Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   [Probem] Windows XP: Nach dem "Willkommen"-Screen weißer Bildschirm - Taskmanager lässt sich NICHT öffnen (https://www.trojaner-board.de/138352-probem-windows-xp-willkommen-screen-weisser-bildschirm-taskmanager-laesst-oeffnen.html)

schrauber 18.07.2013 14:08
Zum kotzen, warum löscht FRST die nit?
Mit was meldest Du dich im Safe Mode an?

NeedFastHelp 18.07.2013 14:11
Abgesicherter Modus mit Eingabeaufforderung als Administrator

schrauber 18.07.2013 14:25
Kannste auch mit deinem Account anmelden im Safe Mode?

NeedFastHelp 18.07.2013 16:14
Ja.

schrauber 18.07.2013 16:38
dann bitte von dort nen FRST scan :)

NeedFastHelp 18.07.2013 18:37

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-07-2013
Ran by User (administrator) on 18-07-2013 19:34:24
Running from G:\
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] - C:\WINDOWS\system32\NvCpl.dll [13684736 2009-03-28] (NVIDIA Corporation)
HKLM\...\Run: [nwiz] - nwiz.exe /install [x]
HKLM\...\Run: [RTHDCPL] - RTHDCPL.EXE [x]
HKLM\...\Run: [SkyTel] - SkyTel.EXE [x]
HKLM\...\Run: [Alcmtr] - ALCMTR.EXE [x]
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [AVMWlanClient] - C:\Programme\avmwlanstick\wlangui.exe [1748992 2007-12-20] (AVM Berlin)
HKLM\...\Run: [NvMediaCenter] - C:\WINDOWS\system32\NvMcTray.dll [86016 2009-03-28] (NVIDIA Corporation)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [facemoods] - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe [329432 2011-04-14] (facemoods.com)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [KernelFaultCheck] - %systemroot%\system32\dumprep 0 -k [x]
HKCU\...\Run: [H/PC Connection Agent] - C:\Programme\Microsoft ActiveSync\Wcescomm.exe [1289000 2006-11-13] (Microsoft Corporation)
HKCU\...\Run: [ICQ] - C:\Programme\ICQ7.6\ICQ.exe [127040 2011-10-10] (ICQ, LLC.)
HKCU\...\Run: [Google Update] - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [136176 2011-09-28] (Google Inc.)
HKCU\...\Run: [KiesHelper] - C:\Programme\Samsung\Kies\KiesHelper.exe [935312 2011-11-29] (Samsung)
HKCU\...\Run: [KiesPDLR] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2011-11-29] ()
HKCU\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKCU\...\Run: [IExplorer Util] - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\ie_util.exe [63488 2013-02-11] ()
HKCU\...\Run: [Skype] - C:\Programme\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Pando Media Booster] - C:\Programme\Pando Networks\Media Booster\PMB.exe [4284976 2013-05-08] ()
HKCU\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe [x] <===== ATTENTION
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [814472 2013-06-11] (Adobe Systems Incorporated)
HKCU\...\Winlogon: [Shell] cmd.exe [401920 2008-04-14] (Microsoft Corporation) <==== ATTENTION
HKCU\...\Command Processor: "C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe" <======= ATTENTION
Startup: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dsl-start.computerbild.de/
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
URLSearchHook: (No Name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
URLSearchHook: (No Name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} -  No File
HKLM SearchScopes: DefaultScope {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=sb&searchfor={searchTerms}
HKCU SearchScopes: DefaultScope {7AE9CEBA-FF1A-4AEB-9A6B-B33CDE12E4EC} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
SearchScopes: HKCU - {342E97D3-7BFF-4E4F-9D04-7E66D2D3A353} URL = hxxp://websearch.search-results.com/redirect?client=ie&tb=STC-SRS&o=41648033&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=96&apn_dtid=YYYYYYYYDE&apn_uid=C2E53CF7-93DF-428C-BD0F-5FE827EBC2BB&apn_sauid=3BDCAC75-8F2C-45D6-9FA0-4DAD0377E6A4&
SearchScopes: HKCU - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {7AE9CEBA-FF1A-4AEB-9A6B-B33CDE12E4EC} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552
BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: ShopperReports - {100EB1FD-D03E-47fd-81F3-EE91287F9465} - C:\Programme\ShopperReports3\bin\3.0.517.0\ShopperReports.dll (SmartShopper Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
BHO: CescrtHlpr Object - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll (facemoods.com BHO)
BHO: No Name - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
BHO: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Programme\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll (webHancer Corporation)
BHO: Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
BHO: SweetIM Toolbar Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
BHO: ICQ Sparberater - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Programme\icq\Internet Explorer\icq.dll (solute gmbh)
Toolbar: HKLM - SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM - My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
Toolbar: HKLM - No Name - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
Toolbar: HKLM - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
Toolbar: HKLM - Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
Toolbar: HKLM - facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll (facemoods.com)
Toolbar: HKLM - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKCU -Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
Toolbar: HKCU -SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ipp - No CLSID Value -
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msdaipp - No CLSID Value -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL (Skype Technologies)
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
Winsock: Catalog9 01 C:\WINDOWS\webhdll.dll [40960] (webHancer Corporation)
Winsock: Catalog9 02 C:\WINDOWS\webhdll.dll [40960] (webHancer Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default
FF SelectedSearchEngine: Google
FF Homepage: user_pref("browser.startup.homepage", "");
FF Keyword.URL: hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=kwd&searchfor=
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @bittorrent.com/BitTorrentDNA - C:\Programme\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Programme\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @mywebsearch.com/Plugin - C:\Programme\MyWebSearch\bar\2.bin\NPMyWebS.dll (MyWebSearch.com)
FF Plugin: @Nero.com/KM - C:\PROGRA~1\GEMEIN~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Programme\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-4.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-5.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-6.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\mywebsearch.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\searchplugins-backup
FF Extension: No Name - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: No Name - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF Extension: Hotspot Shield  - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
FF Extension: stealthyextension - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\stealthyextension@gmail.com.xpi
FF Extension: Default - C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [m3ffxtbr@mywebsearch.com] C:\Programme\MyWebSearch\bar\2.bin
FF Extension: My Web Search - C:\Programme\MyWebSearch\bar\2.bin
FF HKLM\...\Firefox\Extensions: [ShopperReports@ShopperReports.com] C:\Programme\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions
FF Extension: ShopperReports - C:\Programme\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF StartMenuInternet: FIREFOX.EXE - F:\Programme\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR StartMenuInternet: Google Chrome - "C:\Dokumente und Einstellungen\TEMP\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe"

========================== Services (Whitelisted) =================

S2 AVM WLAN Connection Service; C:\Programme\avmwlanstick\WlanNetService.exe [364544 2007-12-20] (AVM Berlin)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2011-01-02] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2011-01-02] (Google Inc.)
S2 ICQ Service; C:\Programme\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
S3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [820008 2010-11-17] (Apple Inc.)
S3 McComponentHostService; C:\Programme\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2006-06-01] (Microsoft Corporation)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [115608 2013-04-10] (Mozilla Foundation)
S2 MyWebSearchService; C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe [28762 2011-03-25] (MyWebSearch.com)
S2 NAUpdate; C:\Programme\Nero\Update\NASvc.exe [690472 2011-07-22] (Nero AG)
S3 npggsvc; C:\WINDOWS\system32\GameMon.des [4023760 2010-12-01] (INCA Internet Co., Ltd.)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2006-06-01] (Microsoft Corporation)
S2 QuestBrowse Service; C:\Programme\QuestBrwSearch\questbrwsearch.dll [573440 2011-04-12] ()
S2 SkypeUpdate; C:\Programme\Skype\Updater\Updater.exe [161384 2013-02-28] (Skype Technologies)
S2 StealthInjectorService; C:\Programme\ArchiCrypt Stealth 4\IJStealth4Svc.exe [145920 2006-08-01] (Softwareentwicklung Remus)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-10-24] (Microsoft Corporation)
S3 AppMgmt; %SystemRoot%\System32\appmgmts.dll [x]
S2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf" [x]

==================== Drivers (Whitelisted) ====================

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-12-20] (AVM Berlin)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-12-20] (AVM GmbH)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [18688 2001-08-17] (Microsoft Corporation)
R3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows (R) Codename Longhorn DDK provider)
S3 NPPTNT2; C:\WINDOWS\system32\npptNT2.sys [4682 2004-12-30] (INCA Internet Co., Ltd.)
S3 Rasirda; C:\Windows\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
S3 RTLE8023xp; C:\Windows\System32\DRIVERS\Rtenicxp.sys [101504 2007-09-19] (Realtek Semiconductor Corporation                          )
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [63352 2006-07-05] (Protection Technology (StarForce))
R0 sfsync03; C:\Windows\System32\drivers\sfsync03.sys [35328 2005-12-06] (Protection Technology)
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [59776 2006-08-11] (Protection Technology (StarForce))
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-11-08] (AnchorFree Inc)
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2008-11-11] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [19968 2008-11-11] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24832 2008-11-11] (LG Electronics Inc.)
S3 cpuz134; \??\C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\cpuz134\cpuz134_x32.sys [x]
S3 EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys [x]
S3 EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys [x]
S4 IntelIde; No ImagePath
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-17 10:26 - 2013-07-17 11:38 - 00000000 ____D C:\FRST
2013-07-17 09:05 - 2013-07-17 09:05 - 00000000 ____D C:\autostartsicherung
2013-07-17 08:54 - 2013-07-17 08:54 - 00000000 __SHD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\IETldCache
2013-07-16 23:57 - 2013-07-18 15:02 - 00000190 ___SH C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\ntuser.ini
2013-07-16 23:57 - 2013-07-17 08:54 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ___RD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Startmenü
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ___HD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Netzwerkumgebung
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ___HD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Druckumgebung
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Desktop
2013-07-16 23:54 - 2013-07-16 23:54 - 00163060 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\2433f433
2013-07-11 03:35 - 2013-07-11 03:35 - 00010961 _____ C:\WINDOWS\KB2834886.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00010881 _____ C:\WINDOWS\KB2834904.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850851$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904_WM11$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834886$
2013-07-11 03:34 - 2013-07-11 03:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2845187$
2013-07-11 03:31 - 2013-07-11 03:32 - 00013260 _____ C:\WINDOWS\KB2846071-IE8.log
2013-07-11 01:44 - 2013-07-11 03:35 - 00016274 _____ C:\WINDOWS\KB2850851.log
2013-07-11 01:44 - 2013-07-11 03:34 - 00015045 _____ C:\WINDOWS\KB2845187.log

==================== One Month Modified Files and Folders =======

2013-07-18 15:14 - 2011-09-15 21:33 - 00000190 ___SH C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\ntuser.ini
2013-07-18 15:14 - 2011-09-15 21:33 - 00000190 ___SH C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\ntuser.ini
2013-07-18 15:14 - 2008-12-19 11:24 - 01668339 _____ C:\WINDOWS\WindowsUpdate.log
2013-07-18 15:02 - 2013-07-16 23:57 - 00000190 ___SH C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\ntuser.ini
2013-07-18 13:29 - 2008-12-19 11:28 - 00032642 _____ C:\WINDOWS\SchedLgU.Txt
2013-07-18 13:29 - 2008-12-19 11:28 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-07-18 13:29 - 2008-12-19 11:19 - 00000216 _____ C:\WINDOWS\wiadebug.log
2013-07-18 13:29 - 2008-12-19 11:19 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-07-18 13:28 - 2011-01-02 21:04 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-17 17:49 - 2011-09-22 19:41 - 00000416 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{2D336ACC-32A6-4A94-B047-3074AA51D08C}.job
2013-07-17 17:47 - 2013-06-11 21:47 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-07-17 11:38 - 2013-07-17 10:26 - 00000000 ____D C:\FRST
2013-07-17 11:38 - 2011-09-15 21:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50
2013-07-17 09:05 - 2013-07-17 09:05 - 00000000 ____D C:\autostartsicherung
2013-07-17 08:54 - 2013-07-17 08:54 - 00000000 __SHD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\IETldCache
2013-07-17 08:54 - 2013-07-16 23:57 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50
2013-07-16 23:55 - 2006-02-28 14:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl
2013-07-16 23:54 - 2013-07-16 23:54 - 00163060 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\2433f433
2013-07-16 23:54 - 2012-09-18 20:14 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Skype
2013-07-16 23:36 - 2011-09-15 19:58 - 00001238 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-2139871995-839522115-1004UA.job
2013-07-16 23:24 - 2011-01-02 21:04 - 00001086 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-16 23:01 - 2011-08-28 03:23 - 00000224 _____ C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
2013-07-16 04:36 - 2011-09-15 19:58 - 00001186 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-2139871995-839522115-1004Core.job
2013-07-13 23:54 - 2011-09-16 18:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\ICQ
2013-07-13 23:52 - 2008-12-19 12:46 - 00208477 _____ C:\WINDOWS\system32\nvapps.xml
2013-07-13 05:18 - 2008-12-19 11:17 - 00000000 ___RD C:\Programme
2013-07-13 04:40 - 2011-10-23 23:44 - 00002475 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\Google Chrome.lnk
2013-07-13 04:40 - 2011-10-23 23:44 - 00002475 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\Google Chrome.lnk
2013-07-12 18:43 - 2012-12-09 19:10 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\router_reconnect
2013-07-12 18:43 - 2012-12-09 19:10 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\router_reconnect
2013-07-12 18:43 - 2011-09-15 21:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop
2013-07-12 18:43 - 2011-09-15 21:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop
2013-07-11 22:57 - 2010-04-18 14:00 - 00000276 _____ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2013-07-11 04:42 - 2011-09-15 21:32 - 00000000 __SHD C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Verlauf
2013-07-11 04:41 - 2008-12-19 11:16 - 00294072 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-07-11 04:21 - 2009-10-05 17:06 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-07-11 03:35 - 2013-07-11 03:35 - 00010961 _____ C:\WINDOWS\KB2834886.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00010881 _____ C:\WINDOWS\KB2834904.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850851$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904_WM11$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834886$
2013-07-11 03:35 - 2013-07-11 01:44 - 00016274 _____ C:\WINDOWS\KB2850851.log
2013-07-11 03:35 - 2013-01-10 02:47 - 00194578 _____ C:\WINDOWS\setupapi.log
2013-07-11 03:35 - 2008-12-19 11:17 - 01921953 _____ C:\WINDOWS\FaxSetup.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00942003 _____ C:\WINDOWS\ocgen.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00741031 _____ C:\WINDOWS\tsoc.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00648976 _____ C:\WINDOWS\comsetup.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00392944 _____ C:\WINDOWS\ntdtcsetup.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00304236 _____ C:\WINDOWS\iis6.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00106837 _____ C:\WINDOWS\ocmsn.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00096795 _____ C:\WINDOWS\msgsocm.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00001374 _____ C:\WINDOWS\imsins.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-07-11 03:34 - 2013-07-11 03:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2845187$
2013-07-11 03:34 - 2013-07-11 01:44 - 00015045 _____ C:\WINDOWS\KB2845187.log
2013-07-11 03:34 - 2008-12-19 11:17 - 00006516 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-07-11 03:32 - 2013-07-11 03:31 - 00013260 _____ C:\WINDOWS\KB2846071-IE8.log
2013-07-11 03:32 - 2008-12-19 16:02 - 00260975 _____ C:\WINDOWS\updspapi.log
2013-07-11 03:31 - 2009-08-15 21:58 - 00000000 ____D C:\WINDOWS\ie8updates
2013-07-11 03:01 - 2009-10-05 17:08 - 00000000 ____D C:\WINDOWS\system32\XPSViewer
2013-07-08 03:17 - 2012-10-08 20:38 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\TS3Client

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2006-02-28 14:00] - [2008-04-14 04:22] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e

C:\Windows\System32\winlogon.exe
[2006-02-28 14:00] - [2008-04-14 04:23] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a

C:\Windows\System32\svchost.exe
[2006-02-28 14:00] - [2008-04-14 04:23] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366

C:\Windows\System32\services.exe
[2006-02-28 14:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc

C:\Windows\System32\User32.dll
[2006-02-28 14:00] - [2008-04-14 04:22] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd

C:\Windows\System32\userinit.exe
[2006-02-28 14:00] - [2008-04-14 04:23] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106

C:\Windows\System32\Drivers\volsnap.sys
[2006-02-28 14:00] - [2008-04-14 03:52] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d


==================== End Of Log ============================
--- --- ---

schrauber 19.07.2013 08:55
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKCU\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe [x] <===== ATTENTION
HKCU\...\Winlogon: [Shell] cmd.exe [401920 2008-04-14] (Microsoft Corporation) <==== ATTENTION
HKCU\...\Command Processor: "C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe" <======= ATTENTION
C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


jetzt aber :)

NeedFastHelp 19.07.2013 11:04
Habe den Fix mit meinem Benutzerkonto durchgeführt, das war richtig, oder?

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 17-07-2013
Ran by User at 2013-07-19 12:02:31 Run:6
Running from G:\
Boot Mode: Safe Mode (minimal)

==============================================

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe [x => Value not found.
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon => Key deleted successfully.
HKCU\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
"C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe" => File/Directory not found.

==== End of Fixlog ====

schrauber 19.07.2013 12:17
genau. Rechner neu booten und *trommelwirbel*.......

NeedFastHelp 19.07.2013 12:24
Whitescreen ....

schrauber 19.07.2013 12:27
Aargh! :)

Neues Scanlog aus deinem Profil bitte.

NeedFastHelp 19.07.2013 17:20

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-07-2013
Ran by User (administrator) on 19-07-2013 18:14:06
Running from G:\
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\WINDOWS\system32\cmd.exe
(Microsoft Corporation) C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] - C:\WINDOWS\system32\NvCpl.dll [13684736 2009-03-28] (NVIDIA Corporation)
HKLM\...\Run: [nwiz] - nwiz.exe /install [x]
HKLM\...\Run: [RTHDCPL] - RTHDCPL.EXE [x]
HKLM\...\Run: [SkyTel] - SkyTel.EXE [x]
HKLM\...\Run: [Alcmtr] - ALCMTR.EXE [x]
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated)
HKLM\...\Run: [AVMWlanClient] - C:\Programme\avmwlanstick\wlangui.exe [1748992 2007-12-20] (AVM Berlin)
HKLM\...\Run: [NvMediaCenter] - C:\WINDOWS\system32\NvMcTray.dll [86016 2009-03-28] (NVIDIA Corporation)
HKLM\...\Run: [] -  [x]
HKLM\...\Run: [facemoods] - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodssrv.exe [329432 2011-04-14] (facemoods.com)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [KernelFaultCheck] - %systemroot%\system32\dumprep 0 -k [x]
HKCU\...\Run: [H/PC Connection Agent] - C:\Programme\Microsoft ActiveSync\Wcescomm.exe [1289000 2006-11-13] (Microsoft Corporation)
HKCU\...\Run: [ICQ] - C:\Programme\ICQ7.6\ICQ.exe [127040 2011-10-10] (ICQ, LLC.)
HKCU\...\Run: [Google Update] - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [136176 2011-09-28] (Google Inc.)
HKCU\...\Run: [KiesHelper] - C:\Programme\Samsung\Kies\KiesHelper.exe [935312 2011-11-29] (Samsung)
HKCU\...\Run: [KiesPDLR] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21392 2011-11-29] ()
HKCU\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKCU\...\Run: [IExplorer Util] - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\ie_util.exe [63488 2013-02-11] ()
HKCU\...\Run: [Skype] - C:\Programme\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [Pando Media Booster] - C:\Programme\Pando Networks\Media Booster\PMB.exe [4284976 2013-05-08] ()
HKCU\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe [x] <===== ATTENTION
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin [814472 2013-06-11] (Adobe Systems Incorporated)
Startup: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dsl-start.computerbild.de/
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
URLSearchHook: (No Name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
URLSearchHook: (No Name) - {c95a4e8e-816d-4655-8c79-d736da1adb6d} -  No File
HKLM SearchScopes: DefaultScope {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=sb&searchfor={searchTerms}
HKCU SearchScopes: DefaultScope {7AE9CEBA-FF1A-4AEB-9A6B-B33CDE12E4EC} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
SearchScopes: HKCU - {342E97D3-7BFF-4E4F-9D04-7E66D2D3A353} URL = hxxp://websearch.search-results.com/redirect?client=ie&tb=STC-SRS&o=41648033&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=96&apn_dtid=YYYYYYYYDE&apn_uid=C2E53CF7-93DF-428C-BD0F-5FE827EBC2BB&apn_sauid=3BDCAC75-8F2C-45D6-9FA0-4DAD0377E6A4&
SearchScopes: HKCU - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {7AE9CEBA-FF1A-4AEB-9A6B-B33CDE12E4EC} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1561552
BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\2.bin\MWSSRCAS.DLL (MyWebSearch.com)
BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: ShopperReports - {100EB1FD-D03E-47fd-81F3-EE91287F9465} - C:\Programme\ShopperReports3\bin\3.0.517.0\ShopperReports.dll (SmartShopper Inc.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
BHO: CescrtHlpr Object - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Programme\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll (facemoods.com BHO)
BHO: No Name - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
BHO: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Programme\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll (webHancer Corporation)
BHO: Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
BHO: SweetIM Toolbar Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
BHO: ICQ Sparberater - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Programme\icq\Internet Explorer\icq.dll (solute gmbh)
Toolbar: HKLM - SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM - My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\2.bin\MWSBAR.DLL (MyWebSearch.com)
Toolbar: HKLM - No Name - {872b5b88-9db5-4310-bdd0-ac189557e5f5} -  No File
Toolbar: HKLM - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
Toolbar: HKLM - Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
Toolbar: HKLM - facemoods Toolbar - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll (facemoods.com)
Toolbar: HKLM - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKCU -Search-Results Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)
Toolbar: HKCU -SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Handler: ipp - No CLSID Value -
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msdaipp - No CLSID Value -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL (Skype Technologies)
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
Winsock: Catalog9 01 C:\WINDOWS\webhdll.dll [40960] (webHancer Corporation)
Winsock: Catalog9 02 C:\WINDOWS\webhdll.dll [40960] (webHancer Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default
FF SelectedSearchEngine: Google
FF Homepage: user_pref("browser.startup.homepage", "");
FF Keyword.URL: hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZNxpt158YYDE&ptnrS=ZNxpt158YYDE&si=216118&ptb=guIloz1OBjPIzKGO8EmpSg&ind=2010121709&n=77d005ed&psa=&st=kwd&searchfor=
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @bittorrent.com/BitTorrentDNA - C:\Programme\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Programme\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @mywebsearch.com/Plugin - C:\Programme\MyWebSearch\bar\2.bin\NPMyWebS.dll (MyWebSearch.com)
FF Plugin: @Nero.com/KM - C:\PROGRA~1\GEMEIN~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Programme\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-1.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-2.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-3.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-4.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-5.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin-6.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\mywebsearch.xml
FF SearchPlugin: C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\searchplugins\searchplugins-backup
FF Extension: No Name - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Microsoft .NET Framework Assistant - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: No Name - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF Extension: Hotspot Shield  - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
FF Extension: stealthyextension - C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Mozilla\Firefox\Profiles\9d29ab5w.default\Extensions\stealthyextension@gmail.com.xpi
FF Extension: Default - C:\Programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [m3ffxtbr@mywebsearch.com] C:\Programme\MyWebSearch\bar\2.bin
FF Extension: My Web Search - C:\Programme\MyWebSearch\bar\2.bin
FF HKLM\...\Firefox\Extensions: [ShopperReports@ShopperReports.com] C:\Programme\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions
FF Extension: ShopperReports - C:\Programme\ShopperReports3\bin\3.0.517.0\firefox\firefoxtoolbar\extensions
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF StartMenuInternet: FIREFOX.EXE - F:\Programme\Mozilla Firefox\firefox.exe

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR StartMenuInternet: Google Chrome - "C:\Dokumente und Einstellungen\TEMP\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\Application\chrome.exe"

========================== Services (Whitelisted) =================

S2 AVM WLAN Connection Service; C:\Programme\avmwlanstick\WlanNetService.exe [364544 2007-12-20] (AVM Berlin)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2011-01-02] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2011-01-02] (Google Inc.)
S2 ICQ Service; C:\Programme\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
S3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [820008 2010-11-17] (Apple Inc.)
S3 McComponentHostService; C:\Programme\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 MDM; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [322120 2006-06-01] (Microsoft Corporation)
S3 MozillaMaintenance; C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe [115608 2013-04-10] (Mozilla Foundation)
S2 MyWebSearchService; C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwssvc.exe [28762 2011-03-25] (MyWebSearch.com)
S2 NAUpdate; C:\Programme\Nero\Update\NASvc.exe [690472 2011-07-22] (Nero AG)
S3 npggsvc; C:\WINDOWS\system32\GameMon.des [4023760 2010-12-01] (INCA Internet Co., Ltd.)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2006-06-01] (Microsoft Corporation)
S2 QuestBrowse Service; C:\Programme\QuestBrwSearch\questbrwsearch.dll [573440 2011-04-12] ()
S2 SkypeUpdate; C:\Programme\Skype\Updater\Updater.exe [161384 2013-02-28] (Skype Technologies)
S2 StealthInjectorService; C:\Programme\ArchiCrypt Stealth 4\IJStealth4Svc.exe [145920 2006-08-01] (Softwareentwicklung Remus)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-10-24] (Microsoft Corporation)
S3 AppMgmt; %SystemRoot%\System32\appmgmts.dll [x]
S2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf" [x]

==================== Drivers (Whitelisted) ====================

S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-12-20] (AVM Berlin)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2007-12-20] (AVM GmbH)
R3 HDAudBus; C:\Windows\System32\DRIVERS\HDAudBus.sys [144384 2008-04-13] (Windows (R) Server 2003 DDK provider)
S3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [18688 2001-08-17] (Microsoft Corporation)
R3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows (R) Codename Longhorn DDK provider)
S3 NPPTNT2; C:\WINDOWS\system32\npptNT2.sys [4682 2004-12-30] (INCA Internet Co., Ltd.)
S3 Rasirda; C:\Windows\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
S3 RTLE8023xp; C:\Windows\System32\DRIVERS\Rtenicxp.sys [101504 2007-09-19] (Realtek Semiconductor Corporation                          )
R0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [63352 2006-07-05] (Protection Technology (StarForce))
R0 sfsync03; C:\Windows\System32\drivers\sfsync03.sys [35328 2005-12-06] (Protection Technology)
R0 sfsync04; C:\Windows\System32\drivers\sfsync04.sys [59776 2006-08-11] (Protection Technology (StarForce))
S3 taphss; C:\Windows\System32\DRIVERS\taphss.sys [33512 2012-11-08] (AnchorFree Inc)
S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2008-11-11] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [19968 2008-11-11] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24832 2008-11-11] (LG Electronics Inc.)
S3 cpuz134; \??\C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\cpuz134\cpuz134_x32.sys [x]
S3 EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys [x]
S3 EagleXNt; \??\C:\WINDOWS\system32\drivers\EagleXNt.sys [x]
S4 IntelIde; No ImagePath
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-17 10:26 - 2013-07-17 11:38 - 00000000 ____D C:\FRST
2013-07-17 09:05 - 2013-07-17 09:05 - 00000000 ____D C:\autostartsicherung
2013-07-17 08:54 - 2013-07-17 08:54 - 00000000 __SHD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\IETldCache
2013-07-16 23:57 - 2013-07-18 15:02 - 00000190 ___SH C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\ntuser.ini
2013-07-16 23:57 - 2013-07-17 08:54 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ___RD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Startmenü
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ___HD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Netzwerkumgebung
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ___HD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Druckumgebung
2013-07-16 23:57 - 2008-12-19 11:16 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\Desktop
2013-07-16 23:54 - 2013-07-16 23:54 - 00163060 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\2433f433
2013-07-11 03:35 - 2013-07-11 03:35 - 00010961 _____ C:\WINDOWS\KB2834886.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00010881 _____ C:\WINDOWS\KB2834904.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850851$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904_WM11$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834886$
2013-07-11 03:34 - 2013-07-11 03:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2845187$
2013-07-11 03:31 - 2013-07-11 03:32 - 00013260 _____ C:\WINDOWS\KB2846071-IE8.log
2013-07-11 01:44 - 2013-07-11 03:35 - 00016274 _____ C:\WINDOWS\KB2850851.log
2013-07-11 01:44 - 2013-07-11 03:34 - 00015045 _____ C:\WINDOWS\KB2845187.log

==================== One Month Modified Files and Folders =======

2013-07-19 13:23 - 2011-01-02 21:04 - 00001086 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-19 13:20 - 2011-09-22 19:41 - 00000416 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{2D336ACC-32A6-4A94-B047-3074AA51D08C}.job
2013-07-19 13:20 - 2011-01-02 21:04 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-19 13:20 - 2008-12-19 12:15 - 00262144 _____ C:\WINDOWS\system32\config\userdiff
2013-07-19 13:20 - 2008-12-19 12:15 - 00001024 ____H C:\WINDOWS\system32\config\userdiff.LOG
2013-07-19 13:20 - 2008-12-19 11:19 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-07-19 13:20 - 2008-12-19 11:19 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-07-19 13:19 - 2008-12-19 11:28 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-07-19 13:19 - 2008-12-19 11:16 - 00001812 ____C C:\WINDOWS\regopt.log
2013-07-19 12:03 - 2011-09-15 21:33 - 00000042 ___SH C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\ntuser.ini
2013-07-19 12:03 - 2011-09-15 21:33 - 00000042 ___SH C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\ntuser.ini
2013-07-19 12:03 - 2008-12-19 11:24 - 01669103 _____ C:\WINDOWS\WindowsUpdate.log
2013-07-18 15:02 - 2013-07-16 23:57 - 00000190 ___SH C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\ntuser.ini
2013-07-18 13:29 - 2008-12-19 11:28 - 00032642 _____ C:\WINDOWS\SchedLgU.Txt
2013-07-17 17:47 - 2013-06-11 21:47 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-07-17 11:38 - 2013-07-17 10:26 - 00000000 ____D C:\FRST
2013-07-17 11:38 - 2011-09-15 21:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50
2013-07-17 09:05 - 2013-07-17 09:05 - 00000000 ____D C:\autostartsicherung
2013-07-17 08:54 - 2013-07-17 08:54 - 00000000 __SHD C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50\IETldCache
2013-07-17 08:54 - 2013-07-16 23:57 - 00000000 ____D C:\Dokumente und Einstellungen\Administrator.USER-A6BFC21F50
2013-07-16 23:55 - 2006-02-28 14:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl
2013-07-16 23:54 - 2013-07-16 23:54 - 00163060 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\2433f433
2013-07-16 23:54 - 2012-09-18 20:14 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\Skype
2013-07-16 23:36 - 2011-09-15 19:58 - 00001238 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-2139871995-839522115-1004UA.job
2013-07-16 23:01 - 2011-08-28 03:23 - 00000224 _____ C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
2013-07-16 04:36 - 2011-09-15 19:58 - 00001186 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-2139871995-839522115-1004Core.job
2013-07-13 23:54 - 2011-09-16 18:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\ICQ
2013-07-13 23:52 - 2008-12-19 12:46 - 00208477 _____ C:\WINDOWS\system32\nvapps.xml
2013-07-13 05:18 - 2008-12-19 11:17 - 00000000 ___RD C:\Programme
2013-07-13 04:40 - 2011-10-23 23:44 - 00002475 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\Google Chrome.lnk
2013-07-13 04:40 - 2011-10-23 23:44 - 00002475 _____ C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\Google Chrome.lnk
2013-07-12 18:43 - 2012-12-09 19:10 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\router_reconnect
2013-07-12 18:43 - 2012-12-09 19:10 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop\router_reconnect
2013-07-12 18:43 - 2011-09-15 21:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop
2013-07-12 18:43 - 2011-09-15 21:32 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Desktop
2013-07-11 22:57 - 2010-04-18 14:00 - 00000276 _____ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2013-07-11 04:42 - 2011-09-15 21:32 - 00000000 __SHD C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Verlauf
2013-07-11 04:41 - 2008-12-19 11:16 - 00294072 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-07-11 04:21 - 2009-10-05 17:06 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-07-11 03:35 - 2013-07-11 03:35 - 00010961 _____ C:\WINDOWS\KB2834886.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00010881 _____ C:\WINDOWS\KB2834904.log
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850851$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904_WM11$
2013-07-11 03:35 - 2013-07-11 03:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834886$
2013-07-11 03:35 - 2013-07-11 01:44 - 00016274 _____ C:\WINDOWS\KB2850851.log
2013-07-11 03:35 - 2013-01-10 02:47 - 00194578 _____ C:\WINDOWS\setupapi.log
2013-07-11 03:35 - 2008-12-19 11:17 - 01921953 _____ C:\WINDOWS\FaxSetup.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00942003 _____ C:\WINDOWS\ocgen.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00741031 _____ C:\WINDOWS\tsoc.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00648976 _____ C:\WINDOWS\comsetup.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00392944 _____ C:\WINDOWS\ntdtcsetup.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00304236 _____ C:\WINDOWS\iis6.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00106837 _____ C:\WINDOWS\ocmsn.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00096795 _____ C:\WINDOWS\msgsocm.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00001374 _____ C:\WINDOWS\imsins.log
2013-07-11 03:35 - 2008-12-19 11:17 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-07-11 03:34 - 2013-07-11 03:34 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2845187$
2013-07-11 03:34 - 2013-07-11 01:44 - 00015045 _____ C:\WINDOWS\KB2845187.log
2013-07-11 03:34 - 2008-12-19 11:17 - 00006516 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-07-11 03:32 - 2013-07-11 03:31 - 00013260 _____ C:\WINDOWS\KB2846071-IE8.log
2013-07-11 03:32 - 2008-12-19 16:02 - 00260975 _____ C:\WINDOWS\updspapi.log
2013-07-11 03:31 - 2009-08-15 21:58 - 00000000 ____D C:\WINDOWS\ie8updates
2013-07-11 03:01 - 2009-10-05 17:08 - 00000000 ____D C:\WINDOWS\system32\XPSViewer
2013-07-08 03:17 - 2012-10-08 20:38 - 00000000 ____D C:\Dokumente und Einstellungen\TEMP.USER-A6BFC21F50\Anwendungsdaten\TS3Client

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2006-02-28 14:00] - [2008-04-14 04:22] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e

C:\Windows\System32\winlogon.exe
[2006-02-28 14:00] - [2008-04-14 04:23] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a

C:\Windows\System32\svchost.exe
[2006-02-28 14:00] - [2008-04-14 04:23] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366

C:\Windows\System32\services.exe
[2006-02-28 14:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc

C:\Windows\System32\User32.dll
[2006-02-28 14:00] - [2008-04-14 04:22] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd

C:\Windows\System32\userinit.exe
[2006-02-28 14:00] - [2008-04-14 04:23] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106

C:\Windows\System32\Drivers\volsnap.sys
[2006-02-28 14:00] - [2008-04-14 03:52] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d


==================== End Of Log ============================
--- --- ---

schrauber 19.07.2013 20:07
Log ist sauber...

Mach mal bitte en handybild davon.

NeedFastHelp 20.07.2013 19:38
Ein Handybild von was?

Gruß,
NeedFastHelp

Ich habe - entgegen der Regeln - etwas auf eigene Faust unternommen ... und siehe da: es hat geklappt.

Code:
HKCU\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.exe [x] <===== ATTENTION
Dies war die Zeile im Log, die mir komisch vorkam und welche in deinen Fixes immer mit "Value not found." betitelt wurde. Ich habe im regedit nach "uvksve" gesucht (abgekürzt) und fand einen Eintrag mit dem Wert "C:\DOKUME~1\TEMP~1.USE\LOKALE~1\Temp\uvksvecwvfdbjoyti.DLL".

Ich habe die Datei dann über das cmd gelöscht und nun funktioniert soweit wieder alles (zumindest im Moment). Ich würde aber gerne wissen, ob mein Computer jetzt komplett bereinigt ist oder ich weitere Schritte einleiten sollte.

Gruß und vielen Dank für die Mühen,
NeedFastHelp

schrauber 20.07.2013 20:16
Supi, dann jetzt aus dem normalen Windows:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Alle Zeitangaben in WEZ +1. Es ist jetzt 08:36 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19