Google leitet mich auf sinnlose Seiten um

Carolina_91 · 20.06.2011, 20:24

Hallo

Ich bin völlig verzweifelt, mit Mühe und Not habe ich es geschafft, überhaupt auf diese Seite zu gelangen. Google leitet mich immer auf andere Seiten um, sobald ich einen Link aus den Suchergebnissen anklicke. Also zuerst steht noch der richtige Link in der Adress-Zeile und dann stellt der Laptop das selbständig um..
Außerdem ist die komplette Leistung des Laptops gestört: Alles ist auf einmal extrem verlangsamt, auch Vorgänge ohne Internet, wie Öffnen der Systemsteuerung o.Ä., manchmal hängen sich einzelne Fenster total auf, sodass ich nichts mehr tun kann und per strg+alt+entf das Programm schließen muss (was zwischendurch auch nicht geht). Der Laptop ist unnatürlich laut, ich weiß nicht ob das etwas damit zu tun hat, aber normalerweise ist er relativ ruhig, erst seit die anderen Symptome aufgetreten sind, ist er lauter geworden.
Manchmal sehe ich auch nur noch meinen Desktop-Hintergrund, ohne Taskleiste oder Symbole, wenn ich gerade auf "Ausschalten" geklickt habe. Ich weiß, dass das für einen Moment normal ist, aber bei mir bleibt das dann einfach so und ich muss per Dauerdruck auf den Startknopf ausschalten.
Ach ja, und zwischendurch kommt immer mal wieder so ein Ton, wie wenn man eine Fehlermeldung kriegt, aber ich seh nichts..
So, ich hoffe ich hab nichts vergessen und dass mir jemand helfen kann..
Vielen Dank im Voraus,
LG Caro

markusg · 21.06.2011, 10:16

hiho
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
beide posten

Carolina_91 · 21.06.2011, 12:48

Danke für die schnelle Antwort, hier die Reporte:

markusg · 21.06.2011, 13:52

der text ergibt keinen sinn, hast du otl so ausgeführt und dieses zeug da bekommen was du gepostet hast?

Carolina_91 · 21.06.2011, 18:27

Ja, also eigentlich schon.. es sei denn, ich habe beim Hochladen was falsch gemacht.. Ich kenn mich da nicht so aus^^

markusg · 21.06.2011, 18:40

dann machs mal bitte erneut.
und kopiere von mir aus den inhalt der otl.txt einfach hier rein :-)

Carolina_91 · 22.06.2011, 16:02

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 22.06.2011 15:55:26 - Run 3
OTL by OldTimer - Version 3.2.24.1     Folder = C:\Dokumente und Einstellungen\Caro\Eigene Dateien
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,75 Gb Total Physical Memory | 1,04 Gb Available Physical Memory | 59,33% Memory free
3,60 Gb Paging File | 2,90 Gb Available in Paging File | 80,74% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 297,08 Gb Total Space | 248,43 Gb Free Space | 83,63% Space Free | Partition Type: NTFS
Drive D: | 1,00 Gb Total Space | 1,00 Gb Free Space | 99,50% Space Free | Partition Type: FAT32
Drive F: | 6,34 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: NOTEBOOK | User Name: Caro | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Caro\Eigene Dateien\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe ()
PRC - C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe ()
PRC - C:\Programme\Verbindungsassistent\Verbindungsassistent.exe (WebToGo Mobile Internet GmbH)
PRC - C:\Programme\Verbindungsassistent\WTGService.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\MyWebSearch\bar\3.bin\MWSOEMON.EXE (MyWebSearch.com)
PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
PRC - C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\system32\AESTFltr.exe (Andrea Electronics Corporation)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Programme\LSI SoftModem\agrsmsvc.exe (Agere Systems)
PRC - C:\Programme\PDF Complete\pdfsvc.exe (PDF Complete Inc)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Dokumente und Einstellungen\Caro\Eigene Dateien\OTL.exe (OldTimer Tools)
MOD - C:\Programme\MyWebSearch\bar\3.bin\MWSOESTB.DLL (MyWebSearch.com)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\BtMmHook.dll (Broadcom Corporation.)
MOD - C:\Programme\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (SSHNAS) --  File not found
SRV - (0035151258721312mcinstcleanup) McAfee Application Installer Cleanup (0035151258721312) --  File not found
SRV - (WTGService) -- C:\Programme\Verbindungsassistent\WTGService.exe ()
SRV - (MyWebSearchService) -- C:\Programme\MyWebSearch\bar\3.bin\MWSSVC.EXE (MyWebSearch.com)
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (LightScribeService) -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe (Hewlett-Packard Company)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (STacSV) -- c:\Programme\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (AgereModemAudio) -- C:\Programme\LSI SoftModem\agrsmsvc.exe (Agere Systems)
SRV - (pdfcDispatcher) -- C:\Programme\PDF Complete\pdfsvc.exe (PDF Complete Inc)
SRV - (PSI_SVC_2) -- C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (IviRegMgr) -- C:\Programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (dtsoftbus01) -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MQAC) -- C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation)
DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (IDT, Inc.)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (ahcix86) -- C:\WINDOWS\System32\DRIVERS\ahcix86.sys (Advanced Micro Devices, Inc)
DRV - (AESTAud) -- C:\WINDOWS\system32\drivers\AESTAud.sys (Andrea Electronics Corporation)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (RMCAST) -- C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (HpqKbFiltr) -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (regi) -- C:\WINDOWS\system32\drivers\regi.sys (InterVideo)
DRV - (AmdPPM) -- C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)
DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3940611076-4115891190-78566518-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche
IE - HKU\S-1-5-21-3940611076-4115891190-78566518-1006\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-3940611076-4115891190-78566518-1006\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\3.bin\MWSSRCAS.DLL (MyWebSearch.com)
IE - HKU\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:53495
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig?hl=de"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: m3ffxtbr@mywebsearch.com:1.2
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.8
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.5.8.6
FF - prefs.js..keyword.URL: "hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=6xMaYxSN&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 53495
FF - prefs.js..network.proxy.type: 1
 
FF - user.js..browser.search.selectedEngine: "Search"
FF - user.js..keyword.URL: "hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=6xMaYxSN&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\m3ffxtbr@mywebsearch.com: C:\Programme\MyWebSearch\bar\3.bin [2011.06.12 00:00:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.06.13 14:04:40 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.06.13 14:12:21 | 000,000,000 | ---D | M]
 
[2009.11.24 19:29:20 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Extensions
[2011.06.15 16:00:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\extensions
[2009.11.25 23:18:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.06.15 16:00:46 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2011.03.05 00:23:58 | 000,002,197 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\google-search.xml
[2010.11.13 01:56:40 | 000,000,776 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icq-search.xml
[2010.01.10 13:56:05 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-1.xml
[2011.03.03 19:09:58 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-10.xml
[2011.03.05 15:45:06 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-11.xml
[2011.05.01 09:57:59 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-12.xml
[2011.06.13 14:05:45 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-13.xml
[2010.02.04 17:58:28 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-2.xml
[2010.04.04 14:02:36 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-3.xml
[2010.06.05 14:56:07 | 000,000,666 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-4.xml
[2010.09.10 17:40:35 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-5.xml
[2010.09.16 21:47:05 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-6.xml
[2010.10.24 12:29:16 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-7.xml
[2010.10.31 22:09:36 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-8.xml
[2010.11.13 01:59:12 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin-9.xml
[2010.05.12 18:40:06 | 000,001,042 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\searchplugins\icqplugin.xml
[2011.06.13 14:12:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.02.04 17:31:02 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.06.13 14:12:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- 
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\CARO\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\3KZ7W170.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI
[2011.06.13 14:12:05 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.06.12 00:00:15 | 000,000,000 | ---D | M] (My Web Search) -- C:\PROGRAMME\MYWEBSEARCH\BAR\3.BIN
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2011.06.13 14:12:04 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.03.05 00:23:58 | 000,002,197 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\google-search.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O2 - BHO: (MyWebSearch Search Assistant BHO) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\bar\3.bin\MWSSRCAS.DLL (MyWebSearch.com)
O2 - BHO: (mwsBar BHO) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\3.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKLM\..\Toolbar: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\3.bin\MWSBAR.DLL (MyWebSearch.com)
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006\..\Toolbar\WebBrowser: (My Web Search) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\3.bin\MWSBAR.DLL (MyWebSearch.com)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [comctl32]  File not found
O4 - HKLM..\Run: [conhost] C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe ()
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HPCam_Menu] c:\Programme\Hewlett-Packard\HP Webcam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
O4 - HKLM..\Run: [MsmqIntCert] C:\WINDOWS\System32\mqrt.dll (Microsoft Corporation)
O4 - HKLM..\Run: [My Web Search Bar Search Scope Monitor] C:\Programme\MyWebSearch\bar\3.bin\M3SRCHMN.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\Programme\MyWebSearch\bar\3.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKLM..\Run: [PDF Complete] C:\Programme\PDF Complete\pdfsty.exe (PDF Complete Inc)
O4 - HKLM..\Run: [Regedit32]  File not found
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Windows System Manager]  File not found
O4 - HKLM..\Run: [zCpqset] C:\Programme\Hewlett-Packard\Default Settings\Cpqset.exe ()
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [{0E0A6A5A-B7BA-D0B0-1E0B-76A3A46E006A}]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [comctl32]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [EA Core]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [ICQ] C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [LightScribe Control Panel] C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [M5T8QL3YW3]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [msnmsgr]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [MyWebSearch Email Plugin] C:\Programme\MyWebSearch\bar\3.bin\MWSOEMON.EXE (MyWebSearch.com)
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [pj6vi7wlh9]  File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Dokumente und Einstellungen\Caro\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
F3 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006 WinNT: Load - (C:\DOKUME~1\Caro\LOKALE~1\Temp\csrss.exe) -  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1258722041265 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - c:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - c:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006 Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006 Winlogon: Shell - (C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe) - C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.04.24 01:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.) - F:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2008.06.02 18:16:48 | 000,000,045 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{0dd626db-d7a6-11de-a97d-00265e5706c9}\Shell - "" = AutoRun
O33 - MountPoints2\{0dd626db-d7a6-11de-a97d-00265e5706c9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{0dd626db-d7a6-11de-a97d-00265e5706c9}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2008.04.24 01:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{221950ca-db48-11de-a983-00265e5706c9}\Shell - "" = AutoRun
O33 - MountPoints2\{221950ca-db48-11de-a983-00265e5706c9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{221950ca-db48-11de-a983-00265e5706c9}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2008.04.24 01:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{8de0bd9e-e4e3-11de-a993-00265e5706c9}\Shell - "" = AutoRun
O33 - MountPoints2\{8de0bd9e-e4e3-11de-a993-00265e5706c9}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{8de0bd9e-e4e3-11de-a993-00265e5706c9}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2008.04.24 01:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{b9d76190-8f75-11df-aad4-00247e984400}\Shell - "" = AutoRun
O33 - MountPoints2\{b9d76190-8f75-11df-aad4-00247e984400}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{b9d76190-8f75-11df-aad4-00247e984400}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{ede01040-74b2-11e0-ac7a-00247e984400}\Shell - "" = AutoRun
O33 - MountPoints2\{ede01040-74b2-11e0-ac7a-00247e984400}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ede01040-74b2-11e0-ac7a-00247e984400}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2008.04.24 01:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{ede01043-74b2-11e0-ac7a-00247e984400}\Shell - "" = AutoRun
O33 - MountPoints2\{ede01043-74b2-11e0-ac7a-00247e984400}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ede01043-74b2-11e0-ac7a-00247e984400}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2008.04.24 01:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O33 - MountPoints2\{f8d38f5f-8213-11e0-ac9b-00247e984400}\Shell - "" = AutoRun
O33 - MountPoints2\{f8d38f5f-8213-11e0-ac9b-00247e984400}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f8d38f5f-8213-11e0-ac9b-00247e984400}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2008.04.24 01:44:40 | 000,114,688 | R--- | M] (Huawei Technologies Co., Ltd.)
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: SSHNAS -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - Microsoft NetShow Player
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: Microsoft Base Smart Card Crypto Provider Package - 
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (69537929998893056)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.22 15:54:27 | 000,579,072 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\OTL.exe
[2011.06.22 15:07:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\befis
[2011.06.20 17:27:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\pikt
[2011.06.17 20:42:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2011.06.17 20:42:50 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun
[2011.06.16 18:15:11 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2011.06.16 16:41:44 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys
[2011.06.13 14:18:51 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\OpenOffice.org 3.3
[2011.06.13 14:14:59 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011.06.13 14:12:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
[2011.06.13 14:12:28 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2011.06.13 14:12:21 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011.06.13 14:12:21 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.06.13 14:12:21 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.06.13 14:12:21 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.06.13 14:12:21 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011.06.13 14:09:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\sun
[2011.06.12 09:09:52 | 000,014,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhid.sys
[2011.05.23 18:08:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\EA GAMES
[2011.05.23 17:59:26 | 000,000,000 | ---D | C] -- C:\Programme\EA GAMES
[2011.05.23 17:56:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Dokumente\DAEMON Tools Images
[2011.05.23 17:55:16 | 000,218,688 | ---- | C] (DT Soft Ltd) -- C:\WINDOWS\System32\drivers\dtsoftbus01.sys
[2011.05.23 17:55:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\DAEMON Tools Lite
[2011.05.23 17:55:07 | 000,000,000 | ---D | C] -- C:\Programme\DAEMON Tools Lite
[2011.05.23 17:54:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\DAEMON Tools Lite
[2011.05.23 17:54:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2009.11.20 14:35:21 | 000,203,328 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2009.11.20 14:35:18 | 000,256,576 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.22 15:58:13 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.06.22 15:56:10 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{065FC861-89CA-4183-AD6B-D896D5AB5CF3}.job
[2011.06.22 15:54:34 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\OTL.exe
[2011.06.22 15:46:43 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.06.22 15:46:08 | 000,173,776 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2011.06.22 15:46:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.06.22 15:46:03 | 1875,759,104 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.22 14:50:53 | 000,010,124 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\F56E.7D4
[2011.06.20 18:39:19 | 000,045,038 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\hilfsforum.odt
[2011.06.20 17:28:42 | 000,000,148 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\defogger_reenable
[2011.06.17 20:30:42 | 000,184,832 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe
[2011.06.16 18:16:39 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.06.15 18:41:32 | 000,009,164 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\Zugfahrt Berlin Details.odt
[2011.06.14 19:27:13 | 000,027,698 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\PM 14.6.11.odt
[2011.06.13 20:47:53 | 000,074,399 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Desktop\Buchungs-Bestätigung_zu_Vorgang_Nr._17808194.pdf
[2011.06.13 17:43:17 | 000,294,072 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.06.13 14:25:12 | 000,000,836 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
[2011.06.13 14:14:59 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011.06.13 14:12:03 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2011.06.13 14:12:03 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2011.06.13 14:12:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2011.06.13 14:12:03 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2011.06.13 14:12:03 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2011.06.13 14:04:44 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk
[2011.06.04 15:19:10 | 339,548,990 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\Herbert_Gronemeyer_-_Was_Muss_Muss.rar
[2011.05.31 00:12:59 | 005,964,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2011.05.30 11:24:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011.05.25 20:07:00 | 000,497,416 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.05.25 20:07:00 | 000,452,372 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.05.25 20:07:00 | 000,098,294 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.05.25 20:07:00 | 000,074,546 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.05.25 07:20:00 | 000,000,521 | ---- | M] () -- C:\hpfr3320.xml
[2011.05.23 18:08:16 | 000,001,704 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Die Sims 2.lnk
[2011.05.23 17:55:16 | 000,218,688 | ---- | M] (DT Soft Ltd) -- C:\WINDOWS\System32\drivers\dtsoftbus01.sys
[2011.05.23 17:55:11 | 000,001,577 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DAEMON Tools Lite.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.20 18:39:16 | 000,045,038 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\hilfsforum.odt
[2011.06.20 17:28:40 | 000,000,148 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\defogger_reenable
[2011.06.17 20:30:42 | 000,184,832 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe
[2011.06.17 20:30:23 | 000,010,124 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\F56E.7D4
[2011.06.15 18:41:31 | 000,009,164 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\Zugfahrt Berlin Details.odt
[2011.06.14 19:27:13 | 000,027,698 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\PM 14.6.11.odt
[2011.06.13 20:47:52 | 000,074,399 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Desktop\Buchungs-Bestätigung_zu_Vorgang_Nr._17808194.pdf
[2011.06.13 14:25:12 | 000,000,836 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Startmenü\Programme\Autostart\OpenOffice.org 3.3.lnk
[2011.06.13 14:04:44 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2011.06.12 10:30:06 | 1875,759,104 | -HS- | C] () -- C:\hiberfil.sys
[2011.06.04 14:21:06 | 339,548,990 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Eigene Dateien\Herbert_Gronemeyer_-_Was_Muss_Muss.rar
[2011.05.23 18:08:16 | 000,001,704 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Die Sims 2.lnk
[2011.05.23 17:55:11 | 000,001,577 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\DAEMON Tools Lite.lnk
[2010.06.05 13:53:11 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.03.08 23:19:28 | 000,045,940 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010.01.24 01:03:57 | 000,307,200 | ---- | C] () -- C:\WINDOWS\System32\AscSQLite.dll
[2009.12.19 21:34:43 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.22 23:33:32 | 000,002,984 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
[2009.11.22 23:33:32 | 000,000,008 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\58E610A541.sys
[2009.11.20 17:59:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.11.20 14:35:21 | 001,765,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2009.11.20 14:35:21 | 000,034,496 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2009.11.20 14:35:21 | 000,027,200 | ---- | C] () -- C:\WINDOWS\snuvcdsm.exe
[2009.11.20 14:35:21 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2009.11.20 14:30:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2009.08.06 03:31:03 | 000,029,752 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009.04.01 09:57:02 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2009.04.01 09:57:02 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2009.02.23 03:39:30 | 000,184,394 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2008.12.11 15:22:10 | 002,854,976 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2008.05.26 23:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2008.05.26 23:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2008.05.26 23:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2008.05.26 22:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008.05.26 22:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2004.08.07 08:08:56 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004.08.07 08:08:46 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004.08.07 08:04:28 | 000,497,416 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.07 08:04:28 | 000,452,372 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.07 08:04:28 | 000,098,294 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.07 08:04:28 | 000,074,546 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.07 08:02:10 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004.08.07 07:57:28 | 000,294,072 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004.08.07 07:52:36 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.08.07 07:49:42 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.08.04 10:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.04 10:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.04 10:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.04 10:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.04 10:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.04 10:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.04 10:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.04 10:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.04 10:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.08.04 10:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002.05.28 10:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002.05.28 10:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2009.11.21 14:30:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ICQ
[2009.11.22 23:33:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\InterVideo
[2010.11.13 01:55:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Verbindungsassistent
[2009.11.20 16:44:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Windows Desktop Search
[2011.05.27 18:44:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2010.01.23 20:39:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Electronic Arts
[2010.06.13 17:05:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ
[2010.09.10 22:04:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NCH Swift Sound
[2011.06.20 13:27:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PDFC
[2009.11.20 14:35:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp
[2011.01.11 23:57:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009.11.27 17:35:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2011.01.14 23:13:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\AnvSoft
[2010.07.20 21:33:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\D21FD9D7373D11FF9DFAA905966F8D5A
[2011.05.23 17:56:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\DAEMON Tools Lite
[2011.01.20 22:52:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\de.closeup.fotowerkstatt.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2011.03.02 19:49:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\gtk-2.0
[2011.01.09 12:24:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Hyynni
[2011.05.25 15:15:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\ICQ
[2009.12.27 02:28:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\InterVideo
[2010.11.13 01:56:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\NCH Swift Sound
[2009.11.27 19:14:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\OCS
[2011.01.06 19:31:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Onroy
[2009.12.05 22:21:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\OpenOffice.org
[2009.11.27 19:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Opera
[2009.11.27 19:14:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\soul.im
[2011.06.20 13:18:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent
[2009.11.23 21:37:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Windows Desktop Search
[2009.11.23 21:38:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Windows Search
[2009.11.24 19:57:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Verbindungsassistent
[2009.11.25 23:14:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Verbindungsassistent
[2011.01.13 00:42:26 | 000,000,284 | ---- | M] () -- C:\WINDOWS\Tasks\expressripShakeIcon.job
[2011.04.23 19:28:53 | 000,000,268 | ---- | M] () -- C:\WINDOWS\Tasks\switchShakeIcon.job
[2011.06.22 15:56:10 | 000,000,416 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{065FC861-89CA-4183-AD6B-D896D5AB5CF3}.job
[2011.01.21 23:13:05 | 000,000,270 | ---- | M] () -- C:\WINDOWS\Tasks\videopadShakeIcon.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.06.17 20:30:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Adobe
[2011.01.14 23:13:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\AnvSoft
[2011.01.11 23:58:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Apple Computer
[2009.11.23 21:38:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\ATI
[2009.12.27 02:28:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Corel
[2010.07.20 21:33:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\D21FD9D7373D11FF9DFAA905966F8D5A
[2011.05.23 17:56:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\DAEMON Tools Lite
[2011.01.20 22:52:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\de.closeup.fotowerkstatt.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1
[2010.05.16 16:01:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\DivX
[2011.03.02 19:49:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\gtk-2.0
[2010.05.13 15:46:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Help
[2009.08.06 03:48:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\hpqLog
[2011.01.09 12:24:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Hyynni
[2011.05.25 15:15:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\ICQ
[2009.08.06 11:41:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Identities
[2009.08.06 03:09:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\InstallShield
[2009.12.27 02:28:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\InterVideo
[2009.11.23 21:47:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Macromedia
[2011.06.19 19:36:12 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft
[2009.11.24 19:29:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Mozilla
[2011.01.11 23:13:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\NCH Software
[2010.11.13 01:56:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\NCH Swift Sound
[2009.11.27 19:14:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\OCS
[2011.01.06 19:31:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Onroy
[2009.12.05 22:21:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\OpenOffice.org
[2009.11.27 19:14:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Opera
[2009.08.06 03:51:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\SiteAdvisor
[2009.11.27 19:14:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\soul.im
[2009.11.28 12:44:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Sun
[2011.06.20 13:18:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent
[2009.11.23 21:37:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Windows Desktop Search
[2009.11.23 21:38:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Windows Search
[2009.11.30 23:22:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2011.06.17 20:30:42 | 000,184,832 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe
File not found -- 
[2011.06.17 20:30:18 | 000,000,162 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Adobe\plugs\mmc38.exe
[2011.01.20 22:48:29 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.06.17 20:30:22 | 000,173,568 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe
[2010.01.16 10:20:15 | 000,010,134 | R--- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
[2009.11.27 19:14:09 | 000,106,496 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\OCS\SM\SearchAnonymizer.exe
[2009.11.27 19:14:09 | 000,040,960 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\OCS\SM\SearchAnonymizerHelper.exe
[2009.01.14 11:09:12 | 000,120,264 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\Del_CD_ROM.exe
[2009.03.03 12:44:48 | 000,030,160 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\InstallWTGService.exe
[2009.03.03 12:44:55 | 000,251,344 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\OSU.exe
[2009.03.03 12:45:08 | 000,693,712 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\Setup.exe
[2009.03.03 12:45:05 | 001,091,024 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\Uninstaller.exe
[2009.03.03 12:44:52 | 007,009,744 | ---- | M] (WebToGo Mobile Internet GmbH) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\Verbindungsassistent.exe
[2009.03.04 08:34:41 | 000,468,432 | ---- | M] (WebToGo Mobiles Internet GmbH) -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\Verbindungsassistent_SMSMMS.exe
[2009.03.03 12:45:11 | 000,296,400 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\WTGService.exe
[2009.03.03 12:45:15 | 000,243,152 | ---- | M] () -- C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Verbindungsassistent\BackUp\WTGVistaUtil.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 15:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys
[2004.08.04 10:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009.11.20 17:21:52 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2009.11.20 17:21:52 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 20:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: AHCIX86.SYS  >
[2009.03.10 18:26:00 | 000,189,456 | ---- | M] (Advanced Micro Devices, Inc) MD5=B7A9F32A54FD9D2F53BBF36AEF8D27B2 -- C:\SwSetup\HDD1\ahcix86.sys
[2009.03.10 18:26:00 | 000,189,456 | ---- | M] (Advanced Micro Devices, Inc) MD5=B7A9F32A54FD9D2F53BBF36AEF8D27B2 -- C:\SwSetup\HDD1\RAID7xx\x86\ahcix86.sys
[2009.03.10 18:26:00 | 000,189,456 | ---- | M] (Advanced Micro Devices, Inc) MD5=B7A9F32A54FD9D2F53BBF36AEF8D27B2 -- C:\WINDOWS\system32\drivers\ahcix86.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 15:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys
[2004.08.04 10:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009.11.20 17:21:52 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2009.11.20 17:21:52 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 20:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.03 17:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 04:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 10:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2004.08.04 10:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
[2007.06.13 15:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe
[2008.04.14 04:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 04:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 10:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtUninstallKB968389_0$\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009.02.06 20:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$NtUninstallKB975467_0$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 04:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 10:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.03.08 17:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 20:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 10:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 17:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 04:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 04:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 10:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 10:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 04:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 10:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2004.08.07 09:42:24 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004.08.07 09:42:24 | 000,663,552 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004.08.07 09:42:24 | 000,438,272 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >

--- --- ---

markusg · 22.06.2011, 16:24

das sieht doch gut aus
zumindest das log ist da.

deine internet verbindung könnte nach dem otl script gekapt sein. schreib dir die arbeitsschritte mit den proxy einstellungen, die nach otl folgen auf.

achtung!
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
PRC - C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe ()
PRC - C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe ()
SRV - (SSHNAS) --  File not found
SRV - (0035151258721312mcinstcleanup) McAfee Application Installer Cleanup (0035151258721312) --  File not found
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found
O4 - HKLM..\Run: [comctl32]  File not found
O4 - HKLM..\Run: [conhost] C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe ()
O4 - HKLM..\Run: [Regedit32]  File not found
O4 - HKLM..\Run: [Windows System Manager]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [{0E0A6A5A-B7BA-D0B0-1E0B-76A3A46E006A}]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [comctl32]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [EA Core]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [M5T8QL3YW3]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [msnmsgr]  File not found
O4 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006..\Run: [pj6vi7wlh9]  File not found
F3 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006 WinNT: Load - (C:\DOKUME~1\Caro\LOKALE~1\Temp\csrss.exe) -  File not found
O20 - HKU\S-1-5-21-3940611076-4115891190-78566518-1006 Winlogon: Shell - (C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe) - C:\Dokumente und
Einstellungen\Caro\Anwendungsdaten\dwm.exe ()

:Files
C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe
C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

proxy einstellungen:
öffne internet explorer, extras, internet optionen, verbindung, lanverbindung.
eintrag bei proxy löschen und keinen proxy verwenden einstellen, übernehmen ok.
öffne firefox, extras einstellungen erweitert, netzwerk, keinen proxy verwenden, übernehmen ok.

öffne arbeitsplatz, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
http://www.trojaner-board.de/54791-a...ner-board.html

Carolina_91 · 22.06.2011, 17:51

Wow, ok, ich hoffe das war jetzt alles i.O., wie ich das gemacht habe, aber ich habe deine Anleitung genauestens befolgt =)

All processes killed
========== OTL ==========
No active process named dwm.exe was found!
No active process named conhost.exe was found!
Service SSHNAS stopped successfully!
Service SSHNAS deleted successfully!
File File not found not found.
Error: No service named 0035151258721312mcinstcleanup) McAfee Application Installer Cleanup (0035151258721312 was found to stop!
Service\Driver key 0035151258721312mcinstcleanup) McAfee Application Installer Cleanup (0035151258721312 not found.
File File not found not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{0BF43445-2F28-4351-9252-17FE6E806AA0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0BF43445-2F28-4351-9252-17FE6E806AA0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\comctl32 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\conhost deleted successfully.
File move failed. C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Regedit32 deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Windows System Manager deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Run\\{0E0A6A5A-B7BA-D0B0-1E0B-76A3A46E006A} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E0A6A5A-B7BA-D0B0-1E0B-76A3A46E006A}\ not found.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Run\\comctl32 deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Run\\EA Core deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Run\\M5T8QL3YW3 deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Run\\msnmsgr deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\Software\Microsoft\Windows\CurrentVersion\Run\\pj6vi7wlh9 deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\DOKUME~1\Caro\LOKALE~1\Temp\csrss.exe deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3940611076-4115891190-78566518-1006\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe deleted successfully.
File C:\Dokumente und not found.
========== FILES ==========
C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\dwm.exe moved successfully.
File\Folder C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 2180 bytes

User: All Users

User: Caro
->Flash cache emptied: 211352 bytes

User: Default User
->Flash cache emptied: 56502 bytes

User: LocalService

User: NetworkService
->Flash cache emptied: 6209 bytes

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 65109854 bytes
->Temporary Internet Files folder emptied: 79156535 bytes
->Java cache emptied: 13689500 bytes
->FireFox cache emptied: 92350544 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Caro
->Temp folder emptied: 18633873 bytes
->Temporary Internet Files folder emptied: 116558231 bytes
->Java cache emptied: 77712 bytes
->FireFox cache emptied: 502118184 bytes
->Google Chrome cache emptied: 6124169 bytes
->Apple Safari cache emptied: 773120 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1534122 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 255556664 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 844514 bytes
RecycleBin emptied: 589735 bytes

Total Files Cleaned = 1.100,00 mb

OTL by OldTimer - Version 3.2.24.1 log created on 06222011_182824

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\Caro\Anwendungsdaten\Microsoft\conhost.exe not found!
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\W8OBIXJL\player_v2[1].swf moved successfully.
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S7WAH3QC\searchnation_net[1].htm moved successfully.
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S7WAH3QC\searchnation_net[2].htm moved successfully.
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\OXPT8ES3\button[1].txt moved successfully.
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IKSKUVAD\132153.0.0[1].swf moved successfully.
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\HHN95SY0\g1309779[1].txt moved successfully.
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\HHN95SY0\in[1].htm moved successfully.
C:\Dokumente und Einstellungen\Caro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\DB2K1XUC\proxy[1].html moved successfully.
File\Folder C:\WINDOWS\temp\hsperfdata_SYSTEM\1292 not found!
C:\WINDOWS\temp\MPC1D.tmp moved successfully.

Registry entries deleted on Reboot...

markusg · 22.06.2011, 17:53

na ganz befolgt hast du sie nicht, ich warte auf den upload, im upload channel.

markusg · 22.06.2011, 18:03

danke, hat geklappt
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Carolina_91 · 22.06.2011, 20:54

Ok, erledigt:
Combofix Logfile:

Code:

ATTFilter

ComboFix 11-06-22.01 - Caro 22.06.2011  21:23:45.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1789.1074 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Caro\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Caro\Anwendungsdaten\Adobe\plugs
c:\dokumente und einstellungen\Caro\Anwendungsdaten\Adobe\plugs\mmc19216421.txt
c:\dokumente und einstellungen\Caro\Anwendungsdaten\Adobe\plugs\mmc38.exe
c:\dokumente und einstellungen\Caro\Anwendungsdaten\Adobe\shed
c:\dokumente und einstellungen\Caro\Anwendungsdaten\Adobe\shed\thr1.chm
c:\progra~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
c:\programme\FunWebProducts
c:\programme\FunWebProducts\Shared\00400680.dat
c:\programme\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\programme\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\programme\FunWebProducts\Shared\Cache\WebfettiBtn.html
c:\programme\MyWebSearch
c:\programme\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR
c:\programme\MyWebSearch\bar\2.bin\chrome\M3FFXTBR.JAR
c:\programme\MyWebSearch\bar\2.bin\M3FFTBPR.DLL
c:\programme\MyWebSearch\bar\2.bin\M3PATCH.DLL
c:\programme\MyWebSearch\bar\3.bin\CHROME.MANIFEST
c:\programme\MyWebSearch\bar\3.bin\chrome\M3FFXTBR.JAR
c:\programme\MyWebSearch\bar\3.bin\F3BKGERR.JPG
c:\programme\MyWebSearch\bar\3.bin\F3CJpeg.dll
c:\programme\MyWebSearch\bar\3.bin\F3DTactl.dll
c:\programme\MyWebSearch\bar\3.bin\F3HISTSW.DLL
c:\programme\MyWebSearch\bar\3.bin\F3HKSTUB.DLL
c:\programme\MyWebSearch\bar\3.bin\F3HTmlmu.dll
c:\programme\MyWebSearch\bar\3.bin\F3HTtpct.dll
c:\programme\MyWebSearch\bar\3.bin\F3IMSTUB.DLL
c:\programme\MyWebSearch\bar\3.bin\F3POPSWT.DLL
c:\programme\MyWebSearch\bar\3.bin\F3PSSAVR.SCR
c:\programme\MyWebSearch\bar\3.bin\F3REGHK.DLL
c:\programme\MyWebSearch\bar\3.bin\F3REPROX.DLL
c:\programme\MyWebSearch\bar\3.bin\F3RESTUB.DLL
c:\programme\MyWebSearch\bar\3.bin\F3SCHMON.EXE
c:\programme\MyWebSearch\bar\3.bin\F3SCrctr.dll
c:\programme\MyWebSearch\bar\3.bin\F3SPACER.WMV
c:\programme\MyWebSearch\bar\3.bin\F3WALLPP.DAT
c:\programme\MyWebSearch\bar\3.bin\FWPBUDDY.PNG
c:\programme\MyWebSearch\bar\3.bin\INSTALL.RDF
c:\programme\MyWebSearch\bar\3.bin\M3AUXSTB.DLL
c:\programme\MyWebSearch\bar\3.bin\M3DLGHK.DLL
c:\programme\MyWebSearch\bar\3.bin\M3HIGHIN.EXE
c:\programme\MyWebSearch\bar\3.bin\M3HTML.DLL
c:\programme\MyWebSearch\bar\3.bin\M3IDLE.DLL
c:\programme\MyWebSearch\bar\3.bin\M3IMPIPE.EXE
c:\programme\MyWebSearch\bar\3.bin\M3MEDINT.EXE
c:\programme\MyWebSearch\bar\3.bin\M3MSg.dll
c:\programme\MyWebSearch\bar\3.bin\M3OUtlcn.dll
c:\programme\MyWebSearch\bar\3.bin\M3PLUGIN.DLL
c:\programme\MyWebSearch\bar\3.bin\M3SKIN.DLL
c:\programme\MyWebSearch\bar\3.bin\M3SKPLAY.EXE
c:\programme\MyWebSearch\bar\3.bin\M3SLSRCH.EXE
c:\programme\MyWebSearch\bar\3.bin\M3SRCHMN.EXE
c:\programme\MyWebSearch\bar\3.bin\M3TPINST.DLL
c:\programme\MyWebSearch\bar\3.bin\MWSBAR.DLL
c:\programme\MyWebSearch\bar\3.bin\MWSMLBTN.DLL
c:\programme\MyWebSearch\bar\3.bin\MWSOEMON.EXE
c:\programme\MyWebSearch\bar\3.bin\MWSOEPLG.DLL
c:\programme\MyWebSearch\bar\3.bin\MWSOESTB.DLL
c:\programme\MyWebSearch\bar\3.bin\MWSSRCAS.DLL
c:\programme\MyWebSearch\bar\3.bin\MWSSVC.EXE
c:\programme\MyWebSearch\bar\3.bin\MWSUABTN.DLL
c:\programme\MyWebSearch\bar\3.bin\NPMYWEBS.DLL
c:\programme\MyWebSearch\bar\Avatar\COMMON.F3S
c:\programme\MyWebSearch\bar\Cache\0001E2BA
c:\programme\MyWebSearch\bar\Cache\0001FD18.bmp
c:\programme\MyWebSearch\bar\Cache\0001FF0C
c:\programme\MyWebSearch\bar\Cache\0002209D.bin
c:\programme\MyWebSearch\bar\Cache\00022ACF.bin
c:\programme\MyWebSearch\bar\Cache\0002309B
c:\programme\MyWebSearch\bar\Cache\00023270.bin
c:\programme\MyWebSearch\bar\Cache\00023510.bin
c:\programme\MyWebSearch\bar\Cache\0002385C.bin
c:\programme\MyWebSearch\bar\Cache\000244DF
c:\programme\MyWebSearch\bar\Cache\00024D5B
c:\programme\MyWebSearch\bar\Cache\00024FCC
c:\programme\MyWebSearch\bar\Cache\00025DD5
c:\programme\MyWebSearch\bar\Cache\0002711F
c:\programme\MyWebSearch\bar\Cache\00027FB5
c:\programme\MyWebSearch\bar\Cache\000285DF
c:\programme\MyWebSearch\bar\Cache\00028F74
c:\programme\MyWebSearch\bar\Cache\00029B0D
c:\programme\MyWebSearch\bar\Cache\0002E3ED
c:\programme\MyWebSearch\bar\Cache\0002F4D6
c:\programme\MyWebSearch\bar\Cache\0002F718
c:\programme\MyWebSearch\bar\Cache\0002FBEA
c:\programme\MyWebSearch\bar\Cache\00031FFC
c:\programme\MyWebSearch\bar\Cache\0003225E
c:\programme\MyWebSearch\bar\Cache\000323F4
c:\programme\MyWebSearch\bar\Cache\00032D1C.exe
c:\programme\MyWebSearch\bar\Cache\000338C4
c:\programme\MyWebSearch\bar\Cache\00033E04
c:\programme\MyWebSearch\bar\Cache\00035A46
c:\programme\MyWebSearch\bar\Cache\00036032
c:\programme\MyWebSearch\bar\Cache\000374B4
c:\programme\MyWebSearch\bar\Cache\000380CA
c:\programme\MyWebSearch\bar\Cache\0003922F
c:\programme\MyWebSearch\bar\Cache\0003CAE2
c:\programme\MyWebSearch\bar\Cache\0003CE6D
c:\programme\MyWebSearch\bar\Cache\0003F6D4
c:\programme\MyWebSearch\bar\Cache\00041019
c:\programme\MyWebSearch\bar\Cache\00041123
c:\programme\MyWebSearch\bar\Cache\0004243D
c:\programme\MyWebSearch\bar\Cache\00042DF2
c:\programme\MyWebSearch\bar\Cache\00044051
c:\programme\MyWebSearch\bar\Cache\00044821
c:\programme\MyWebSearch\bar\Cache\000480A6
c:\programme\MyWebSearch\bar\Cache\000482C9
c:\programme\MyWebSearch\bar\Cache\0004852A
c:\programme\MyWebSearch\bar\Cache\00048FE8
c:\programme\MyWebSearch\bar\Cache\0004B3BC
c:\programme\MyWebSearch\bar\Cache\0004B66B
c:\programme\MyWebSearch\bar\Cache\0004C1A6
c:\programme\MyWebSearch\bar\Cache\0004CFC0
c:\programme\MyWebSearch\bar\Cache\0004D619
c:\programme\MyWebSearch\bar\Cache\0004F103
c:\programme\MyWebSearch\bar\Cache\00051573
c:\programme\MyWebSearch\bar\Cache\0005210C
c:\programme\MyWebSearch\bar\Cache\00052A92
c:\programme\MyWebSearch\bar\Cache\00053C55
c:\programme\MyWebSearch\bar\Cache\00054B87
c:\programme\MyWebSearch\bar\Cache\00055730.bmp
c:\programme\MyWebSearch\bar\Cache\00055839
c:\programme\MyWebSearch\bar\Cache\00056921
c:\programme\MyWebSearch\bar\Cache\00056CCB
c:\programme\MyWebSearch\bar\Cache\00058082
c:\programme\MyWebSearch\bar\Cache\00059B8C
c:\programme\MyWebSearch\bar\Cache\0005A204
c:\programme\MyWebSearch\bar\Cache\0005B8F7
c:\programme\MyWebSearch\bar\Cache\0005BA8D
c:\programme\MyWebSearch\bar\Cache\0005D086
c:\programme\MyWebSearch\bar\Cache\0005E547
c:\programme\MyWebSearch\bar\Cache\0005EA57.bin
c:\programme\MyWebSearch\bar\Cache\0005EF59.bin
c:\programme\MyWebSearch\bar\Cache\0005EFD6
c:\programme\MyWebSearch\bar\Cache\0005F302.bin
c:\programme\MyWebSearch\bar\Cache\0005F506.bin
c:\programme\MyWebSearch\bar\Cache\0005F63E.bin
c:\programme\MyWebSearch\bar\Cache\000602F0
c:\programme\MyWebSearch\bar\Cache\000609E6
c:\programme\MyWebSearch\bar\Cache\000628E7
c:\programme\MyWebSearch\bar\Cache\0006470E
c:\programme\MyWebSearch\bar\Cache\00066880
c:\programme\MyWebSearch\bar\Cache\000673AC
c:\programme\MyWebSearch\bar\Cache\00068158
c:\programme\MyWebSearch\bar\Cache\00069CBF
c:\programme\MyWebSearch\bar\Cache\0006A00B
c:\programme\MyWebSearch\bar\Cache\0006BDF3
c:\programme\MyWebSearch\bar\Cache\0006C0B2
c:\programme\MyWebSearch\bar\Cache\0006C72B
c:\programme\MyWebSearch\bar\Cache\0006DD24
c:\programme\MyWebSearch\bar\Cache\0006E801
c:\programme\MyWebSearch\bar\Cache\0006F03E
c:\programme\MyWebSearch\bar\Cache\000703F5
c:\programme\MyWebSearch\bar\Cache\00070E17
c:\programme\MyWebSearch\bar\Cache\00071B46
c:\programme\MyWebSearch\bar\Cache\000745C1
c:\programme\MyWebSearch\bar\Cache\00075707
c:\programme\MyWebSearch\bar\Cache\000764E2
c:\programme\MyWebSearch\bar\Cache\0007920C
c:\programme\MyWebSearch\bar\Cache\00079B05
c:\programme\MyWebSearch\bar\Cache\0007C169
c:\programme\MyWebSearch\bar\Cache\0007F1C0
c:\programme\MyWebSearch\bar\Cache\00080364
c:\programme\MyWebSearch\bar\Cache\00082459
c:\programme\MyWebSearch\bar\Cache\00082A06
c:\programme\MyWebSearch\bar\Cache\00084232
c:\programme\MyWebSearch\bar\Cache\00085230
c:\programme\MyWebSearch\bar\Cache\0008675E
c:\programme\MyWebSearch\bar\Cache\00086D3A
c:\programme\MyWebSearch\bar\Cache\00087F2B
c:\programme\MyWebSearch\bar\Cache\00088F77
c:\programme\MyWebSearch\bar\Cache\0008A438
c:\programme\MyWebSearch\bar\Cache\0008B8E9
c:\programme\MyWebSearch\bar\Cache\0008D9DE
c:\programme\MyWebSearch\bar\Cache\0008ED47
c:\programme\MyWebSearch\bar\Cache\0008F2A6
c:\programme\MyWebSearch\bar\Cache\0008FB9F
c:\programme\MyWebSearch\bar\Cache\00090572
c:\programme\MyWebSearch\bar\Cache\0009200F
c:\programme\MyWebSearch\bar\Cache\00093220
c:\programme\MyWebSearch\bar\Cache\0009450C
c:\programme\MyWebSearch\bar\Cache\00095B72
c:\programme\MyWebSearch\bar\Cache\00096F58
c:\programme\MyWebSearch\bar\Cache\00098466
c:\programme\MyWebSearch\bar\Cache\0009981D
c:\programme\MyWebSearch\bar\Cache\0009BEC0
c:\programme\MyWebSearch\bar\Cache\0009CB81
c:\programme\MyWebSearch\bar\Cache\0009CC1E
c:\programme\MyWebSearch\bar\Cache\0009D3AF
c:\programme\MyWebSearch\bar\Cache\0009DCF6
c:\programme\MyWebSearch\bar\Cache\0009E2E2
c:\programme\MyWebSearch\bar\Cache\0009EBFA
c:\programme\MyWebSearch\bar\Cache\000A102C
c:\programme\MyWebSearch\bar\Cache\000A201A
c:\programme\MyWebSearch\bar\Cache\000A2D68
c:\programme\MyWebSearch\bar\Cache\000A68EA
c:\programme\MyWebSearch\bar\Cache\000A923C
c:\programme\MyWebSearch\bar\Cache\000AAB14
c:\programme\MyWebSearch\bar\Cache\000ACB0F
c:\programme\MyWebSearch\bar\Cache\000AE425
c:\programme\MyWebSearch\bar\Cache\000AEC24
c:\programme\MyWebSearch\bar\Cache\000AFF3F
c:\programme\MyWebSearch\bar\Cache\000B20D0
c:\programme\MyWebSearch\bar\Cache\000B4754
c:\programme\MyWebSearch\bar\Cache\000B4D01
c:\programme\MyWebSearch\bar\Cache\000B4D9D
c:\programme\MyWebSearch\bar\Cache\000B5B2A
c:\programme\MyWebSearch\bar\Cache\000B6329
c:\programme\MyWebSearch\bar\Cache\000BACD4
c:\programme\MyWebSearch\bar\Cache\000BBC84
c:\programme\MyWebSearch\bar\Cache\000BC483
c:\programme\MyWebSearch\bar\Cache\000BCF60
c:\programme\MyWebSearch\bar\Cache\000BE3C3
c:\programme\MyWebSearch\bar\Cache\000BF121
c:\programme\MyWebSearch\bar\Cache\000C0D15
c:\programme\MyWebSearch\bar\Cache\000C22DF
c:\programme\MyWebSearch\bar\Cache\000C7228
c:\programme\MyWebSearch\bar\Cache\000C7B30
c:\programme\MyWebSearch\bar\Cache\000CCC0F
c:\programme\MyWebSearch\bar\Cache\000CD602
c:\programme\MyWebSearch\bar\Cache\000D444D
c:\programme\MyWebSearch\bar\Cache\000D4D46
c:\programme\MyWebSearch\bar\Cache\000D9829
c:\programme\MyWebSearch\bar\Cache\000E0616
c:\programme\MyWebSearch\bar\Cache\000E0D88
c:\programme\MyWebSearch\bar\Cache\000E34D7
c:\programme\MyWebSearch\bar\Cache\000FECD7
c:\programme\MyWebSearch\bar\Cache\001321B4
c:\programme\MyWebSearch\bar\Cache\001329C3
c:\programme\MyWebSearch\bar\Cache\001338E6
c:\programme\MyWebSearch\bar\Cache\001464E2
c:\programme\MyWebSearch\bar\Cache\00146EC6
c:\programme\MyWebSearch\bar\Cache\0014C12B
c:\programme\MyWebSearch\bar\Cache\0016892A
c:\programme\MyWebSearch\bar\Cache\00169A70
c:\programme\MyWebSearch\bar\Cache\00169B6A
c:\programme\MyWebSearch\bar\Cache\0016CE51
c:\programme\MyWebSearch\bar\Cache\001714C0
c:\programme\MyWebSearch\bar\Cache\00172ED0
c:\programme\MyWebSearch\bar\Cache\0017469E
c:\programme\MyWebSearch\bar\Cache\00177956
c:\programme\MyWebSearch\bar\Cache\00179328
c:\programme\MyWebSearch\bar\Cache\0017CE0E
c:\programme\MyWebSearch\bar\Cache\0017EDEA
c:\programme\MyWebSearch\bar\Cache\00181DB4
c:\programme\MyWebSearch\bar\Cache\001853D8
c:\programme\MyWebSearch\bar\Cache\00186C90
c:\programme\MyWebSearch\bar\Cache\001881ED
c:\programme\MyWebSearch\bar\Cache\00189A57
c:\programme\MyWebSearch\bar\Cache\0018BD50
c:\programme\MyWebSearch\bar\Cache\0018DCFD
c:\programme\MyWebSearch\bar\Cache\0018EF2D
c:\programme\MyWebSearch\bar\Cache\0018F661
c:\programme\MyWebSearch\bar\Cache\0019111D
c:\programme\MyWebSearch\bar\Cache\00192968
c:\programme\MyWebSearch\bar\Cache\00194193
c:\programme\MyWebSearch\bar\Cache\001944B0
c:\programme\MyWebSearch\bar\Cache\00194B47
c:\programme\MyWebSearch\bar\Cache\00196622
c:\programme\MyWebSearch\bar\Cache\00197C6A
c:\programme\MyWebSearch\bar\Cache\001993F9
c:\programme\MyWebSearch\bar\Cache\00199D21
c:\programme\MyWebSearch\bar\Cache\0019AFED
c:\programme\MyWebSearch\bar\Cache\0019E0F0
c:\programme\MyWebSearch\bar\Cache\0019ECB8
c:\programme\MyWebSearch\bar\Cache\0019FD42
c:\programme\MyWebSearch\bar\Cache\001A0428
c:\programme\MyWebSearch\bar\Cache\001A0A04
c:\programme\MyWebSearch\bar\Cache\001A1AFB
c:\programme\MyWebSearch\bar\Cache\001A2C22
c:\programme\MyWebSearch\bar\Cache\001A4DD3
c:\programme\MyWebSearch\bar\Cache\001A6F45
c:\programme\MyWebSearch\bar\Cache\001A7AFD
c:\programme\MyWebSearch\bar\Cache\001A9079
c:\programme\MyWebSearch\bar\Cache\001AA682
c:\programme\MyWebSearch\bar\Cache\001AF89A
c:\programme\MyWebSearch\bar\Cache\001B511A
c:\programme\MyWebSearch\bar\Cache\001B5A61
c:\programme\MyWebSearch\bar\Cache\001B6E56
c:\programme\MyWebSearch\bar\Cache\001B90E2
c:\programme\MyWebSearch\bar\Cache\001BFCCB
c:\programme\MyWebSearch\bar\Cache\001D6861
c:\programme\MyWebSearch\bar\Cache\001D6FB4
c:\programme\MyWebSearch\bar\Cache\001F95E0
c:\programme\MyWebSearch\bar\Cache\0022077C
c:\programme\MyWebSearch\bar\Cache\00277570
c:\programme\MyWebSearch\bar\Cache\00278966
c:\programme\MyWebSearch\bar\Cache\0027C621
c:\programme\MyWebSearch\bar\Cache\0027D4E6
c:\programme\MyWebSearch\bar\Cache\0027E9E5
c:\programme\MyWebSearch\bar\Cache\0027FD7C
c:\programme\MyWebSearch\bar\Cache\00281598
c:\programme\MyWebSearch\bar\Cache\00284DA0
c:\programme\MyWebSearch\bar\Cache\0028F172
c:\programme\MyWebSearch\bar\Cache\0028FC01
c:\programme\MyWebSearch\bar\Cache\00290325
c:\programme\MyWebSearch\bar\Cache\00291B9E
c:\programme\MyWebSearch\bar\Cache\00292F46
c:\programme\MyWebSearch\bar\Cache\00293DDC
c:\programme\MyWebSearch\bar\Cache\002942DD
c:\programme\MyWebSearch\bar\Cache\002969ED
c:\programme\MyWebSearch\bar\Cache\002976BF
c:\programme\MyWebSearch\bar\Cache\00298A56
c:\programme\MyWebSearch\bar\Cache\00299042
c:\programme\MyWebSearch\bar\Cache\0029A958
c:\programme\MyWebSearch\bar\Cache\002A7DCE
c:\programme\MyWebSearch\bar\Cache\002A89E4
c:\programme\MyWebSearch\bar\Cache\002AC298
c:\programme\MyWebSearch\bar\Cache\002AD600
c:\programme\MyWebSearch\bar\Cache\002ADD92
c:\programme\MyWebSearch\bar\Cache\002BFF5D
c:\programme\MyWebSearch\bar\Cache\002C0605
c:\programme\MyWebSearch\bar\Cache\002EB0A3
c:\programme\MyWebSearch\bar\Cache\00304869
c:\programme\MyWebSearch\bar\Cache\00305FCA
c:\programme\MyWebSearch\bar\Cache\0030C1CF
c:\programme\MyWebSearch\bar\Cache\003235B2
c:\programme\MyWebSearch\bar\Cache\00324A44
c:\programme\MyWebSearch\bar\Cache\00343A2D
c:\programme\MyWebSearch\bar\Cache\00345DC3
c:\programme\MyWebSearch\bar\Cache\003475DE
c:\programme\MyWebSearch\bar\Cache\003E353B
c:\programme\MyWebSearch\bar\Cache\003E3D59
c:\programme\MyWebSearch\bar\Cache\003E7060
c:\programme\MyWebSearch\bar\Cache\003E9A5E
c:\programme\MyWebSearch\bar\Cache\003EB8B3
c:\programme\MyWebSearch\bar\Cache\003F2C9B
c:\programme\MyWebSearch\bar\Cache\003F4C87
c:\programme\MyWebSearch\bar\Cache\003FAB02
c:\programme\MyWebSearch\bar\Cache\003FB5E0
c:\programme\MyWebSearch\bar\Cache\003FF5B7
c:\programme\MyWebSearch\bar\Cache\00402052
c:\programme\MyWebSearch\bar\Cache\004040E9
c:\programme\MyWebSearch\bar\Cache\00409226
c:\programme\MyWebSearch\bar\Cache\00414B55
c:\programme\MyWebSearch\bar\Cache\00611739
c:\programme\MyWebSearch\bar\Cache\00624FE8
c:\programme\MyWebSearch\bar\Cache\00625E30
c:\programme\MyWebSearch\bar\Cache\0063F461
c:\programme\MyWebSearch\bar\Cache\006EB241
c:\programme\MyWebSearch\bar\Cache\006EBB0B
c:\programme\MyWebSearch\bar\Cache\006FA0B8
c:\programme\MyWebSearch\bar\Cache\006FA665
c:\programme\MyWebSearch\bar\Cache\00764C5C
c:\programme\MyWebSearch\bar\Cache\0076F639
c:\programme\MyWebSearch\bar\Cache\0076FDEA
c:\programme\MyWebSearch\bar\Cache\008CB84A
c:\programme\MyWebSearch\bar\Cache\00AC8930
c:\programme\MyWebSearch\bar\Cache\00ACBA71
c:\programme\MyWebSearch\bar\Cache\00ACD637
c:\programme\MyWebSearch\bar\Cache\00ACFA2A
c:\programme\MyWebSearch\bar\Cache\00AD1EAA
c:\programme\MyWebSearch\bar\Cache\00ADDA1A
c:\programme\MyWebSearch\bar\Cache\00B871B6
c:\programme\MyWebSearch\bar\Cache\00F2306D
c:\programme\MyWebSearch\bar\Cache\files.ini
c:\programme\MyWebSearch\bar\Game\CHECKERS.F3S
c:\programme\MyWebSearch\bar\Game\CHESS.F3S
c:\programme\MyWebSearch\bar\Game\REVERSI.F3S
c:\programme\MyWebSearch\bar\History\search3
c:\programme\MyWebSearch\bar\icons\CM.ICO
c:\programme\MyWebSearch\bar\icons\MFC.ICO
c:\programme\MyWebSearch\bar\icons\PSS.ICO
c:\programme\MyWebSearch\bar\icons\SMILEY.ICO
c:\programme\MyWebSearch\bar\icons\WB.ICO
c:\programme\MyWebSearch\bar\icons\ZWINKY.ICO
c:\programme\MyWebSearch\bar\Message\COMMON.F3S
c:\programme\MyWebSearch\bar\Message\COMMON\8_step1.gif
c:\programme\MyWebSearch\bar\Message\COMMON\autoup.gif
c:\programme\MyWebSearch\bar\Message\COMMON\autoup.htm
c:\programme\MyWebSearch\bar\Message\COMMON\bkez.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkgr.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkgs.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bklf.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkrg.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkwebfet.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzc.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzl.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzn.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzq.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzr.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzu.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzv.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzw.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\bkzwinky.jpg
c:\programme\MyWebSearch\bar\Message\COMMON\blubtn2d.png
c:\programme\MyWebSearch\bar\Message\COMMON\blubtn2r.png
c:\programme\MyWebSearch\bar\Message\COMMON\blubtn3d.png
c:\programme\MyWebSearch\bar\Message\COMMON\blubtn3r.png
c:\programme\MyWebSearch\bar\Message\COMMON\center.htm
c:\programme\MyWebSearch\bar\Message\COMMON\index.htm
c:\programme\MyWebSearch\bar\Message\COMMON\mid_dots.gif
c:\programme\MyWebSearch\bar\Message\COMMON\protect.htm
c:\programme\MyWebSearch\bar\Message\COMMON\rebut4.htm
c:\programme\MyWebSearch\bar\Message\COMMON\rebut4b.htm
c:\programme\MyWebSearch\bar\Message\COMMON\rebut4c.htm
c:\programme\MyWebSearch\bar\Message\COMMON\shield.png
c:\programme\MyWebSearch\bar\Message\COMMON\shocked.gif
c:\programme\MyWebSearch\bar\Message\COMMON\stop.gif
c:\programme\MyWebSearch\bar\Message\COMMON\systray.htm
c:\programme\MyWebSearch\bar\Message\COMMON\systrayp.htm
c:\programme\MyWebSearch\bar\Message\COMMON\tp_grad.gif
c:\programme\MyWebSearch\bar\Message\COMMON\warn.gif
c:\programme\MyWebSearch\bar\Notifier\COMMON.F3S
c:\programme\MyWebSearch\bar\Notifier\DOG.F3S
c:\programme\MyWebSearch\bar\Notifier\FISH.F3S
c:\programme\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\programme\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\programme\MyWebSearch\bar\Notifier\MAID.F3S
c:\programme\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\programme\MyWebSearch\bar\Notifier\OPERA.F3S
c:\programme\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\programme\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\programme\MyWebSearch\bar\Notifier\SURFER.F3S
c:\programme\MyWebSearch\bar\Overlay\COMMON.F3S
c:\programme\MyWebSearch\bar\Settings\prevcfg2.htm
c:\programme\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\IsUn0407.exe
c:\windows\system32\f3PSSavr.scr
c:\windows\system32\winsvncs.txt
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_MyWebSearchService
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-05-22 bis 2011-06-22  ))))))))))))))))))))))))))))))
.
.
2011-06-22 16:28 . 2011-06-22 16:45	--------	d-----w-	C:\_OTL
2011-06-16 16:15 . 2011-06-16 18:33	--------	d-----w-	c:\windows\SxsCaPendDel
2011-06-16 14:41 . 2011-04-21 13:37	105472	------w-	c:\windows\system32\dllcache\mup.sys
2011-06-13 12:14 . 2011-06-13 12:14	404640	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-13 12:12 . 2011-06-13 12:12	--------	d-----w-	c:\programme\Gemeinsame Dateien\Java
2011-06-13 12:12 . 2011-06-13 12:12	472808	----a-w-	c:\programme\Mozilla Firefox\plugins\npdeployJava1.dll
2011-06-13 12:12 . 2011-06-13 12:12	73728	----a-w-	c:\windows\system32\javacpl.cpl
2011-06-13 12:12 . 2011-06-13 12:12	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-06-13 12:04 . 2011-04-14 16:40	142296	----a-w-	c:\programme\Mozilla Firefox\components\browsercomps.dll
2011-06-13 12:04 . 2011-04-14 16:40	89048	----a-w-	c:\programme\Mozilla Firefox\libEGL.dll
2011-06-13 12:04 . 2011-04-14 16:40	781272	----a-w-	c:\programme\Mozilla Firefox\mozsqlite3.dll
2011-06-13 12:04 . 2011-04-14 16:40	719832	----a-w-	c:\programme\Mozilla Firefox\mozcpp19.dll
2011-06-13 12:04 . 2011-04-14 16:40	465880	----a-w-	c:\programme\Mozilla Firefox\libGLESv2.dll
2011-06-13 12:04 . 2011-04-14 16:40	1874904	----a-w-	c:\programme\Mozilla Firefox\mozjs.dll
2011-06-13 12:04 . 2011-04-14 16:40	16856	----a-w-	c:\programme\Mozilla Firefox\plugin-container.exe
2011-06-13 12:04 . 2011-04-14 16:40	15832	----a-w-	c:\programme\Mozilla Firefox\mozalloc.dll
2011-06-13 12:04 . 2010-01-01 08:00	1974616	----a-w-	c:\programme\Mozilla Firefox\D3DCompiler_42.dll
2011-06-13 12:04 . 2010-01-01 08:00	1892184	----a-w-	c:\programme\Mozilla Firefox\d3dx9_42.dll
2011-06-12 10:05 . 2011-06-12 10:05	--------	d-sh--w-	c:\windows\system32\config\systemprofile\IETldCache
2011-06-12 07:09 . 2008-04-14 00:58	14720	----a-w-	c:\windows\system32\drivers\kbdhid.sys
2011-06-12 07:09 . 2008-04-14 00:58	14720	----a-w-	c:\windows\system32\dllcache\kbdhid.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-23 15:55 . 2011-05-23 15:55	218688	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2011-05-02 15:31 . 2004-08-04 08:00	692736	----a-w-	c:\windows\system32\inetcomm.dll
2011-05-02 11:55 . 2011-05-02 11:55	621056	----a-w-	c:\windows\system32\drivers\mod7700.sys
2011-05-02 11:55 . 2011-05-02 11:55	23424	----a-w-	c:\windows\system32\drivers\ewdcsc.sys
2011-04-29 16:19 . 2004-08-04 08:00	456320	----a-w-	c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:05 . 2004-08-04 08:00	916480	----a-w-	c:\windows\system32\wininet.dll
2011-04-25 16:05 . 2004-08-04 08:00	43520	----a-w-	c:\windows\system32\licmgr10.dll
2011-04-25 16:05 . 2004-08-04 08:00	1469440	------w-	c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-04 08:00	385024	----a-w-	c:\windows\system32\html.iec
2011-04-22 16:12 . 2009-11-22 21:33	2984	--sha-w-	c:\dokumente und einstellungen\All Users\Anwendungsdaten\KGyGaAvL.sys
2011-04-21 13:37 . 2004-08-04 08:00	105472	----a-w-	c:\windows\system32\drivers\mup.sys
2011-04-06 14:20 . 2011-04-06 14:20	91424	----a-w-	c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20	197920	----a-w-	c:\windows\system32\dnssdX.dll
2011-04-06 14:20 . 2011-04-06 14:20	107808	----a-w-	c:\windows\system32\dns-sd.exe
2011-04-14 16:40 . 2011-06-13 12:04	142296	----a-w-	c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe" [2009-05-18 2363392]
"ICQ"="c:\programme\ICQ7.2\ICQ.exe" [2011-01-05 133432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsmqIntCert"="mqrt.dll" [2009-06-25 177152]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-02-18 737280]
"PDF Complete"="c:\programme\PDF Complete\pdfsty.exe" [2008-08-08 319000]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2009-02-06 1430824]
"WirelessAssistant"="c:\programme\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-02-18 506424]
"QlbCtrl.exe"="c:\programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-02-03 287288]
"HP Software Update"="c:\programme\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"zCpqset"="c:\programme\Hewlett-Packard\Default Settings\cpqset.exe" [2008-12-11 81920]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-01 61440]
"HPCam_Menu"="c:\programme\Hewlett-Packard\HP Webcam\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-03 188416]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
"DivXUpdate"="c:\programme\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Caro\Startmen\Programme\Autostart\
OpenOffice.org 3.3.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
BTTray.lnk - c:\programme\WIDCOMM\Bluetooth Software\BTTray.exe [2008-12-11 604776]
Windows Search.lnk - c:\programme\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\ICQ7.2\\ICQ.exe"=
"c:\\Programme\\ICQ7.2\\aolload.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
.
R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [06.08.2009 11:38 189456]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [23.05.2011 17:55 218688]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\programme\Avira\AntiVir Desktop\sched.exe [28.11.2009 12:08 108289]
R2 pdfcDispatcher;PDF Document Manager;c:\programme\PDF Complete\pdfsvc.exe [06.08.2009 03:19 777240]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [17.04.2007 21:09 11032]
R2 WTGService;WTGService;c:\programme\Verbindungsassistent\WTGService.exe [02.05.2011 13:55 330696]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [18.02.2009 15:41 113536]
R3 Com4QLBEx;Com4QLBEx;c:\programme\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [06.08.2009 03:55 209464]
S2 0035151258721312mcinstcleanup;McAfee Application Installer Cleanup (0035151258721312);c:\dokume~1\ADMINI~1\LOKALE~1\Temp\003515~1.EXE c:\progra~1\GEMEIN~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\dokume~1\ADMINI~1\LOKALE~1\Temp\003515~1.EXE c:\progra~1\GEMEIN~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-05-18 15:54	451872	----a-w-	c:\programme\Gemeinsame Dateien\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2011-01-12 c:\windows\Tasks\expressripShakeIcon.job
- c:\programme\NCH Swift Sound\ExpressRip\expressrip.exe [2010-09-10 19:52]
.
2011-04-23 c:\windows\Tasks\switchShakeIcon.job
- c:\programme\NCH Swift Sound\Switch\switch.exe [2010-09-10 19:50]
.
2011-06-22 c:\windows\Tasks\User_Feed_Synchronization-{065FC861-89CA-4183-AD6B-D896D5AB5CF3}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
2011-01-21 c:\windows\Tasks\videopadShakeIcon.job
- c:\programme\NCH Software\VideoPad\videopad.exe [2011-01-11 21:13]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uInternet Connection Wizard,ShellNext = "c:\programme\Outlook Express\msimn.exe" //mailurl:mailto:sozialamt@landkreis-helmstedt.de
uInternet Settings,ProxyServer = http=127.0.0.1:53495
uInternet Settings,ProxyOverride = *.local
IE: Senden an &Bluetooth-Gerät... - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Senden an Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: Interfaces\{CB943FB0-551A-4C9C-8141-303895003CD2}: NameServer = 212.23.97.3 212.23.97.2
FF - ProfilePath - c:\dokumente und einstellungen\Caro\Anwendungsdaten\Mozilla\Firefox\Profiles\3kz7w170.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig?hl=de
FF - prefs.js: keyword.URL - hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=6xMaYxSN&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 53495
FF - prefs.js: network.proxy.type - 0
FF - user.js: keyword.URL - hxxp://www.sitfy.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=6xMaYxSN&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\programme\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-06-22 21:43
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  zCpqset = c:\programme\Hewlett-Packard\Default Settings\cpqset.exe??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher]
"ImagePath"="c:\programme\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(904)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(1744)
c:\windows\system32\btmmhook.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\programme\idt\wdm\STacSV.exe
c:\windows\system32\msdtc.exe
c:\programme\LSI SoftModem\agrsmsvc.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Gemeinsame Dateien\InterVideo\RegMgr\iviRegMgr.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\SearchIndexer.exe
c:\programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\programme\Hewlett-Packard\Shared\hpqwmiex.exe
c:\programme\iPod\bin\iPodService.exe
c:\programme\OpenOffice.org 3\program\soffice.exe
c:\programme\OpenOffice.org 3\program\soffice.bin
c:\windows\system32\wscntfy.exe
c:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\programme\Hewlett-Packard\Shared\hpqToaster.exe
c:\programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-06-22  21:51:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-06-22 19:51
.
Vor Suchlauf: 12 Verzeichnis(se), 267.808.104.448 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 267.794.542.592 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
.
- - End Of File - - 46DEF269DA57351F434176ABD7994A74

--- --- ---

markusg · 23.06.2011, 10:46

sieht gut aus.
download malwarebytes:
Malwarebytes : Malwarebytes Anti-Malware is a free download that removes viruses and malware from your computer
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.

Carolina_91 · 23.06.2011, 14:34

Malwarebytes' Anti-Malware 1.51.0.1200
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6924

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

23.06.2011 15:26:54
mbam-log-2011-06-23 (15-26-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|I:\|)
Durchsuchte Objekte: 298534
Laufzeit: 1 Stunde(n), 30 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 11
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 128

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{F42228FB-E84E-479E-B922-FBBD096E792C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MyWebSearch.ThirdPartyInstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\MyWebSearch.ThirdPartyInstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Value: f3PopularScreensavers -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\programme\msn messenger\msimg32.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\programme\msn messenger\riched20.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\qoobox\quarantine\c\dokumente und einstellungen\caro\anwendungsdaten\adobe\plugs\mmc19216421.txt.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\2.bin\m3fftbpr.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\2.bin\m3patch.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3imstub.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3medint.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3cjpeg.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3dtactl.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3histsw.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3hkstub.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3htmlmu.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3httpct.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3popswt.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3pssavr.scr.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3reghk.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3reprox.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3restub.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3schmon.exe.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\f3scrctr.dll.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3auxstb.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3dlghk.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3highin.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3html.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3idle.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3impipe.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3msg.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3outlcn.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3plugin.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3skin.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3skplay.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3slsrch.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\m3srchmn.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\mwsbar.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\mwsmlbtn.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\mwsoeplg.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\mwsoestb.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\mwssrcas.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\mwssvc.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\mwsuabtn.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\programme\mywebsearch\bar\3.bin\npmywebs.dll.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe.vir (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\system32\f3pssavr.scr.vir (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033757.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033761.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033762.dll (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033763.scr (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033773.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033774.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033775.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033776.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033777.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033778.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033779.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033780.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033781.SCR (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033782.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033783.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033784.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033785.EXE (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033786.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033787.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033788.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033789.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033791.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033792.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033793.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033794.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033795.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033796.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033797.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033798.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033799.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033800.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033801.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033802.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033803.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033804.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033805.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033806.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033808.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033809.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033810.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033814.exe (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033790.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP213\A0033807.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\rp263\a0044627.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044694.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044695.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044696.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044698.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044699.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044700.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044701.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044702.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044703.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044704.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044705.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044706.SCR (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044707.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044708.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044709.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044711.DLL (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044712.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044713.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044714.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044715.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044716.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044717.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044718.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044719.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044720.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044721.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044722.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044723.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044724.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044725.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044727.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044710.EXE (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044728.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044729.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044730.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044731.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044732.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044733.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044734.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\system volume information\_restore{b32aee6a-215a-4a68-95fc-9cabbf245d43}\RP263\A0044743.scr (PUP.FunWebProducts) -> Quarantined and deleted successfully.
c:\_OTL\movedfiles\06222011_182824\c_dokumente und einstellungen\Caro\anwendungsdaten\dwm.exe (Trojan.Agent) -> Quarantined and deleted successfully.

markusg · 23.06.2011, 15:12

wie läuft das system?

21.06.2011, 18:40	#6
markusg /// Malware-holic	Google leitet mich auf sinnlose Seiten um dann machs mal bitte erneut. und kopiere von mir aus den inhalt der otl.txt einfach hier rein :-) __________________ --> Google leitet mich auf sinnlose Seiten um

23.06.2011, 15:12	#15
markusg /// Malware-holic	Google leitet mich auf sinnlose Seiten um wie läuft das system? __________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet

Google leitet mich auf sinnlose Seiten um

Plagegeister aller Art und deren Bekämpfung: Google leitet mich auf sinnlose Seiten um