >
--- --- ---

t'john 06.09.2012 18:52
:hallo:

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
:OTL
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (cusbohcn) -- C:\Dokumente und Einstellungen\Harald\Lokale Einstellungen\Temp\cusbohcn.sys ()
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://eu.ask.com/web?l=dis&o=APN10020&gct=hp&apn_dtid=^YYYYYY^YY^AT&apn_ptnrs=^A4G &apn_uid=3023599007924021&p2=^A4G ^YYYYYY^YY^AT
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\URLSearchHook: {cd8812d4-e5b8-41c6-94d4-59872a484bf1} - C:\Programme\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll ()
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKCU\..\SearchScopes\{AE5E0ACB-8C76-4BA0-B302-AA9097CF7E13}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}: "URL" = http://eu.ask.com/web?l=dis&o=APN10020&gct=sb&qsrc=2869&apn_dtid=^YYYYYY^YY^AT&apn_ptnrs=^A4G &apn_uid=3023599007924021&p2=^A4G ^YYYYYY^YY^AT&q={searchTerms}
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://search.yahoo.com/search?fr=mcafee&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "http://go.microsoft.com/fwlink/?LinkId=69157"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.12.2.16749
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.8
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.5&q="
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [AutoEJCD_0ACE20FF] C:\Programme\AutoInstall\ZD1211B_Auto_Install_CD_Only_Gen_0ACE20FF\AutoEJCD.EXE ()
O4 - HKCU..\Run: [Power2GoExpress] File not found
O4 - HKLM..\RunOnceEx: [] File not found
O4 - Startup: C:\Dokumente und Einstellungen\Raphael\Startmenü\Programme\Autostart\autobit.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.11.17 09:33:53 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2010.06.24 07:41:43 | 018,499,623 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vlc-1.0.5-win32.exe
[2009.12.19 15:41:20 | 018,030,130 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vlc-1.0.3-win32.exe
[2012.06.22 13:54:52 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com
[2012.08.28 11:56:00 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-1.xml
[2011.09.29 15:28:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-10.xml
[2011.10.03 13:50:49 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-11.xml
[2011.11.17 11:30:41 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-12.xml
[2011.11.24 22:02:36 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-13.xml
[2011.12.01 13:11:03 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-14.xml
[2011.12.24 13:49:58 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-15.xml
[2012.01.02 09:32:44 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-16.xml
[2012.01.04 18:42:18 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-17.xml
[2011.03.25 15:44:17 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-2.xml
[2011.05.02 18:58:46 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-3.xml
[2011.06.23 12:59:50 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-4.xml
[2011.06.24 14:38:05 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-5.xml
[2011.08.17 13:15:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-6.xml
[2011.08.19 16:20:36 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-7.xml
[2011.09.05 14:56:11 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-8.xml
[2011.09.09 11:17:59 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-9.xml
[2011.03.21 14:05:33 | 000,000,947 | ---- | M] () -- C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin.xml
[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 13:02:53 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
[2012.02.20 13:30:02 | 000,002,276 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\ask.xml
[2012.08.30 18:09:37 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2009.01.12 09:34:07 | 000,002,384 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\seekeen.xml
[2012.09.06 12:44:02 | 000,000,230 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012.09.06 12:40:53 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.09.06 12:23:25 | 000,000,266 | ---- | M] () -- C:\WINDOWS\tasks\HP Usg Login.job
[2012.09.06 12:23:25 | 000,000,266 | ---- | M] () -- C:\WINDOWS\tasks\HP Usg Daily.job
[2012.09.06 12:23:18 | 000,000,310 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012.09.06 12:20:53 | 000,000,400 | ---- | M] () -- C:\WINDOWS\tasks\PCConfidential.job
[2012.09.05 19:03:05 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{CD5C12A5-37FB-4AE3-AEC9-3C7C0184EB36}.job
[2012.09.04 13:17:26 | 004,503,728 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nud0repor.pad
[2012.09.04 08:15:11 | 000,003,002 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
:Files
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.exe
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\*.exe
C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\*.exe
C:\Dokumente und Einstellungen\Raphael\*.exe
C:\Dokumente und Einstellungen\Raphael\Startmenü\Programme\Autostart\ctfmon.lnk
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

3. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.



4. Schritt
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

Raphael3006 07.09.2012 13:33
Erstmal danke für deine zuverlässige Hilfe!
Pc läuft wieder! :knuddel:
Hier die Logs:
Code:
All processes killed
========== OTL ==========
Service ICQ Service stopped successfully!
Service ICQ Service deleted successfully!
C:\Programme\ICQ6Toolbar\ICQ Service.exe moved successfully.
Service WDICA stopped successfully!
Service WDICA deleted successfully!
File  File not found not found.
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
File  File not found not found.
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
File  File not found not found.
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
File  File not found not found.
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
File  File not found not found.
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
File  File not found not found.
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
File  File not found not found.
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
File  File not found not found.
Service Changer stopped successfully!
Service Changer deleted successfully!
File  File not found not found.
Service cusbohcn stopped successfully!
Service cusbohcn deleted successfully!
C:\Dokumente und Einstellungen\Harald\Lokale Einstellungen\Temp\cusbohcn.sys moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cd8812d4-e5b8-41c6-94d4-59872a484bf1} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd8812d4-e5b8-41c6-94d4-59872a484bf1}\ deleted successfully.
C:\Programme\dvdvideosofttoolbar\dvdvideosofttoolbarX.dll moved successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AE5E0ACB-8C76-4BA0-B302-AA9097CF7E13}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE5E0ACB-8C76-4BA0-B302-AA9097CF7E13}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B9C7CE32-DA91-43C2-B7E9-0E9AAFC675CD}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DECA3892-BA8F-44b8-A993-A466AD694AE4}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" removed from browser.search.defaulturl
Prefs.js: "ICQ Search" removed from browser.search.selectedEngine
Prefs.js: "hxxp://go.microsoft.com/fwlink/?LinkId=69157" removed from browser.startup.homepage
Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems
Prefs.js: dvscontextmenuy@dvdvideosoft.com:1.0 removed from extensions.enabledItems
Prefs.js: toolbar@ask.com:3.12.2.16749 removed from extensions.enabledItems
Prefs.js: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.8 removed from extensions.enabledItems
Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.5&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}\ deleted successfully.
C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
File C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
File C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Programme\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AutoEJCD_0ACE20FF deleted successfully.
C:\Programme\AutoInstall\ZD1211B_Auto_Install_CD_Only_Gen_0ACE20FF\AutoEJCD.EXE moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Power2GoExpress deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\\ deleted successfully.
C:\Dokumente und Einstellungen\Raphael\Startmenü\Programme\Autostart\autobit.lnk moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Add to Windows &Live Favorites\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
C:\WINDOWS\System32\asycfilt.dll.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\OLD3B9.tmp deleted successfully.
C:\WINDOWS\System32\OLD3BC.tmp deleted successfully.
C:\WINDOWS\System32\olepro32.dll.tmp deleted successfully.
C:\WINDOWS\System32\SET66.tmp deleted successfully.
C:\WINDOWS\System32\SET6A.tmp deleted successfully.
C:\WINDOWS\System32\SET72.tmp deleted successfully.
C:\WINDOWS\System32\SETC8.tmp deleted successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vlc-1.0.5-win32.exe moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\vlc-1.0.3-win32.exe moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\searchplugins folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\logs folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\defaults folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\datastore folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-28-Dec-2011-18-07-11-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-16-Nov-2011-18-47-58-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-11-May-2011-20-11-55-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Wed-04-Jan-2012-16-39-27-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-31-May-2011-18-10-21-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-22-Mar-2011-22-19-21-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-15-Nov-2011-13-08-11-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-13-Sep-2011-20-18-04-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Tue-06-Sep-2011-13-29-37-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Thu-28-Apr-2011-19-37-17-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sun-13-Mar-2011-11-10-58-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-30-Jul-2011-16-04-35-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Sat-18-Feb-2012-17-36-45-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Mon-14-Mar-2011-16-35-17-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp\ff-config.Fri-27-May-2011-11-45-51-GMT folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\temp folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\skin folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome\content folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com\chrome folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\extensions\toolbar@ask.com folder moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-14.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-15.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-16.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-17.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Mozilla\Firefox\Profiles\i1pckdzu.default\searchplugins\icqplugin.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\ask.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\seekeen.xml moved successfully.
C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job moved successfully.
C:\WINDOWS\tasks\MP Scheduled Scan.job moved successfully.
C:\WINDOWS\tasks\HP Usg Login.job moved successfully.
C:\WINDOWS\tasks\HP Usg Daily.job moved successfully.
C:\WINDOWS\tasks\avast! Emergency Update.job moved successfully.
C:\WINDOWS\tasks\PCConfidential.job moved successfully.
C:\WINDOWS\tasks\User_Feed_Synchronization-{CD5C12A5-37FB-4AE3-AEC9-3C7C0184EB36}.job moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nud0repor.pad moved successfully.
C:\WINDOWS\system32\CONFIG.NT moved successfully.
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\TEMP not found.
File\Folder C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.exe not found.
File\Folder C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\*.exe not found.
File\Folder C:\Dokumente und Einstellungen\Raphael\Lokale Einstellungen\Anwendungsdaten\*.exe not found.
File\Folder C:\Dokumente und Einstellungen\Raphael\*.exe not found.
File\Folder C:\Dokumente und Einstellungen\Raphael\Startmenü\Programme\Autostart\ctfmon.lnk not found.
File\Folder C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ctfmon.lnk not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
E:\cmd.bat deleted successfully.
E:\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 130045 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: Harald
->Temp folder emptied: 208903067 bytes
->Temporary Internet Files folder emptied: 165671961 bytes
->Java cache emptied: 112519402 bytes
->FireFox cache emptied: 523327750 bytes
->Google Chrome cache emptied: 8165001 bytes
->Apple Safari cache emptied: 1108992 bytes
->Flash cache emptied: 23053 bytes
 
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 23257234 bytes
->FireFox cache emptied: 1660072 bytes
 
User: Martina
->Temp folder emptied: 553894880 bytes
->Temporary Internet Files folder emptied: 584167309 bytes
->Java cache emptied: 79745933 bytes
->FireFox cache emptied: 1114310970 bytes
->Flash cache emptied: 52500 bytes
 
User: NetworkService
->Temp folder emptied: 1693300 bytes
->Temporary Internet Files folder emptied: 87051712 bytes
 
User: Raphael
->Temp folder emptied: 396086367 bytes
->Temporary Internet Files folder emptied: 876309012 bytes
->Java cache emptied: 122235507 bytes
->FireFox cache emptied: 51951446 bytes
->Google Chrome cache emptied: 101957209 bytes
->Flash cache emptied: 6902254 bytes
 
User: Sarah
->Temp folder emptied: 23878486 bytes
->Temporary Internet Files folder emptied: 1238731147 bytes
->Java cache emptied: 33363224 bytes
->FireFox cache emptied: 60672215 bytes
->Apple Safari cache emptied: 10392576 bytes
->Flash cache emptied: 735461 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 13583709 bytes
RecycleBin emptied: 32841890 bytes
 
Total Files Cleaned = 6.137,00 mb
 
 
OTL by OldTimer - Version 3.2.61.0 log created on 09072012_113121

Files\Folders moved on Reboot...
C:\WINDOWS\temp\Perflib_Perfdata_bb4.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...






Code:
Malwarebytes Anti-Malware (Test) 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.09.07.06

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Raphael :: HAMARASA [Administrator]

Schutz: Aktiviert

07.09.2012 12:15:53
mbam-log-2012-09-07 (12-15-53).txt

Art des Suchlaufs: Vollständiger Suchlauf (A:\|C:\|E:\|F:\|G:\|H:\|I:\|J:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 472419
Laufzeit: 1 Stunde(n), 36 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 4
HKLM\SOFTWARE\Seekeen (PUP.Zwangi) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Seekeen (PUP.Zwangi) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SEEKEEN_SERVICE (PUP.Zwangi) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Seekeen (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 2
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 1
C:\Programme\Seekeen (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 3
C:\Programme\Seekeen\home.js (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Programme\Seekeen\readme.html (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Programme\Seekeen\uninstall.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)









Code:
# AdwCleaner v2.000 - Datei am 09/07/2012 um 14:05:39 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)
# Benutzer : Raphael - HAMARASA
# Normaler Modus : Normal
# Ausgeführt unter : E:\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Dokumente und Einstellungen\Harald\Desktop\Free Animated Desktop Wallpaper.lnk
Datei Gefunden : C:\Dokumente und Einstellungen\Harald\Desktop\Free Whales ScreenSaver.lnk
Ordner Gefunden : C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Ask.com
Ordner Gefunden : C:\Programme\Ask.com
Ordner Gefunden : C:\Programme\Free Offers from Freeze.com
Ordner Gefunden : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\APN
Schlüssel Gefunden : HKCU\Software\APN DTX
Schlüssel Gefunden : HKCU\Software\AppDataLow\AskToolbarInfo
Schlüssel Gefunden : HKCU\Software\Ask.com
Schlüssel Gefunden : HKCU\Software\AskToolbar
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKLM\Software\APN
Schlüssel Gefunden : HKLM\Software\AskToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gefunden : HKLM\Software\Freeze.com
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Software
Schlüssel Gefunden : HKU\S-1-5-21-3420643022-4140185904-3759307008-1008\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Die Registrierungsdatenbank ist sauber.

*************************

AdwCleaner[R1].txt - [3794 octets] - [07/09/2012 14:05:39]

########## EOF - C:\AdwCleaner[R1].txt - [3854 octets] ##########










Code:
# AdwCleaner v2.000 - Datei am 09/07/2012 um 14:07:14 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Microsoft Windows XP Service Pack 3 (32 bits)
# Benutzer : Raphael - HAMARASA
# Normaler Modus : Normal
# Ausgeführt unter : E:\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Dokumente und Einstellungen\Harald\Desktop\Free Animated Desktop Wallpaper.lnk
Datei Gelöscht : C:\Dokumente und Einstellungen\Harald\Desktop\Free Whales ScreenSaver.lnk
Ordner Gelöscht : C:\Dokumente und Einstellungen\Raphael\Anwendungsdaten\Ask.com
Ordner Gelöscht : C:\Programme\Ask.com
Ordner Gelöscht : C:\Programme\Free Offers from Freeze.com
Ordner Gelöscht : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\APN DTX
Schlüssel Gelöscht : HKCU\Software\AppDataLow\AskToolbarInfo
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gelöscht : HKLM\Software\Freeze.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Software

***** [Internet Browser] *****

-\\ Internet Explorer v8.0.6001.18702

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

*************************

AdwCleaner[R1].txt - [3923 octets] - [07/09/2012 14:05:39]
AdwCleaner[S1].txt - [4137 octets] - [07/09/2012 14:07:14]

########## EOF - C:\AdwCleaner[S1].txt - [4197 octets] ##########

t'john 07.09.2012 14:55
Sehr gut! :daumenhoc

Wie laeuft der Rechner?

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Raphael3006 08.09.2012 14:32
Läuft eigentlich wieder ganz normal! Danke vielmals dafür! :)
Mach ich!

t'john 08.09.2012 20:46
Schaue bitte in der Anleitung (http://www.trojaner-board.de/103809-...i-malware.html) nach, wo du die Logfiles finden kannst.
Poste das Logfile bitte.

Raphael3006 08.09.2012 21:39
Code:
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 08.09.2012 06:23:40

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:        08.09.2012 06:24:02

c:\dokumente und einstellungen\raphael\anwendungsdaten\sun        gefunden: Trace.File.dapato!E1
c:\dokumente und einstellungen\raphael\startmenü\programme\activision value        gefunden: Trace.File.seaworld adventure parks tycoon!E1
c:\programme\winferno\pc confidential\        gefunden: Trace.File.pcconfidential!E1
c:\programme\winferno        gefunden: Trace.File.winferno!E1
c:\programme\winferno\pc confidential        gefunden: Trace.File.pcconfidential!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\run --> monitor        gefunden: Trace.Registry.cmjspy!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> ip        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> ip1        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> mediapath        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> playwelcome        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> reconnection_elapse        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> reconnection_not_response        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> reconnection_timeout        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> serial        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> test_data        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> version        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> curr_ver        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> s_ip        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> upd_flag        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> upd_ver        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> upg_date        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pokerinstaller --> fullpath        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pokerinstaller --> installer_guid        gefunden: Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pokerinstaller --> url_casino_2        gefunden: Trace.Registry.pacific poker!E1
Key: hkey_local_machine\software\microsoft\internet explorer\extensions\{53f6fccd-9e22-4d71-86ea-6e43136192ab}\        gefunden: Trace.Registry.pcconfidential!E1
Key: hkey_current_user\software\pacificpoker        gefunden: Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pacificpoker\poker\init        gefunden: Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pacificpoker\poker        gefunden: Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pacificpoker\poker\sdl        gefunden: Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pokerinstaller        gefunden: Trace.Registry.pacificpoker!E1
C:\System Volume Information\_restore{E974F7A0-9A04-403D-8FA3-EA14D23570BA}\RP1298\A0542154.lnk        gefunden: Trojan.LNK.Reveton!E2
C:\System Volume Information\_restore{E974F7A0-9A04-403D-8FA3-EA14D23570BA}\RP1294\A0541684.exe        gefunden: Riskware.AdWare.Win32.OneStep!E2

Gescannt        659779
Gefunden        32

Scan Ende:        08.09.2012 20:03:46
Scan Zeit:        13:39:44

C:\System Volume Information\_restore{E974F7A0-9A04-403D-8FA3-EA14D23570BA}\RP1294\A0541684.exe        Quarantäne Riskware.AdWare.Win32.OneStep!E2
C:\System Volume Information\_restore{E974F7A0-9A04-403D-8FA3-EA14D23570BA}\RP1298\A0542154.lnk        Quarantäne Trojan.LNK.Reveton!E2
Key: hkey_current_user\software\pacificpoker        Quarantäne Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pacificpoker\poker\init        Quarantäne Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pacificpoker\poker        Quarantäne Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pacificpoker\poker\sdl        Quarantäne Trace.Registry.pacificpoker!E1
Key: hkey_current_user\software\pokerinstaller        Quarantäne Trace.Registry.pacificpoker!E1
Key: hkey_local_machine\software\microsoft\internet explorer\extensions\{53f6fccd-9e22-4d71-86ea-6e43136192ab}\        Quarantäne Trace.Registry.pcconfidential!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> ip        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> ip1        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> mediapath        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> playwelcome        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> reconnection_elapse        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> reconnection_not_response        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> reconnection_timeout        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> serial        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> test_data        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\init --> version        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> curr_ver        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> s_ip        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> upd_flag        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> upd_ver        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pacificpoker\poker\sdl --> upg_date        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pokerinstaller --> fullpath        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pokerinstaller --> installer_guid        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_current_user\software\pokerinstaller --> url_casino_2        Quarantäne Trace.Registry.pacific poker!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\run --> monitor        Quarantäne Trace.Registry.cmjspy!E1
c:\programme\winferno        Quarantäne Trace.File.winferno!E1
c:\programme\winferno\pc confidential\        Quarantäne Trace.File.pcconfidential!E1
c:\programme\winferno\pc confidential        Quarantäne Trace.File.pcconfidential!E1
c:\dokumente und einstellungen\raphael\startmenü\programme\activision value        Quarantäne Trace.File.seaworld adventure parks tycoon!E1
c:\dokumente und einstellungen\raphael\anwendungsdaten\sun        Quarantäne Trace.File.dapato!E1

Quarantäne        32

t'john 10.09.2012 02:02
Sehr gut! :daumenhoc



Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

t'john 28.10.2012 21:20
Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:45 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131