Nach einem Virenüberfal und Virenbeseitigung bleiben die Reste:
iexpore.exe startet im Hintergrund.
Malwarebytes' Anti-Malware blocktb ständige Ausgang-Versuche zur 64.120.141.163
Ich habe zwar per Eintrag ins hosts dessen Zugriff gesperrt, aber ich hätte gerne die Sache restlos entfernen.

hier sind die Logfiles von OTL:
Extras
_______________________________________________
OTL Extras logfile created on: 29.09.2011 17:40:18 - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Dokumente und Einstellungen\Rezeption\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,75 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 66,26% Memory free
4,59 Gb Paging File | 3,87 Gb Available in Paging File | 84,17% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 465,75 Gb Total Space | 450,60 Gb Free Space | 96,75% Space Free | Partition Type: NTFS
Drive E: | 30,07 Gb Total Space | 12,01 Gb Free Space | 39,94% Space Free | Partition Type: FAT32

Computer Name: RECEPT1 | User Name: Rezeption | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Durchsuchen mit &IrfanView] -- "C:\Programme\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-zu-Peer-Gruppierung
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution-Protokoll (PNRP)
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3587:TCP" = 3587:TCP:*:Enabled:Windows Peer-zu-Peer-Gruppierung
"3540:UDP" = 3540:UDP:*:Enabled:Peer Name Resolution-Protokoll (PNRP)
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Microsoft Office\Office14\GROOVE.EXE" = C:\Programme\Microsoft Office\Office14\GROOVE.EXE:*:Enabled:Microsoft SharePoint Workspace -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\TEMP\-=[OFFICE2010]=-\zwt-kms.exe" = C:\TEMP\-=[OFFICE2010]=-\zwt-kms.exe:*:Enabled:zwt-kms
"C:\Programme\LGNAS\NASDetector\nasdetector.exe" = C:\Programme\LGNAS\NASDetector\nasdetector.exe:*:Enabled:LGNAS Detector -- (LG Electronics, Inc.)
"\\Olivpcif1\HotMax\HotMax.exe" = \\Olivpcif1\HotMax\HotMax.exe:*:Enabled:HotMax
"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\creativbox.net\SimpleSYN 2.1\CBN.SimpleSYN.NET.exe" = C:\Programme\creativbox.net\SimpleSYN 2.1\CBN.SimpleSYN.NET.exe:*:Enabled:CBN.SimpleSYN.NET
"C:\Programme\TeamViewer\Version6\TeamViewer.exe" = C:\Programme\TeamViewer\Version6\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{81388290-5DFA-493E-83D6-244B652DE5AA}" = NASDetector(English)
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 14
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.6 - Deutsch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast" = avast! Free Antivirus
"Diercke Globus Online" = Diercke Globus Online
"FaJo XP File Security Extension_is1" = FaJo XP File Security Extension v1.2
"FLV Player" = FLV Player 2.0 (build 25)
"HotMax" = HotMax
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 7.0 (x86 de)" = Mozilla Firefox 7.0 (x86 de)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Opera 11.51.1087" = Opera 11.51
"TeamViewer 6" = TeamViewer 6
"Unlocker" = Unlocker 1.9.1
"WinRAR archiver" = WinRAR 4.01 (32-Bit)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 29.09.2011 11:02:57 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\STARTMENÜ\PROGRAMME\WINRAR\HILFE
ZU WINRAR.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung,
SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert
nicht. (0x8007001f)

Error - 29.09.2011 11:02:57 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\STARTMENÜ\PROGRAMME\WINRAR\HILFE
ZU WINRAR.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung,
SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert
nicht. (0x8007001f)

Error - 29.09.2011 11:02:57 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\STARTMENÜ\PROGRAMME\WINRAR\WINRAR.LNK>
in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex
Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)


Error - 29.09.2011 11:02:57 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\STARTMENÜ\PROGRAMME\WINRAR\WINRAR.LNK>
in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex
Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)


Error - 29.09.2011 11:05:35 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\REZEPTION\STARTMENÜ\PROGRAMME\WINRAR\BENUTZERHANDBUCH
FÜR DIE KONSOLENVERSION VON RAR.LNK> in der Hash-Zuordnung kann nicht aktualisiert
werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes
Gerät funktioniert nicht. (0x8007001f)

Error - 29.09.2011 11:05:35 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\REZEPTION\STARTMENÜ\PROGRAMME\WINRAR\BENUTZERHANDBUCH
FÜR DIE KONSOLENVERSION VON RAR.LNK> in der Hash-Zuordnung kann nicht aktualisiert
werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes
Gerät funktioniert nicht. (0x8007001f)

Error - 29.09.2011 11:05:35 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\REZEPTION\STARTMENÜ\PROGRAMME\WINRAR\HILFE
ZU WINRAR.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung,
SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert
nicht. (0x8007001f)

Error - 29.09.2011 11:05:35 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\REZEPTION\STARTMENÜ\PROGRAMME\WINRAR\HILFE
ZU WINRAR.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung,
SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert
nicht. (0x8007001f)

Error - 29.09.2011 11:05:35 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\REZEPTION\STARTMENÜ\PROGRAMME\WINRAR\WINRAR.LNK>
in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex
Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)


Error - 29.09.2011 11:05:35 | Computer Name = RECEPT1 | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\DOKUMENTE UND EINSTELLUNGEN\REZEPTION\STARTMENÜ\PROGRAMME\WINRAR\WINRAR.LNK>
in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex
Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)


[ System Events ]
Error - 31.01.2011 05:37:06 | Computer Name = RECEPT1 | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt:
Starten Sie den Dienst neu..

Error - 31.01.2011 05:37:36 | Computer Name = RECEPT1 | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Windows Search" Korrekturmaßnahmen (Starten Sie den Dienst neu.)
durchzuführen, ist fehlgeschlagen. Fehler: %%1056


< End of report >
---------------------------------------------------


und OTL.txt:
______________________________________________
OTL logfile created on: 29.09.2011 17:40:18 - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Dokumente und Einstellungen\Rezeption\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,75 Gb Total Physical Memory | 1,82 Gb Available Physical Memory | 66,26% Memory free
4,59 Gb Paging File | 3,87 Gb Available in Paging File | 84,17% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 465,75 Gb Total Space | 450,60 Gb Free Space | 96,75% Space Free | Partition Type: NTFS
Drive E: | 30,07 Gb Total Space | 12,01 Gb Free Space | 39,94% Space Free | Partition Type: FAT32

Computer Name: RECEPT1 | User Name: Rezeption | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\Rezeption\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\TeamViewer\Version6\TeamViewer.exe (TeamViewer GmbH)
PRC - C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Programme\$$SysinternalsSuite\Process Explorer\Process Explorer.exe (Sysinternals - www.sysinternals.com)
PRC - C:\WINXP\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Alwil Software\Avast5\defs\11092900\algo.dll ()
MOD - C:\Programme\Alwil Software\Avast5\defs\11092900\aswRep.dll ()
MOD - C:\Programme\WinRAR\RarExt.dll ()
MOD - C:\WINXP\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Programme\Unlocker\UnlockerCOM.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
MOD - C:\WINXP\system32\msdmo.dll ()


========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (TeamViewer6) -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Programme\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (p2pgasvc) -- C:\WINXP\system32\p2pgasvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) -- C:\WINXP\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\WINXP\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINXP\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) -- C:\WINXP\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINXP\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINXP\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINXP\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (MBAMProtector) -- C:\WINXP\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (sptd) -- C:\WINXP\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINXP\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) -- C:\WINXP\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (Tcpip6) -- C:\WINXP\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (nvgts) -- C:\WINXP\system32\DRIVERS\nvgts.sys (NVIDIA Corporation)
DRV - (Monfilt) -- C:\WINXP\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (Ambfilt) -- C:\WINXP\system32\drivers\Ambfilt.sys (Creative)
DRV - (AmdPPM) -- C:\WINXP\system32\drivers\AmdPPM.sys (Advanced Micro Devices)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 86 14 EB BC 88 76 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Web Search..."
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q="
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINXP\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Programme\Alwil Software\Avast5\WebRep\FF [2011.09.29 11:46:36 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.29 15:44:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.09.23 18:33:04 | 000,000,000 | ---D | M]

[2010.10.28 12:14:25 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Mozilla\Extensions
[2011.09.29 15:46:01 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Mozilla\Firefox\Profiles\1f181p9a.default\extensions
[2011.01.14 18:08:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Mozilla\Firefox\Profiles\1f181p9a.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.01.22 19:52:55 | 000,000,000 | ---D | M] (vShare) -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Mozilla\Firefox\Profiles\1f181p9a.default\extensions\vshare@toolbar
[2011.01.22 19:54:17 | 000,001,583 | ---- | M] () -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Mozilla\Firefox\Profiles\1f181p9a.default\searchplugins\web-search.xml
[2011.09.23 18:32:23 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.09.23 18:32:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011.09.29 11:46:36 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAMME\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2011.09.23 18:32:06 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.09.29 15:44:30 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.09.23 18:32:06 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.09.03 02:19:44 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.03 02:13:56 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.09.03 02:19:44 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.03 02:19:44 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.03 02:19:44 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.03 02:19:44 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2011.09.29 17:05:01 | 000,437,717 | R--- | M]) - C:\WINXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 64.120.141.163
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-domains-registrations.com
O1 - Hosts: 127.0.0.1 www.1-domains-registrations.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 15053 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINXP\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINXP\System32\NvMcTray.dll (NVIDIA Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FDA1901-0738-44B0-BF04-AA786E45EAD7}: NameServer = 192.168.1.254
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINXP\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINXP\system32\userinit.exe) -C:\WINXP\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:AutorunsDisabled () -
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Rezeption\Eigene Dateien\Sicherungsordner Eigene Dateien\Eigene Bilder\201024071914-18577.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Rezeption\Eigene Dateien\Sicherungsordner Eigene Dateien\Eigene Bilder\201024071914-18577.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.10.28 11:37:52 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.09.24 14:29:36 | 000,000,076 | ---- | M] () - E:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2011.09.24 14:28:56 | 000,000,313 | ---- | M] () - E:\AUTORUN.INF.txt -- [ FAT32 ]
O33 - MountPoints2\{a04d1e21-1d07-11e0-a71b-6c626d72acc1}\Shell\AutoRun\command - "" = E:\starter.exe -- [2011.02.14 10:44:38 | 001,273,856 | ---- | M] ()
O33 - MountPoints2\{ca28dcc2-e279-11df-ae36-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{ca28dcc2-e279-11df-ae36-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ca28dcc2-e279-11df-ae36-806d6172696f}\Shell\AutoRun\command - "" = D:\DVDSetup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.09.29 17:39:14 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Rezeption\Desktop\OTL.exe
[2011.09.29 16:20:00 | 000,000,000 | ---D | C] -- C:\Programme\FaJo
[2011.09.29 16:16:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Startmenü\Programme\WinRAR
[2011.09.29 16:16:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\WinRAR
[2011.09.29 16:07:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\HotMax
[2011.09.29 16:04:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Startmenü\Programme\Security
[2011.09.29 16:04:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Startmenü\Programme\Player
[2011.09.29 16:01:00 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\ieencode.dll
[2011.09.29 16:01:00 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ieencode.dll
[2011.09.29 15:47:00 | 017,010,016 | ---- | C] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Rezeption\Desktop\IE8-WindowsXP-x86-DEU.exe
[2011.09.29 15:46:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Eigene Dateien\Downloads
[2011.09.29 15:36:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2011.09.29 13:34:35 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.09.29 13:34:33 | 000,000,000 | ---D | C] -- C:\WINXP\setup.pss
[2011.09.29 13:27:16 | 000,000,000 | ---D | C] -- C:\Programme\IrfanView
[2011.09.29 13:21:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Media
[2011.09.29 13:21:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Hardware
[2011.09.29 13:20:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Security
[2011.09.29 13:20:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Grafik
[2011.09.29 13:19:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Player
[2011.09.29 12:53:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Malwarebytes
[2011.09.29 12:52:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.09.29 12:52:48 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINXP\System32\drivers\mbam.sys
[2011.09.29 12:52:48 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.09.29 11:46:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Lokale Einstellungen\Anwendungsdaten\GHISLER
[2011.09.29 11:46:37 | 000,442,200 | ---- | C] (AVAST Software) -- C:\WINXP\System32\drivers\aswSnx.sys
[2011.09.29 11:38:16 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Rezeption\Recent
[2011.09.29 07:31:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Startmenü\Programme\Data Restore
[2011.09.26 23:15:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Eigene Dateien\Igor
[2011.09.23 18:40:06 | 000,000,000 | R--D | C] -- C:\Programme\$$SysinternalsSuite
[2011.09.23 18:32:32 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java
[2011.09.23 18:32:22 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINXP\System32\javaws.exe
[2011.09.23 18:32:22 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINXP\System32\javaw.exe
[2011.09.23 18:32:22 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINXP\System32\java.exe
[2011.09.23 18:32:22 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINXP\System32\javacpl.cpl
[2011.09.23 18:32:00 | 000,000,000 | ---D | C] -- C:\Programme\Java
[2011.09.23 18:30:30 | 000,000,000 | ---D | C] -- C:\WINXP\pss
[2011.09.23 18:15:57 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.09.23 18:14:33 | 000,000,000 | ---D | C] -- C:\WINXP\System32\appmgmt
[2011.09.22 08:08:18 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINXP\System32\FlashPlayerCPLApp.cpl
[2011.09.09 12:45:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Rezeption\Eigene Dateien\Outlook-Dateien
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.09.29 17:39:09 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Rezeption\Desktop\OTL.exe
[2011.09.29 17:05:01 | 000,437,717 | R--- | M] () -- C:\WINXP\System32\drivers\etc\hosts
[2011.09.29 17:01:51 | 000,276,202 | ---- | M] () -- C:\WINXP\System32\NvApps.xml
[2011.09.29 17:01:24 | 000,002,206 | ---- | M] () -- C:\WINXP\System32\wpa.dbl
[2011.09.29 17:00:38 | 000,002,048 | --S- | M] () -- C:\WINXP\bootstat.dat
[2011.09.29 17:00:36 | 000,279,744 | ---- | M] () -- C:\WINXP\System32\FNTCACHE.DAT
[2011.09.29 16:09:33 | 000,000,788 | ---- | M] () -- C:\Dokumente und Einstellungen\Rezeption\Desktop\Avast.lnk
[2011.09.29 16:06:22 | 000,002,485 | ---- | M] () -- C:\Dokumente und Einstellungen\Rezeption\Desktop\Microsoft Word 2010.lnk
[2011.09.29 16:01:26 | 000,477,280 | ---- | M] () -- C:\WINXP\System32\perfh007.dat
[2011.09.29 16:01:26 | 000,435,616 | ---- | M] () -- C:\WINXP\System32\perfh009.dat
[2011.09.29 16:01:26 | 000,091,332 | ---- | M] () -- C:\WINXP\System32\perfc007.dat
[2011.09.29 16:01:26 | 000,068,512 | ---- | M] () -- C:\WINXP\System32\perfc009.dat
[2011.09.29 15:47:07 | 017,010,016 | ---- | M] (Microsoft Corporation) -- C:\Dokumente und Einstellungen\Rezeption\Desktop\IE8-WindowsXP-x86-DEU.exe
[2011.09.29 15:42:37 | 000,437,691 | R--- | M] () -- C:\WINXP\System32\drivers\etc\hosts.20110929-162207.backup
[2011.09.29 15:41:38 | 000,437,691 | R--- | M] () -- C:\WINXP\System32\drivers\etc\hosts.20110929-154237.backup
[2011.09.29 15:28:50 | 000,002,589 | ---- | M] () -- C:\Dokumente und Einstellungen\Rezeption\Desktop\Microsoft Outlook 2010.lnk
[2011.09.29 15:26:24 | 000,003,002 | ---- | M] () -- C:\WINXP\System32\CONFIG.NT
[2011.09.29 13:34:59 | 000,000,301 | RHS- | M] () -- C:\boot.ini
[2011.09.29 12:47:40 | 000,000,218 | RHS- | M] () -- C:\BOOT.BAK
[2011.09.23 18:33:47 | 000,001,917 | ---- | M] () -- C:\WINXP\imsins.BAK
[2011.09.23 18:32:05 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINXP\System32\deployJava1.dll
[2011.09.23 18:32:05 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINXP\System32\javaws.exe
[2011.09.23 18:32:05 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINXP\System32\javaw.exe
[2011.09.23 18:32:05 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINXP\System32\java.exe
[2011.09.23 18:32:05 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINXP\System32\javacpl.cpl
[2011.09.22 08:08:18 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINXP\System32\FlashPlayerCPLApp.cpl
[2011.09.09 11:11:59 | 000,604,160 | ---- | M] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\crypt32.dll
[2011.09.08 16:59:21 | 000,002,487 | ---- | M] () -- C:\Dokumente und Einstellungen\Rezeption\Desktop\Microsoft Excel 2010.lnk
[2011.09.06 22:45:29 | 000,199,304 | ---- | M] (AVAST Software) -- C:\WINXP\System32\aswBoot.exe
[2011.09.06 22:45:29 | 000,041,184 | ---- | M] (AVAST Software) -- C:\WINXP\avastSS.scr
[2011.09.06 22:38:05 | 000,442,200 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aswSnx.sys
[2011.09.06 22:37:53 | 000,320,856 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aswSP.sys
[2011.09.06 22:36:38 | 000,034,392 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aswRdr.sys
[2011.09.06 22:36:36 | 000,052,568 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aswTdi.sys
[2011.09.06 22:36:23 | 000,110,552 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aswmon2.sys
[2011.09.06 22:36:20 | 000,104,536 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aswmon.sys
[2011.09.06 22:36:12 | 000,020,568 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aswFsBlk.sys
[2011.09.06 22:33:11 | 000,030,808 | ---- | M] (AVAST Software) -- C:\WINXP\System32\drivers\aavmker4.sys
[2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) -- C:\WINXP\System32\drivers\mbam.sys
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.09.29 17:00:36 | 000,279,744 | ---- | C] () -- C:\WINXP\System32\FNTCACHE.DAT
[2011.09.29 16:21:48 | 170,738,176 | ---- | C] () -- C:\Dokumente und Einstellungen\Rezeption\Desktop\$ATI2011.6868_s_de.msi
[2011.09.29 16:21:47 | 000,002,345 | ---- | C] () -- C:\Dokumente und Einstellungen\Rezeption\Desktop\$Acronis True Image Home 2011 14.0.0.6696 - Lizenz-gekauft.rar
[2011.09.29 16:09:33 | 000,000,788 | ---- | C] () -- C:\Dokumente und Einstellungen\Rezeption\Desktop\Avast.lnk
[2011.09.29 13:34:58 | 000,000,218 | RHS- | C] () -- C:\BOOT.BAK
[2011.09.29 13:34:54 | 000,262,464 | RHS- | C] () -- C:\cmldr
[2011.03.26 06:10:59 | 000,002,477 | ---- | C] () -- C:\WINXP\Buchung1.INI
[2011.03.05 18:08:56 | 000,230,384 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2011.02.16 02:05:59 | 000,056,500 | ---- | C] () -- C:\WINXP\System32\mlfcache.dat
[2011.02.02 21:17:21 | 000,946,053 | ---- | C] () -- C:\WINXP\Diercke Globus Online Uninstaller.exe
[2011.01.13 08:39:57 | 000,000,793 | ---- | C] () -- C:\WINXP\RUECK1.INI
[2011.01.12 00:23:05 | 000,000,120 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft.SqlServer.Compact.351.32.bc
[2010.12.28 14:37:40 | 000,000,206 | ---- | C] () -- C:\WINXP\MAHN01.INI
[2010.11.08 18:48:07 | 000,002,418 | ---- | C] () -- C:\WINXP\RES1.INI
[2010.10.29 13:03:52 | 000,126,976 | ---- | C] () -- C:\WINXP\System32\LgxDLL.dll
[2010.10.29 13:03:52 | 000,028,672 | ---- | C] () -- C:\WINXP\System32\LgxUNINT.dll
[2010.10.29 13:03:51 | 000,126,976 | ---- | C] () -- C:\WINXP\LgxDLL.dll
[2010.10.29 13:03:51 | 000,028,672 | ---- | C] () -- C:\WINXP\LgxUNINT.dll
[2010.10.29 13:03:51 | 000,000,408 | ---- | C] () -- C:\WINXP\ads.ini
[2010.10.29 13:03:51 | 000,000,034 | ---- | C] () -- C:\WINXP\ais.ini
[2010.10.28 13:40:36 | 000,210,944 | ---- | C] () -- C:\WINXP\System32\msvcrt10.dll
[2010.10.28 12:14:20 | 000,000,000 | ---- | C] () -- C:\WINXP\nsreg.dat
[2010.10.28 11:59:09 | 000,004,073 | ---- | C] () -- C:\WINXP\ODBCINST.INI
[2010.10.28 11:51:58 | 000,080,416 | R--- | C] () -- C:\WINXP\System32\RtNicProp32.dll
[2010.10.28 11:40:09 | 000,002,048 | --S- | C] () -- C:\WINXP\bootstat.dat
[2010.10.28 11:34:55 | 000,021,740 | ---- | C] () -- C:\WINXP\System32\emptyregdb.dat
[2010.03.15 17:52:00 | 002,183,470 | ---- | C] () -- C:\WINXP\System32\nvdata.bin
[2008.05.26 23:23:36 | 000,016,834 | ---- | C] () -- C:\WINXP\System32\gthrctr.ini
[2008.05.26 23:23:34 | 000,024,188 | ---- | C] () -- C:\WINXP\System32\idxcntrs.ini
[2008.05.26 23:23:32 | 000,016,568 | ---- | C] () -- C:\WINXP\System32\gsrvctr.ini
[2008.05.26 22:59:42 | 000,018,904 | ---- | C] () -- C:\WINXP\System32\structuredqueryschematrivial.bin
[2008.05.26 22:59:40 | 000,106,605 | ---- | C] () -- C:\WINXP\System32\structuredqueryschema.bin
[2008.04.14 11:00:00 | 013,107,200 | ---- | C] () -- C:\WINXP\System32\oembios.bin
[2008.04.14 11:00:00 | 000,673,088 | ---- | C] () -- C:\WINXP\System32\mlang.dat
[2008.04.14 11:00:00 | 000,477,280 | ---- | C] () -- C:\WINXP\System32\perfh007.dat
[2008.04.14 11:00:00 | 000,435,616 | ---- | C] () -- C:\WINXP\System32\perfh009.dat
[2008.04.14 11:00:00 | 000,272,128 | ---- | C] () -- C:\WINXP\System32\perfi009.dat
[2008.04.14 11:00:00 | 000,269,480 | ---- | C] () -- C:\WINXP\System32\perfi007.dat
[2008.04.14 11:00:00 | 000,218,003 | ---- | C] () -- C:\WINXP\System32\dssec.dat
[2008.04.14 11:00:00 | 000,091,332 | ---- | C] () -- C:\WINXP\System32\perfc007.dat
[2008.04.14 11:00:00 | 000,068,512 | ---- | C] () -- C:\WINXP\System32\perfc009.dat
[2008.04.14 11:00:00 | 000,046,258 | ---- | C] () -- C:\WINXP\System32\mib.bin
[2008.04.14 11:00:00 | 000,034,478 | ---- | C] () -- C:\WINXP\System32\perfd007.dat
[2008.04.14 11:00:00 | 000,028,626 | ---- | C] () -- C:\WINXP\System32\perfd009.dat
[2008.04.14 11:00:00 | 000,004,569 | ---- | C] () -- C:\WINXP\System32\secupd.dat
[2008.04.14 11:00:00 | 000,004,463 | ---- | C] () -- C:\WINXP\System32\oembios.dat
[2008.04.14 11:00:00 | 000,001,804 | ---- | C] () -- C:\WINXP\System32\Dcache.bin
[2008.04.14 11:00:00 | 000,000,741 | ---- | C] () -- C:\WINXP\System32\noise.dat

========== LOP Check ==========

[2010.10.28 13:29:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2010.10.28 12:15:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
[2011.02.16 01:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.09.29 16:34:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\DAEMON Tools Lite
[2011.01.20 01:58:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2011.02.02 21:17:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Diercke Globus Online
[2010.11.09 23:24:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Opera
[2011.01.12 00:21:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\PeerNetworking
[2011.09.07 07:24:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\TeamViewer
[2010.11.09 16:32:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Windows Desktop Search
[2011.01.12 05:22:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Rezeption\Anwendungsdaten\Windows Search

========== Purity Check ==========



< End of report >

hi,
was hast du bisher womit gelöscht?
malwarebytes logs und sonstige berichte posten bitte.

Boot vom Life-Cd und entfernt:

%AllUsersProfile%\Application Data\~<random>
%AllUsersProfile%\Application Data\~<random>r
%AllUsersProfile%\Application Data\<random>.dll
%AllUsersProfile%\Application Data\<random>.exe
%AllUsersProfile%\Application Data\<random>
%AllUsersProfile%\Application Data\<random>.exe
%UserProfile%\Desktop\Windows Fix Disk.lnk
%UserProfile%\Start Menu\Programs\Windows Fix Disk\
%UserProfile%\Start Menu\Programs\Windows Fix Disk\Uninstall Windows Fix Disk.lnk
%UserProfile%\Start Menu\Programs\Windows Fix Disk\Windows Fix Disk.lnk

und WindowsFixDisk Windows Registry Information:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "<random>.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "<random>"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "CertificateRevocation" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnonBadCertRecving" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop "NoChangingWallPaper" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations "LowRiskFileTypes" = '/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System "DisableTaskMgr" = '1'
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system "DisableTaskMgr" = '1'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download "CheckExeSignatures" = 'no'
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main "Use FormSuggest" = 'yes'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "Hidden" = '0'
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced "ShowSuperHidden" = 0'

Ich werde wahrscheinlich noch die Anleitung durcharbeiten:
hxxp://www.bleepingcomputer.com/virus-removal/remove-windowsfixdisk

ich denke du willst hier hilfe, also machst du entweder das was ich dir schreibe, oder du arbeitest allein, alles andere macht ja wohl kaum sinn.
wo ist das malware bytes log.
oder falls es mehr gibt, poste alle

12:53:44 (null) MESSAGE Protection started successfully
12:53:49 (null) MESSAGE IP Protection started successfully
13:19:27 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
13:19:30 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
13:19:36 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
13:19:48 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
13:19:51 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
13:19:57 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
15:22:55 Rezeption MESSAGE Protection started successfully
15:23:36 Rezeption MESSAGE IP Protection started successfully
15:23:48 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:23:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:23:57 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:24:09 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:24:12 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:24:18 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:25:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:25:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:25:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:26:03 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:26:07 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:26:13 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:27:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:27:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:27:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:28:03 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:28:06 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:28:13 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
15:46:18 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
15:46:21 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
15:46:27 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
15:46:39 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
15:46:42 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
15:46:48 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
16:11:25 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:11:28 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:11:34 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:11:46 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:11:49 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:11:55 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:13:23 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:13:26 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:13:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:13:44 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:13:47 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:13:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:15:23 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:15:26 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:15:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:15:44 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:15:47 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:15:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
16:16:35 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
16:16:38 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
16:16:44 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
16:16:56 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
16:16:59 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
16:17:05 Rezeption IP-BLOCK 206.161.121.100 (Type: outgoing)
16:41:13 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
16:41:16 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
16:41:22 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
16:41:34 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
16:41:37 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
16:41:43 (null) IP-BLOCK 206.161.121.100 (Type: outgoing)
17:02:05 Rezeption MESSAGE Protection started successfully
17:02:11 Rezeption MESSAGE IP Protection started successfully
17:02:47 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:02:48 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:02:50 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:02:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:02:53 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:02:55 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:02:59 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:00 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:03:08 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:11 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:14 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:14 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:03:20 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:25 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:35 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:03:42 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:03:58 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:04:38 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
17:05:11 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:14 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:20 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:35 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:54 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:55 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:56 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:05:57 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:30:47 Rezeption MESSAGE IP Protection stopped
17:30:50 Rezeption MESSAGE Database updated successfully
17:30:54 Rezeption MESSAGE IP Protection started successfully
17:31:25 Rezeption MESSAGE IP Protection stopped
17:31:29 Rezeption MESSAGE IP Protection started successfully
17:46:16 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:46:19 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:46:25 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:46:37 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:46:40 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:46:46 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:48:15 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:48:18 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:48:24 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:48:36 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:48:39 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:48:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:50:15 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:50:18 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:50:24 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:50:36 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:50:39 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
17:50:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:31:20 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:31:23 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:31:29 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:31:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:31:44 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:31:50 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:33:18 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:33:21 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:33:27 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:33:39 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:33:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:33:48 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:35:17 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:35:20 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:35:26 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:35:38 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:35:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
18:35:47 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:16:21 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:16:24 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:16:31 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:16:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:16:46 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:16:52 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:18:21 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:18:24 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:18:30 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:18:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:18:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:18:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:20:20 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:20:23 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:20:30 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:20:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:20:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
19:20:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:01:26 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:01:29 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:01:35 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:01:47 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:01:50 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:01:56 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:03:24 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:03:27 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:03:33 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:03:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:03:48 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:03:54 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:05:24 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:05:27 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:05:33 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:05:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:05:48 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:05:54 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:46:28 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:46:31 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:46:37 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:46:49 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:46:52 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:46:58 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:48:27 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:48:30 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:48:36 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:48:48 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:48:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:48:57 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:50:26 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:50:29 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:50:35 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:50:47 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:50:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
20:50:57 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:31:30 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:31:33 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:31:39 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:31:51 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:31:54 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:32:00 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:33:29 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:33:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:33:38 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:33:50 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:33:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:33:59 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:35:29 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:35:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:35:38 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:35:50 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:35:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
21:35:59 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:16:33 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:16:36 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:16:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:16:54 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:16:57 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:17:03 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:18:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:18:35 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:18:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:18:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:18:56 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:19:02 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:20:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:20:35 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:20:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:20:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:20:56 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
22:21:02 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:01:42 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:01:45 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:01:52 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:02:03 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:02:07 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:02:13 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:03:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:03:44 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:03:50 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:04:02 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:04:05 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:04:11 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:05:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:05:44 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:05:50 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:06:02 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:06:05 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:06:11 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:22:17 Rezeption MESSAGE Protection started successfully
23:22:37 Rezeption MESSAGE IP Protection started successfully
23:22:38 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:22:41 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:22:46 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:22:57 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:23:07 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:23:18 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:23:32 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
23:23:33 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
23:23:35 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
23:23:38 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:23:39 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
23:23:47 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
23:24:03 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
23:24:08 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:24:11 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:24:17 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:24:20 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:24:29 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:24:32 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:24:35 Rezeption IP-BLOCK 64.120.141.163 (Type: incoming)
23:24:38 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:25:44 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:25:47 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:25:53 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:05 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:07 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:08 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:10 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:14 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:16 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:28 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:31 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)
23:26:37 Rezeption IP-BLOCK 64.120.141.163 (Type: outgoing)

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 7838

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

02.10.2011 00:30:09
mbam-log-2011-10-02 (00-30-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 197607
Laufzeit: 7 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 2
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel\Homepage (PUM.Hijack.HomePageControl) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

ok.
combofix:

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

• Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
  Tool
  
  Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  
• Hinweis:
  Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  
• Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.