Trojaner-Board - bundeskriminalamt-virus vollständig löschen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - bundeskriminalamt-virus vollständig löschen (https://www.trojaner-board.de/99775-bundeskriminalamt-virus-vollstaendig-loeschen.html)

okay hier das gmer-ergebnis.ich hoffe in der richtigen form?
falls nicht, sagst nochmal bescheid.....aber machst du ja eh ;)

GMER Logfile:

Code:

GMER 1.0.15.15640 - hxxp://www.gmer.net

Rootkit scan 2011-06-26 16:06:05

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 SAMSUNG_SP2504C rev.VT100-38

Running: 5cxqv1ti.exe; Driver: C:\DOKUME~1\HP_BES~1\LOKALE~1\Temp\kxtcifob.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            F7C5C87E                                                                                                             ZwCreateKey

SSDT            F7C5C874                                                                                                             ZwCreateThread

SSDT            F7C5C883                                                                                                             ZwDeleteKey

SSDT            F7C5C88D                                                                                                             ZwDeleteValueKey

SSDT            sptd.sys                                                                                                             ZwEnumerateKey [0xF736BFB2]

SSDT            sptd.sys                                                                                                             ZwEnumerateValueKey [0xF736C340]

SSDT            F7C5C892                                                                                                             ZwLoadKey

SSDT            sptd.sys                                                                                                             ZwOpenKey [0xF73660B0]

SSDT            F7C5C860                                                                                                             ZwOpenProcess

SSDT            F7C5C865                                                                                                             ZwOpenThread

SSDT            sptd.sys                                                                                                             ZwQueryKey [0xF736C418]

SSDT            sptd.sys                                                                                                             ZwQueryValueKey [0xF736C298]

SSDT            F7C5C89C                                                                                                             ZwReplaceKey

SSDT            F7C5C897                                                                                                             ZwRestoreKey

SSDT            F7C5C888                                                                                                             ZwSetValueKey
 

---- Kernel code sections - GMER 1.0.15 ----
 

?               C:\WINDOWS\system32\drivers\sptd.sys                                                                                 Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                             section is writeable [0xF5C1E360, 0x20FDBD, 0xE8000020]

.text           USBPORT.SYS!DllUnload                                                                                                F5BFE8AC 5 Bytes  JMP 86D853B8 

?               System32\Drivers\acvye09y.SYS                                                                                        Das System kann den angegebenen Pfad nicht finden. !
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[188] USER32.dll!DefWindowProcA + 11A                 7E37C298 7 Bytes  JMP 1004BF70 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text           C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[188] USER32.dll!SetWindowRgn + 2BD                   7E37E7E5 7 Bytes  JMP 1004BE30 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text           C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[188] USER32.dll!SetClipboardData + 19D               7E38113B 7 Bytes  JMP 1004BF50 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text           C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[188] USER32.dll!MessageBoxA + 49                     7E3A0833 7 Bytes  JMP 1004C040 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text           C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[188] USER32.dll!MessageBoxExW + 1F                   7E3A0857 7 Bytes  JMP 1004C090 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)

.text           C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[188] USER32.dll!MessageBoxTimeoutA + CA              7E3B64D0 7 Bytes  JMP 1004BFC0 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
 

---- Kernel IAT/EAT - GMER 1.0.15 ----
 

IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                   [F7366AD4] sptd.sys

IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                           [F7366C1A] sptd.sys

IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                  [F7366B9C] sptd.sys

IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                          [F7367748] sptd.sys

IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                  [F736761E] sptd.sys

IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                                   [F737C29A] sptd.sys
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                               86F651E8

Device          \FileSystem\Fastfat \FatCdrom                                                                                        86B0E790

Device          \Driver\usbohci \Device\USBPDO-0                                                                                     86D96790

Device          \Driver\usbohci \Device\USBPDO-1                                                                                     86D96790

Device          \Driver\PCI_NTPNP2894 \Device\00000045                                                                               sptd.sys

Device          \Driver\usbehci \Device\USBPDO-2                                                                                     86D95790

Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                               86FD41E8

Device          \Driver\usbstor \Device\00000071                                                                                     86B9C790

Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                               86FD41E8

Device          \Driver\usbstor \Device\00000072                                                                                     86B9C790

Device          \Driver\Cdrom \Device\CdRom0                                                                                         86D90790

Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-11                                                                         [F72DFB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                   [F72DFB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                                                                          [F72DFB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                   [F72DFB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort2                                                                                   [F72DFB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort3                                                                                   [F72DFB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdeDeviceP3T1L0-19                                                                         [F72DFB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\usbstor \Device\00000073                                                                                     86B9C790

Device          \Driver\Cdrom \Device\CdRom1                                                                                         86D90790

Device          \Driver\usbstor \Device\00000074                                                                                     86B9C790

Device          \Driver\Cdrom \Device\CdRom2                                                                                         86D90790

Device          \Driver\usbstor \Device\00000075                                                                                     86B9C790

Device          \Driver\Cdrom \Device\CdRom3                                                                                         86D90790

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                              86C2F1E8

Device          \Driver\NetBT \Device\NetbiosSmb                                                                                     86C2F1E8

Device          \Driver\NetBT \Device\NetBT_Tcpip_{C679FCD5-B4DB-4854-AA53-6CDBBE614F77}                                             86C2F1E8

Device          \Driver\usbohci \Device\USBFDO-0                                                                                     86D96790

Device          \Driver\usbohci \Device\USBFDO-1                                                                                     86D96790

Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                                    86C00580

Device          \Driver\usbehci \Device\USBFDO-2                                                                                     86D95790

Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                                          86C00580

Device          \Driver\Ftdisk \Device\FtControl                                                                                     86FD41E8

Device          \Driver\acvye09y \Device\Scsi\acvye09y1Port4Path0Target0Lun0                                                         86CC81E8

Device          \Driver\acvye09y \Device\Scsi\acvye09y1Port4Path0Target1Lun0                                                         86CC81E8

Device          \Driver\acvye09y \Device\Scsi\acvye09y1                                                                              86CC81E8

Device          \FileSystem\Fastfat \Fat                                                                                             86B0E790
 

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                             fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

Device          \FileSystem\Cdfs \Cdfs                                                                                               86AB9790
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                                   771343423

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                                   285507792

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                                   1

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                     

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Programme\DAEMON Tools\

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x61 0x4C 0xC6 0x0F ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0x64 0x2C 0xEE 0xB1 ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0xB1 0xB4 0x18 0x2D ...

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41                      

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                0x52 0xB6 0x92 0xB5 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools\

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x61 0x4C 0xC6 0x0F ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x64 0x2C 0xEE 0xB1 ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xB1 0xB4 0x18 0x2D ...

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                    0x52 0xB6 0x92 0xB5 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools\

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x61 0x4C 0xC6 0x0F ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x64 0x2C 0xEE 0xB1 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0xB1 0xB4 0x18 0x2D ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                    0x52 0xB6 0x92 0xB5 ...
 

---- Disk sectors - GMER 1.0.15 ----
 

Disk            \Device\Harddisk0\DR0                                                                                                MBR read error

Disk            \Device\Harddisk0\DR0                                                                                                MBR BIOS signature not found 0
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Was ist mit den anderen Logs?

Hi Arne,

seit dem letzten Post ist schon etwas Zeit vergangen, da ich im Ausland war, und meine Ex-Freundin (die den Virus auf meinen PC gesetzt hat) an dieser Stelle nicht weitergekommen ist. Ist es besser nochmal von neu anzufangen?

Hier ist erstmal das OSAM logfile:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 12:20:43 on 01.09.2011
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Scheduled Update for Ask Toolbar.job" - ? - C:\Programme\Ask.com\UpdateTask.exe  (File found, but it contains no detailed information)
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"ALSNDMGR.CPL" - ? - C:\WINDOWS\system32\ALSNDMGR.CPL  (File signed by Microsoft | File found, but it contains no detailed information)

"btcpl.cpl" - "Broadcom Corporation." - C:\WINDOWS\system32\btcpl.cpl

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\WINDOWS\system32\ISUSPM.cpl

"javacpl.cpl" - "Oracle" - C:\WINDOWS\system32\javacpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"Avira AntiVir PersonalEdition Classic " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"asal9c62" (asal9c62) - ? - C:\WINDOWS\system32\drivers\asal9c62.sys  (Hidden registry entry, rootkit activity | File not found)

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"Bluetooth-Audiogerät" (btaudio) - "Broadcom Corporation." - C:\WINDOWS\System32\drivers\btaudio.sys

"Bluetooth-Bus-Enumerator" (BTKRNL) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btkrnl.sys

"Bluetooth-LAN-Zugangsserver" (BTWDNDIS) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btwdndis.sys

"btwhid" (btwhid) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btwhid.sys

"catchme" (catchme) - ? - C:\DOKUME~1\HP_BES~1\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"EagleNT" (EagleNT) - ? - C:\WINDOWS\system32\drivers\EagleNT.sys  (File not found)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"sptd" (sptd) - "Duplex Secure Ltd." - C:\WINDOWS\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"vaxscsi" (vaxscsi) - "Alcohol Soft Co., Ltd." - C:\WINDOWS\System32\Drivers\vaxscsi.sys

"Virtueller Bluetooth-Kommunikationstreiber" (BTDriver) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btport.sys

"VN Series Device" (VNUSB) - ? - C:\WINDOWS\System32\DRIVERS\VNUSB.sys  (File not found)

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"WIDCOMM USB Bluetooth Driver" (BTWUSB) - "Broadcom Corporation." - C:\WINDOWS\System32\Drivers\btwusb.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 2.3\program\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{6af09ec9-b429-11d4-a1fb-0090960218cb} "Bluetooth-Umgebung" - "Broadcom Corporation." - C:\WINDOWS\system32\btneighborhood.dll

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - c:\WINDOWS\system32\mscoree.dll

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\WINDOWS\system32\btncopy.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 2.3\program\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 2.3\program\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 2.3\program\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 2.3\program\shlxthdl.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\WINDOWS\system32\ShellvRTF.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{00000000-6E41-4FD3-8538-502F5495E5FC} "UrlSearchHook Class" - "Search-Results" - C:\Programme\Ask.com\GenericAskToolbar.dll

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_21" - "Oracle" - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Oracle" - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_21" - "Oracle" - C:\Programme\Java\jre6\bin\npjpi160_21.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10w.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Programme\Belkin\Bluetooth Software\btsendto_ie.htm

"Hilfe zu Verbindungen" - ? - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Softonic Toolbar" - "Search-Results" - C:\Programme\Ask.com\GenericAskToolbar.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle" - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Oracle" - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{D4027C7F-154A-4066-A1AD-4243D8127440} "Softonic Toolbar" - "Search-Results" - C:\Programme\Ask.com\GenericAskToolbar.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"HP Digital Imaging Monitor.lnk" - "Hewlett-Packard Co." - C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe  (Shortcut exists | File exists)

"BTTray.lnk" - "Broadcom Corporation." - C:\Programme\Belkin\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"VPro530.lnk" - "Philips" - C:\WINDOWS\VPro530.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\HP_Besitzer\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools" - "DT Soft Ltd." - "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033

"Sony Ericsson PC Suite" - "Sony Ericsson Mobile Communications AB" - "C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"ApnUpdater" - "Search-Results" - "C:\Programme\Ask.com\Updater\Updater.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"DivXUpdate" - ? - "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"HP Software Update" - "Hewlett-Packard Co." - C:\Programme\HP\HP Software Update\HPwuSchd2.exe

"HPBootOp" - "Hewlett-Packard Company" - "C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

"HPHUPD08" - "Hewlett-Packard" - c:\Programme\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

"nwiz" - "NVIDIA Corporation" - nwiz.exe /installquiet /keeploaded /nodetect

"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime

"Recguard" - ? - C:\WINDOWS\SMINST\RECGUARD.EXE

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

"TkBellExe" - "RealNetworks, Inc." - "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot

"WinampAgent" - ? - C:\Programme\Winamp\winampa.exe  (File found, but it contains no detailed information)
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Bluetooth-Druckeranschluss" - "Broadcom Corporation." - C:\WINDOWS\system32\bthcrp.dll

"Bullzip PDF Print Monitor" - "BullZip" - C:\WINDOWS\system32\bzpdf.dll

"HP Standard TCP/IP Port" - "Hewlett Packard" - C:\WINDOWS\system32\HpTcpMon.dll

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Programme\Belkin\Bluetooth Software\bin\btwdins.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"Java Quick Starter" (JavaQuickStarterService) - "Oracle" - C:\Programme\Java\jre6\bin\jqs.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"Sony Ericsson OMSI download service" (OMSI download service) - ? - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe  (File found, but it contains no detailed information)

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/HTML]

Hier ist das MBER logfile:

HTML-Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows XP Home Edition

Windows Information:                Service Pack 3 (build 2600)

Logical Drives Mask:                0x00003e7c
 

Kernel Drivers (total 125):

  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe

  0x806D1000 \WINDOWS\system32\hal.dll

  0xF7A50000 \WINDOWS\system32\KDCOM.DLL

  0xF7960000 \WINDOWS\system32\BOOTVID.dll

  0xF7365000 sptd.sys

  0xF7A52000 \WINDOWS\System32\Drivers\WMILIB.SYS

  0xF734D000 \WINDOWS\System32\Drivers\SCSIPORT.SYS

  0xF731E000 ACPI.sys

  0xF730D000 pci.sys

  0xF7550000 ohci1394.sys

  0xF7560000 \WINDOWS\system32\DRIVERS\1394BUS.SYS

  0xF7570000 isapnp.sys

  0xF7B18000 pciide.sys

  0xF77D0000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

  0xF7A54000 viaide.sys

  0xF7A56000 intelide.sys

  0xF7580000 MountMgr.sys

  0xF72EE000 ftdisk.sys

  0xF77D8000 PartMgr.sys

  0xF7590000 VolSnap.sys

  0xF72D6000 atapi.sys

  0xF75A0000 disk.sys

  0xF75B0000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

  0xF72B6000 fltmgr.sys

  0xF72A4000 sr.sys

  0xF75C0000 PxHelp20.sys

  0xF728D000 KSecDD.sys

  0xF7200000 Ntfs.sys

  0xF71D3000 NDIS.sys

  0xF71B9000 Mup.sys

  0xF7630000 \SystemRoot\system32\DRIVERS\AmdK8.sys

  0xF65C4000 \SystemRoot\system32\DRIVERS\nv4_mini.sys

  0xF65B0000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS

  0xF78F8000 \SystemRoot\system32\DRIVERS\usbohci.sys

  0xF658C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0xF7900000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0xF7640000 \SystemRoot\system32\DRIVERS\imapi.sys

  0xF7650000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0xF7660000 \SystemRoot\system32\DRIVERS\redbook.sys

  0xF6569000 \SystemRoot\system32\DRIVERS\ks.sys

  0xF6555000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys

  0xF7670000 \SystemRoot\system32\DRIVERS\nic1394.sys

  0xF61DB000 \SystemRoot\system32\drivers\ALCXWDM.SYS

  0xF61B7000 \SystemRoot\system32\drivers\portcls.sys

  0xF7680000 \SystemRoot\system32\drivers\drmk.sys

  0xF6150000 \SystemRoot\System32\Drivers\asal9c62.SYS

  0xF60EF000 \SystemRoot\system32\DRIVERS\parport.sys

  0xF7690000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0xF7800000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0xF7808000 \SystemRoot\system32\DRIVERS\PS2.sys

  0xF7810000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0xF6022000 \SystemRoot\system32\DRIVERS\btkrnl.sys

  0xF7C10000 \SystemRoot\system32\DRIVERS\audstub.sys

  0xF76A0000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0xF6AD1000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0xF600B000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0xF76B0000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0xF76C0000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0xF7818000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0xF5FFA000 \SystemRoot\system32\DRIVERS\psched.sys

  0xF76D0000 \SystemRoot\system32\DRIVERS\msgpc.sys

  0xF7820000 \SystemRoot\system32\DRIVERS\ptilink.sys

  0xF7828000 \SystemRoot\system32\DRIVERS\raspti.sys

  0xF76F0000 \SystemRoot\system32\DRIVERS\termdd.sys

  0xF7830000 \SystemRoot\system32\DRIVERS\seehcri.sys

  0xF7AA4000 \SystemRoot\system32\DRIVERS\swenum.sys

  0xF5F9C000 \SystemRoot\system32\DRIVERS\update.sys

  0xF7A10000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0xF5F4D000 \SystemRoot\system32\drivers\btaudio.sys

  0xF7700000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0xF7710000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0xF7AA8000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0xF7AAE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0xF7C09000 \SystemRoot\System32\Drivers\Null.SYS

  0xF7AB0000 \SystemRoot\System32\Drivers\Beep.SYS

  0xF7850000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0xF7858000 \SystemRoot\System32\drivers\vga.sys

  0xF7AB2000 \SystemRoot\System32\Drivers\mnmdd.SYS

  0xF7AB4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0xF7860000 \SystemRoot\System32\Drivers\Msfs.SYS

  0xF7868000 \SystemRoot\System32\Drivers\Npfs.SYS

  0xF718D000 \SystemRoot\system32\DRIVERS\rasacd.sys

  0xF3952000 \SystemRoot\system32\DRIVERS\ipsec.sys

  0xF38F9000 \SystemRoot\system32\DRIVERS\tcpip.sys

  0xF38D1000 \SystemRoot\system32\DRIVERS\netbt.sys

  0xF38AF000 \SystemRoot\System32\drivers\afd.sys

  0xF7760000 \SystemRoot\system32\DRIVERS\netbios.sys

  0xF7870000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0xF3884000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0xF37EC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xF7790000 \SystemRoot\System32\Drivers\Fips.SYS

  0xF37C6000 \SystemRoot\system32\DRIVERS\ipnat.sys

  0xF77A0000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0xF77B0000 \SystemRoot\system32\DRIVERS\arp1394.sys

  0xF379F000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0xF7AB8000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys

  0xF377B000 \SystemRoot\System32\Drivers\Fastfat.SYS

  0xF7898000 \SystemRoot\system32\DRIVERS\usbccgp.sys

  0xF3700000 \SystemRoot\system32\drivers\SPC530.sys

  0xF78A0000 \SystemRoot\system32\drivers\SPC530m.sys

  0xF69AF000 \SystemRoot\system32\drivers\STREAM.SYS

  0xF36EA000 \SystemRoot\system32\DRIVERS\phaudlwr.sys

  0xF699F000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS

  0xF366F000 \SystemRoot\system32\DRIVERS\Wdf01000.sys

  0xF698F000 \SystemRoot\system32\drivers\usbaudio.sys

  0xF78A8000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS

  0xF35B7000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0xF7AEC000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS

  0xBF800000 \SystemRoot\System32\win32k.sys

  0xF7A24000 \SystemRoot\System32\drivers\Dxapi.sys

  0xF78E8000 \SystemRoot\System32\watchdog.sys

  0xBF000000 \SystemRoot\System32\drivers\dxg.sys

  0xF7B99000 \SystemRoot\System32\drivers\dxgthk.sys

  0xBF012000 \SystemRoot\System32\nv4_disp.dll

  0xBF3CF000 \SystemRoot\System32\ATMFD.DLL

  0xBA4D1000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0xBA4FC000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xB9224000 \SystemRoot\system32\DRIVERS\mrxdav.sys

  0xB9147000 \SystemRoot\system32\drivers\wdmaud.sys

  0xF7610000 \SystemRoot\system32\drivers\sysaudio.sys

  0xB8FF1000 \SystemRoot\System32\Drivers\Cdfs.SYS

  0xB8C91000 \SystemRoot\system32\DRIVERS\srv.sys

  0xB86F9000 \SystemRoot\System32\Drivers\HTTP.sys

  0x7C910000 \WINDOWS\system32\ntdll.dll

  0x10000000 \Programme\DAEMON Tools\daemon.dll
 

Processes (total 52):

       0 System Idle Process

       4 System

     632 C:\WINDOWS\system32\smss.exe

     712 csrss.exe

     736 C:\WINDOWS\system32\winlogon.exe

     780 C:\WINDOWS\system32\services.exe

     792 C:\WINDOWS\system32\lsass.exe

     960 C:\WINDOWS\system32\svchost.exe

    1036 svchost.exe

    1132 C:\WINDOWS\system32\svchost.exe

    1200 svchost.exe

    1384 svchost.exe

    1596 C:\WINDOWS\explorer.exe

    1656 C:\WINDOWS\system32\spoolsv.exe

    1720 C:\Programme\Avira\AntiVir Desktop\sched.exe

    1808 svchost.exe

    1916 C:\Programme\HP\HP Software Update\hpwuSchd2.exe

    1924 C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe

    1932 C:\Programme\Winamp\winampa.exe

    1948 C:\Programme\Avira\AntiVir Desktop\avgnt.exe

    1972 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe

    2012 C:\WINDOWS\system32\rundll32.exe

    2036 C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

    2044 C:\Programme\DivX\DivX Update\DivXUpdate.exe

     200 C:\Programme\DAEMON Tools\daemon.exe

     228 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

     252 C:\WINDOWS\system32\ctfmon.exe

     280 C:\Programme\Belkin\Bluetooth Software\BTTray.exe

     288 C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe

     308 C:\WINDOWS\VPro530.exe

     864 C:\Programme\HP\Digital Imaging\bin\hpqste08.exe

    1024 C:\Programme\Avira\AntiVir Desktop\avguard.exe

    1080 C:\Programme\Belkin\Bluetooth Software\bin\btwdins.exe

    1208 C:\Programme\Java\jre6\bin\jqs.exe

    1264 C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

    1312 C:\WINDOWS\system32\nvsvc32.exe

    1368 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

    2152 C:\WINDOWS\system32\svchost.exe

    2172 C:\Programme\Avira\AntiVir Desktop\avshadow.exe

    4040 alg.exe

     604 C:\hp\KBD\kbd.exe

    1824 C:\WINDOWS\ALCXMNTR.EXE

    2892 C:\WINDOWS\system\hpsysdrv.exe

    3012 C:\WINDOWS\system32\wuauclt.exe

    2968 C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe

    2388 C:\Programme\Mozilla Firefox\firefox.exe

    1840 C:\Programme\Mozilla Firefox\plugin-container.exe

    2504 C:\WINDOWS\system32\msiexec.exe

     464 C:\Dokumente und Einstellungen\HP_Besitzer\Eigene Dateien\Downloads\osam_autorun_manager_5_0_portable(1)\osam.exe

    3596 C:\Programme\Ask.com\Updater\Updater.exe

    1876 C:\WINDOWS\system32\notepad.exe

    1536 C:\Dokumente und Einstellungen\HP_Besitzer\Eigene Dateien\Downloads\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000038`e4e81e00  (FAT32)
 

PhysicalDrive0 Model Number: SAMSUNGSP2504C, Rev: VT100-38
 

      Size  Device Name          MBR Status

  --------------------------------------------

    232 GB  \\.\PhysicalDrive0   Unknown MBR code

            SHA1: 1767459F00D32DFB18808B1403F5E319EE9E0999
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit: 

Options:

  [1] Dump the MBR of a physical disk to file.

  [2] Restore the MBR of a physical disk with a standard boot code.

  [3] Exit.
 

Enter your choice:

Vielen Dank für die Hilfe!!!

Äh hallo? Nach über zwei Monaten fällt es dir ein mal wieder hier zu antworten? :wtf:

Habe doch die Begründung dazu geschrieben, ich bin erst gestern nach 8 Monaten USA wieder nach Hause an meinen Rechner gekommen...

Alle anderen Posts zu diesem Thema waren von meiner Ex, die sich unter meinem Username hier eingeloggt hat, weil sie auf meinen PC einen Virus gesetzt hat. Sie hat mir gestern gesagt dass sie vor 2 Monaten an dieser Stelle stehen geblieben ist. Ich möchte aber wieder einen sauberen Rechner haben, und würde mich daher über weitere Hilfe sehr freuen...

In zwei Monaten hätte ihr die Kiste mindesten 10x neu aufsetzen können :balla:

Mach erstmal einen neuen Vollscan mit Malwarebytes. An die Updates vorher denken!

Wie schon gesagt, ich bin erst gestern nach über 8 Monaten Abwesenheit wieder das erste mal wieder an den Rechner hier gekommen, ansonsten hast Du natürlich Recht.

Hier das Malwarebytes Logfile

HTML-Code:

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org
 

Database version: 7631
 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702
 

02.09.2011 00:36:44

mbam-log-2011-09-02 (00-36-43).txt
 

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|J:\|K:\|L:\|M:\|N:\|)

Objects scanned: 325086

Time elapsed: 2 hour(s), 27 minute(s), 58 second(s)
 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0
 

Memory Processes Infected:

(No malicious items detected)
 

Memory Modules Infected:

(No malicious items detected)
 

Registry Keys Infected:

(No malicious items detected)
 

Registry Values Infected:

(No malicious items detected)
 

Registry Data Items Infected:

(No malicious items detected)
 

Folders Infected:

(No malicious items detected)
 

Files Infected:

(No malicious items detected)

Führ bitte auch ESET aus, danach sehen wir weiter:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Ok, hier die log.txt:

HTML-Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6528

# api_version=3.0.2

# EOSSerial=905011a2064a664bb0d1ed66a36e219d

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2011-09-03 02:14:59

# local_time=2011-09-03 04:14:59 (+0100, Westeuropäische Sommerzeit)

# country="Germany"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=1797 16775141 100 93 188272 51543488 0 0

# compatibility_mode=8192 67108863 100 0 127 127 0 0

# scanned=147327

# found=0

# cleaned=0

# scan_time=9470

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox.

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Alles klar, hier das OTL logfile:

OTL Logfile:

Code:

OTL logfile created on: 04.09.2011 15:45:46 - Run 3

OTL by OldTimer - Version 3.2.23.0     Folder = C:\Dokumente und Einstellungen\HP_Besitzer\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1022,48 Mb Total Physical Memory | 597,04 Mb Available Physical Memory | 58,39% Memory free

2,40 Gb Paging File | 2,03 Gb Available in Paging File | 84,64% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 227,58 Gb Total Space | 120,02 Gb Free Space | 52,74% Space Free | Partition Type: NTFS

Drive D: | 5,30 Gb Total Space | 0,53 Gb Free Space | 10,05% Space Free | Partition Type: FAT32

 

Computer Name: NAME-CD5FDA878D | User Name: HP_Besitzer | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Ask.com\Updater\Updater.exe (Search-Results)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()

PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)

PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)

PRC - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\WINDOWS\VPro530.exe (Philips)

PRC - C:\Programme\Winamp\winampa.exe ()

PRC - C:\Programme\DAEMON Tools\daemon.exe (DT Soft Ltd.)

PRC - C:\Programme\Belkin\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

PRC - C:\Programme\Belkin\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)

PRC - C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

MOD - C:\WINDOWS\system32\nview.dll ()

MOD - C:\WINDOWS\system32\nvwrsde.dll (NVIDIA Corporation)

MOD - C:\WINDOWS\system32\nvwddi.dll (NVIDIA Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AppMgmt) --  File not found

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (OMSI download service) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()

SRV - (btwdins) -- C:\Programme\Belkin\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)

SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)

SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)

SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)

DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (SPC530) -- C:\WINDOWS\system32\drivers\SPC530.sys (                                                            )

DRV - (SPC530m) -- C:\WINDOWS\system32\drivers\SPC530m.sys (                                                            )

DRV - (phaudlwr) -- C:\WINDOWS\system32\drivers\phaudlwr.sys (Philips Applied Technologies)

DRV - (vaxscsi) -- C:\WINDOWS\System32\Drivers\vaxscsi.sys (Alcohol Soft Co., Ltd.)

DRV - (seehcri) -- C:\WINDOWS\system32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)

DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()

DRV - (s117obex) -- C:\WINDOWS\system32\drivers\s117obex.sys (MCCI Corporation)

DRV - (s117mdm) -- C:\WINDOWS\system32\drivers\s117mdm.sys (MCCI Corporation)

DRV - (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\s117mgmt.sys (MCCI Corporation)

DRV - (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM) -- C:\WINDOWS\system32\drivers\s117unic.sys (MCCI Corporation)

DRV - (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS) -- C:\WINDOWS\system32\drivers\s117nd5.sys (MCCI Corporation)

DRV - (s117mdfl) -- C:\WINDOWS\system32\drivers\s117mdfl.sys (MCCI Corporation)

DRV - (s117bus) Sony Ericsson Device 117 driver (WDM) -- C:\WINDOWS\system32\drivers\s117bus.sys (MCCI Corporation)

DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)

DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)

DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)

DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)

DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)

DRV - (btwhid) -- C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.)

DRV - (Ps2) -- C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)

DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )

DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)

DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)

DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.search-results.com/?l=dis&o=41648036

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie

IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

 

FF - HKLM\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.01 09:33:21 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.05.11 06:31:52 | 000,000,000 | ---D | M]

 

[2008.09.17 00:45:29 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Extensions

[2011.09.01 12:15:58 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\84t4r4d3.default\extensions

[2010.08.05 21:29:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\84t4r4d3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.07.09 19:57:45 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\84t4r4d3.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2010.08.05 12:52:38 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\84t4r4d3.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.09.01 12:16:41 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\84t4r4d3.default\extensions\toolbar@ask.com

[2011.05.16 19:18:56 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2011.06.14 18:28:18 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

[2010.07.19 12:18:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

File not found (No name found) -- C:\PROGRAMME\HAUFE\IDESK\IDESKBROWSER\EXTENSIONS\{C24AECC7-7C95-507F-D71F-155CB86656DF}

[2011.09.01 09:33:20 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2010.07.19 12:18:18 | 000,423,656 | ---- | M] (Oracle) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2011.06.21 19:19:41 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Search-Results)

O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()

O4 - HKLM..\Run: [HPBootOp] C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [HPHUPD08] c:\Programme\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe ()

O4 - HKCU..\Run: [DAEMON Tools] C:\Programme\DAEMON Tools\daemon.exe (DT Soft Ltd.)

O4 - HKCU..\Run: [Sony Ericsson PC Suite] C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\Belkin\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPro530.lnk = C:\WINDOWS\VPro530.exe (Philips)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm ()

O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\Belkin\Bluetooth Software\btsendto_ie_ctx.htm ()

O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Belkin\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Belkin\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()

O9 - Extra 'Tools' menuitem : Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.186.225 192.168.0.1

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\HP_Besitzer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\HP_Besitzer\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2004.11.02 20:05:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 -  File not found

NetSvcs: AppMgmt -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Iprip -  File not found

NetSvcs: Irmon -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: WmdmPmSp -  File not found

 

 

SafeBootMin: AppMgmt -  File not found

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: sermouse.sys - Driver

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vds - Service

SafeBootMin: vga.sys - Driver

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

SafeBootNet: AppMgmt -  File not found

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: sermouse.sys - Driver

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vga.sys - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4

ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4

ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation

ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4

ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)

ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe

ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)

ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8

ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider

ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework

ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework

ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

 

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)

Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)

Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (hxxp://www.mp3dev.org/)

Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)

Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)

Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)

Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)

Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()

Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()

Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)

Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.)

Drivers32: vidc.lsgc - C:\WINDOWS\System32\lsgc.dll (imc AG)

Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902053519425536)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.09.03 01:35:05 | 000,000,000 | ---D | C] -- C:\Programme\ESET

[2011.09.03 01:32:44 | 002,322,184 | ---- | C] (ESET) -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\esetsmartinstaller_enu.exe

[2011.09.01 12:41:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\Pictures Disc III

[2011.09.01 12:16:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_Besitzer\Lokale Einstellungen\Anwendungsdaten\AskToolbar

[2011.09.01 12:15:57 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com

[2011.09.01 12:15:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Philipp Winterberg

[2011.09.01 12:15:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Free RAR Extract Frog

[2011.09.01 12:15:47 | 000,000,000 | ---D | C] -- C:\Programme\Free RAR Extract Frog

[2011.09.01 12:15:30 | 003,578,344 | ---- | C] (Philipp Winterberg) -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\InstallFreeRARExtractFrog_3.20.exe

[2011.09.01 12:15:30 | 003,383,272 | ---- | C] (Search-Results) -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\ApnToolbarInstaller.exe

[2011.08.20 10:53:31 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010.11.19 14:17:27 | 000,486,912 | ---- | C] (                                                            ) -- C:\WINDOWS\System32\drivers\SPC530.sys

[2010.11.19 14:17:27 | 000,007,680 | ---- | C] (                                                            ) -- C:\WINDOWS\System32\drivers\SPC530m.sys

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.09.04 15:33:00 | 000,001,100 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2011.09.04 14:02:59 | 000,000,185 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.DAT

[2011.09.04 14:02:11 | 000,465,684 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat

[2011.09.04 14:02:11 | 000,446,752 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2011.09.04 14:02:11 | 000,087,382 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat

[2011.09.04 14:02:11 | 000,073,574 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2011.09.04 14:01:30 | 000,001,096 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2011.09.04 14:01:27 | 000,039,472 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2011.09.04 14:01:22 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.09.04 14:01:21 | 1072,222,208 | -HS- | M] () -- C:\hiberfil.sys

[2011.09.04 12:01:01 | 000,000,238 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

[2011.09.03 02:26:05 | 000,154,624 | ---- | M] () -- C:\Dokumente und Einstellungen\HP_Besitzer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.09.03 01:32:46 | 002,322,184 | ---- | M] (ESET) -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\esetsmartinstaller_enu.exe

[2011.09.03 00:33:16 | 000,012,501 | ---- | M] () -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\Umzug.ods

[2011.09.01 12:15:48 | 000,000,834 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Free RAR Extract Frog.lnk

[2011.09.01 12:15:36 | 003,383,272 | ---- | M] (Search-Results) -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\ApnToolbarInstaller.exe

[2011.09.01 12:15:31 | 003,578,344 | ---- | M] (Philipp Winterberg) -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\InstallFreeRARExtractFrog_3.20.exe

[2011.08.31 21:19:30 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.08.24 19:26:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2011.08.11 17:39:44 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.09.01 19:14:45 | 000,012,501 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_Besitzer\Desktop\Umzug.ods

[2011.09.01 12:16:37 | 000,000,238 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

[2011.09.01 12:15:48 | 000,000,834 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Free RAR Extract Frog.lnk

[2010.07.16 15:47:05 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010.07.16 15:47:05 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010.07.16 15:47:05 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010.07.16 15:47:05 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010.07.16 15:47:05 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010.07.12 13:16:36 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010.04.06 19:24:26 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI

[2009.12.22 21:45:42 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat

[2009.06.04 18:27:24 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\mp3dec.dll

[2009.06.04 18:27:23 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\tvqenc.dll

[2009.06.04 18:27:23 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\tvqdec.dll

[2009.05.02 02:03:50 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll

[2009.05.02 02:03:46 | 000,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll

[2009.05.02 02:03:46 | 000,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll

[2009.05.02 02:03:43 | 000,084,480 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll

[2008.04.29 18:56:31 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2008.03.24 23:19:59 | 000,000,038 | ---- | C] () -- C:\WINDOWS\TETRIS.INI

[2007.11.20 20:59:07 | 000,154,624 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_Besitzer\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.10.07 02:41:51 | 000,001,421 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2007.10.05 16:01:37 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\wklnhst.dat

[2007.10.03 22:41:20 | 000,001,274 | ---- | C] () -- C:\WINDOWS\mozver.dat

[2007.10.02 10:43:35 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

[2007.10.02 01:01:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2007.10.01 22:54:12 | 000,000,144 | ---- | C] () -- C:\Dokumente und Einstellungen\HP_Besitzer\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat

[2006.06.07 16:52:08 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll

[2005.12.09 23:03:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

[2005.01.01 22:52:12 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2005.01.01 22:33:34 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys

[2005.01.01 22:29:57 | 000,013,625 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS

[2005.01.01 22:29:52 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll

[2005.01.01 22:23:49 | 000,000,108 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2005.01.01 22:19:09 | 000,081,173 | ---- | C] () -- C:\WINDOWS\HPHins08.dat

[2005.01.01 22:19:09 | 000,004,011 | ---- | C] () -- C:\WINDOWS\hphmdl08.dat

[2005.01.01 22:18:12 | 000,073,637 | ---- | C] () -- C:\WINDOWS\hpiins01.dat

[2005.01.01 22:18:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpimdl01.dat

[2005.01.01 22:14:26 | 000,088,050 | ---- | C] () -- C:\WINDOWS\hpqins69.dat

[2005.01.01 22:12:48 | 000,113,695 | ---- | C] () -- C:\WINDOWS\hpoins07.dat

[2005.01.01 22:12:48 | 000,021,124 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat

[2005.01.01 22:09:42 | 000,089,154 | ---- | C] () -- C:\WINDOWS\hpoins06.dat

[2005.01.01 22:09:42 | 000,005,389 | ---- | C] () -- C:\WINDOWS\hpomdl06.dat

[2005.01.01 22:08:42 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2005.01.01 22:05:39 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2005.01.01 22:05:39 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2005.01.01 22:05:39 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll

[2005.01.01 22:05:39 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2005.01.01 22:05:39 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2005.01.01 22:05:39 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2005.01.01 22:05:39 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2005.01.01 22:05:39 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2005.01.01 21:52:19 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2005.01.01 21:49:10 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll

[2005.01.01 21:49:10 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll

[2005.01.01 21:48:54 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll

[2004.11.02 20:13:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2004.11.02 20:10:36 | 000,465,684 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2004.11.02 20:10:36 | 000,446,752 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2004.11.02 20:10:36 | 000,087,382 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2004.11.02 20:10:36 | 000,073,574 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2004.11.02 20:08:40 | 000,314,768 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2004.11.02 20:05:34 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2004.11.02 20:03:38 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2004.08.04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat

[2004.08.04 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat

[2004.08.04 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2004.08.04 06:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2004.08.04 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat

[2004.08.04 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin

[2004.08.04 06:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2004.08.04 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2004.08.04 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin

[2004.08.04 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

[2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[2002.09.20 18:19:34 | 000,001,194 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

[2001.08.23 17:12:28 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin

[2001.08.23 17:11:02 | 000,004,490 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

[2001.07.06 23:30:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI

 
 ========== LOP Check ==========

 

[2011.04.16 20:36:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avanquest

[2009.05.26 18:26:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BTrieve

[2010.08.07 19:27:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software

[2011.07.14 17:35:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Easybits GO

[2010.05.17 20:31:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular

[2009.05.26 18:16:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Haufe

[2009.05.26 23:09:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lexware

[2010.11.19 14:16:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Philips

[2010.12.23 03:23:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WindSolutions

[2008.03.08 00:30:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip

[2011.09.04 12:01:01 | 000,000,238 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %ALLUSERSPROFILE%\Application Data\*. >

 
 < %ALLUSERSPROFILE%\Application Data\*.exe /s >

 
 < %APPDATA%\*. >

[2010.07.08 10:34:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Adobe

[2008.05.09 18:04:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\AdobeUM

[2008.10.26 12:38:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Apple Computer

[2010.11.19 14:24:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\ArcSoft

[2010.07.12 15:52:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Avira

[2008.03.11 21:39:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Bullzip

[2007.11.02 12:13:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Command & Conquer 3 Tiberium Wars

[2011.01.29 13:38:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\CyberLink

[2010.07.24 22:10:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\DivX

[2009.11.08 15:21:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Dr. Regener

[2010.08.05 12:52:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\DVDVideoSoftIEHelpers

[2010.05.17 20:32:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\elsterformular

[2010.07.19 12:24:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Foxit

[2011.06.10 20:19:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\GetRightToGo

[2011.05.29 14:00:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\go

[2008.01.30 18:20:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Google

[2009.05.27 18:52:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Haufe

[2007.10.02 16:14:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\HP

[2007.10.07 14:16:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\HPQ

[2005.10.27 01:32:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Identities

[2007.10.09 17:05:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Leadertech

[2009.05.26 23:04:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Lexware

[2007.10.02 00:41:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Macromedia

[2010.07.12 13:16:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Malwarebytes

[2010.07.16 15:34:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Media Player Classic

[2010.12.22 03:56:48 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Microsoft

[2008.09.17 00:45:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla

[2011.09.04 11:58:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\OpenOffice.org2

[2011.09.01 12:15:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Philipp Winterberg

[2007.10.07 02:41:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Real

[2007.11.01 21:09:53 | 000,000,000 | RH-D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\SecuROM

[2011.08.30 18:06:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Skype

[2011.07.14 17:34:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\skypePM

[2007.10.09 17:05:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Sonic

[2007.10.02 23:15:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Sun

[2010.07.16 19:40:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\SUPERAntiSpyware.com

[2011.01.19 23:31:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\TeamViewer

[2007.11.21 19:02:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Winamp

[2010.12.23 03:35:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\WindSolutions

[2011.06.10 20:21:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\WinRAR

 
 < %APPDATA%\*.exe /s >

[2008.05.08 22:57:07 | 022,319,360 | ---- | M] (                                   ) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Adobe\Acrobat\7.0\Updater\AdbeRdr710_de_DE.exe

[2010.12.23 03:21:35 | 002,728,160 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\CopyTransControlCenter.exe

[2010.12.23 03:23:09 | 006,976,696 | ---- | M] (WindSolutions) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\WindSolutions\CopyTransControlCenter\Applications\CopyTransManager.exe

 
 < %SYSTEMDRIVE%\*.exe >

 

 
 < MD5 for: AGP440.SYS  >

[2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2010.07.18 23:29:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2004.08.03 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys

[2010.07.18 23:29:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ERDNT\cache\agp440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 
 < MD5 for: ATAPI.SYS  >

[2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2010.07.18 23:29:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2004.08.03 14:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys

[2010.07.18 23:29:27 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ERDNT\cache\atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004.08.04 06:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

[2004.08.04 06:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

 
 < MD5 for: EVENTLOG.DLL  >

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ERDNT\cache\eventlog.dll

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll

[2004.08.04 06:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 
 < MD5 for: NETLOGON.DLL  >

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ERDNT\cache\netlogon.dll

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll

[2004.08.04 06:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll

[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll

 
 < MD5 for: SCECLI.DLL  >

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ERDNT\cache\scecli.dll

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll

[2004.08.04 06:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

 
 < MD5 for: USER32.DLL  >

[2005.03.02 20:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll

[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll

[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll

[2004.08.04 06:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll

[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ERDNT\cache\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll

[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll

 
 < MD5 for: USERINIT.EXE  >

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ERDNT\cache\userinit.exe

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe

[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe

[2004.08.04 06:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

 
 < MD5 for: VAXSCSI.SYS  >

[2008.04.29 18:45:16 | 000,223,128 | ---- | M] (Alcohol Soft Co., Ltd.) MD5=92CEBC2BC7BE2C8D49391B365569F306 -- C:\WINDOWS\system32\drivers\vaxscsi.sys

 
 < MD5 for: WINLOGON.EXE  >

[2004.08.04 06:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ERDNT\cache\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe

[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe

 
 < MD5 for: WS2IFSL.SYS  >

[2004.08.04 06:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys

[2004.08.04 06:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys

 
 < %systemroot%\system32\drivers\*.sys /lockedfiles >

[2007.11.01 20:37:01 | 000,685,816 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys

 
 < %systemroot%\System32\config\*.sav >

[2004.11.02 20:55:34 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2004.11.02 20:55:34 | 000,638,976 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

 
 < %systemroot%\*. /mp /s >

 
 < %systemroot%\system32\*.dll /lockedfiles >
 

< End of report >

--- --- ---

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.search-results.com/?l=dis&o=41648036

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

[2010.08.05 12:52:38 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\84t4r4d3.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

[2011.09.01 12:16:41 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Dokumente und Einstellungen\HP_Besitzer\Anwendungsdaten\Mozilla\Firefox\Profiles\84t4r4d3.default\extensions\toolbar@ask.com

O2 - BHO: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Search-Results)

O4 - HKLM..\Run: []  File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2004.11.02 20:05:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

[2011.09.01 12:15:57 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com

[2011.09.04 12:01:01 | 000,000,238 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

:Commands

[emptytemp]

[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Leider hat sich das Programm OTL in der Mitte des Durchlaufs aufgehangen, so dass ich neu starten musste. Virenscanner und alle anderen programme waren deaktiviert, muss ich noch etwas anderes beachten, z.B. Firewall deaktivieren? Ich würde es dann einfach nochmal probieren...

Nee, probier einfach nochmal. Und ja möglichst wenig Programme auf haben, Virenscanner unbedingt ausschalten. Windows-Firewall sollte nicht stören.