Hallo,
habe ebenfalls das Viren Problem "Windows gesperrt! Zahlungsaufforderung 50 €" das ich nicht gelöst bekomme.
Das Problem tritt wie bei allen anderen hier im Forum bei mir genauso auf.
Wenn ich den Rechner starte, erscheint ein schwarzer Bildschirm. Da ist die Rede von infizierten Seiten, Windows sei in einem kritischen Zustand und Dateien könnten verloren gehen. Dann wird man aufgefordert 50 Euro für ein Softvare-Update des Antivirenprogramms zu zahlen.
Der Zugriff auf den Taskmanager funktioniert auch nicht.
Dabei bin ich auf die Beiträge hier im Forum gestossen und habe
hoffentlich soweit wie möglich die nötige Vorabeit zur Lösung meines Problems
bereits erabeitet.
Dazu die folgenden Schritte:

1. Windows im abgesicherten Modus mit Netzwerk hochgefahren.
2. Mit Norten Voll Scan durchgefüht. Ergebnis 8 Risiken erkannt und behoben.
3. Neu hochgefahren Problem nicht behoben.
4. Erneut Windows im abgesicherten Modus mit Netzwerk hochgefahren.
5. Otl heruntegeladen und wie bei Kürbis 20.03.2012 beschrieben die Scans vollzogen als Administrator für Vista.

A. Voll Scan mit den entsprechenden beschriebenen modifikationen im Otl
ProgrammOTL Logfile:

OTL logfile created on: 27.03.2012 14:34:42 - Run 3
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\*******\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,54 Gb Available Physical Memory | 76,93% Memory free
4,22 Gb Paging File | 3,93 Gb Available in Paging File | 93,14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 452,08 Gb Total Space | 358,59 Gb Free Space | 79,32% Space Free | Partition Type: NTFS
Drive D: | 7,38 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive J: | 3,74 Gb Total Space | 0,00 Gb Free Space | 0,02% Space Free | Partition Type: FAT32
 
Computer Name: DIRK-PC | User Name: DIRK | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.27 13:49:36 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\DIRK\Downloads\OTL.exe
PRC - [2011.08.14 13:15:29 | 000,748,336 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.08.30 18:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Stopped] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.04.17 02:45:11 | 000,130,008 | R--- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe -- (NIS)
SRV - [2010.04.14 22:08:12 | 000,598,696 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\lxeccoms.exe -- (lxec_device)
SRV - [2010.04.14 22:08:05 | 000,193,192 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxecserv.exe -- (lxecCATSCustConnectService)
SRV - [2009.11.13 13:31:14 | 000,092,008 | ---- | M] (TomTom) [Auto | Stopped] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009.10.07 02:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.05.13 00:12:56 | 000,069,632 | ---- | M] (Ralink Technology, Corp.) [Auto | Stopped] -- C:\Programme\Hama\Common\RalinkRegistryWriter.exe -- (RalinkRegistryWriter)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.10.25 15:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)
SRV - [2007.10.18 11:31:54 | 000,098,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Messenger\usnsvc.exe -- (usnjsvc)
SRV - [2007.05.29 12:06:44 | 000,598,960 | ---- | M] ( ) [Auto | Stopped] -- C:\Windows\System32\lxdfcoms.exe -- (lxdf_device)
SRV - [2007.05.29 12:06:20 | 000,099,248 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxdfserv.exe -- (lxdfCATSCustConnectService)
SRV - [2007.05.08 18:23:12 | 000,299,093 | ---- | M] () [Auto | Stopped] -- C:\Programme\CyberLink\TV Enhance\Kernel\TV\TVECapSvc.exe -- (TVECapSvc) TVEnhance Background Capture Service (TBCS)
SRV - [2007.05.08 18:23:12 | 000,127,059 | ---- | M] () [Auto | Stopped] -- C:\Programme\CyberLink\TV Enhance\Kernel\TV\TVESched.exe -- (TVESched) TVEnhance Task Scheduler (TTS))
SRV - [2007.03.12 15:45:26 | 000,462,848 | ---- | M] () [Auto | Stopped] -- C:\Windows\CheckStage2.exe -- (CheckStage2_svc)
SRV - [2007.01.04 23:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Stopped] -- C:\Programme\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2006.12.14 17:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Programme\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2006.11.02 20:40:12 | 000,174,656 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2006.10.23 14:50:35 | 000,046,640 | R--- | M] (AOL LLC) [On_Demand | Stopped] -- C:\Programme\Common Files\aol\acs\AOLacsd.exe -- (AOL ACS)
SRV - [2005.11.17 15:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2003.07.28 14:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003.06.20 01:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.03.06 17:04:10 | 000,368,248 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20120324.004\IDSvix86.sys -- (IDSVix86)
DRV - [2012.03.02 20:58:02 | 000,820,856 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20120317.002\BHDrvx86.sys -- (BHDrvx86)
DRV - [2012.02.04 11:12:31 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2012.02.04 11:12:31 | 000,106,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011.08.04 07:58:16 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20120326.019\NAVEX15.SYS -- (NAVEX15)
DRV - [2011.08.04 07:58:16 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20120326.019\NAVENG.SYS -- (NAVENG)
DRV - [2011.05.12 16:59:19 | 000,126,584 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2011.03.31 05:00:09 | 000,516,216 | ---- | M] (Symantec Corporation) [File_System | System | Stopped] -- C:\Windows\System32\drivers\NIS\1206000.01D\srtsp.sys -- (SRTSP)
DRV - [2011.03.31 05:00:09 | 000,050,168 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\NIS\1206000.01D\srtspx.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2011.03.22 02:39:49 | 000,331,384 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\NIS\1206000.01D\symtdiv.sys -- (SYMTDIv)
DRV - [2011.03.15 04:31:23 | 000,744,568 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\NIS\1206000.01D\symefa.sys -- (SymEFA)
DRV - [2011.02.23 08:27:00 | 010,468,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011.01.27 08:47:10 | 000,340,088 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\NIS\1206000.01D\symds.sys -- (SymDS)
DRV - [2011.01.27 07:07:05 | 000,136,312 | ---- | M] (Symantec Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\NIS\1206000.01D\ironx86.sys -- (SymIRON)
DRV - [2009.10.07 02:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.05.01 01:01:34 | 000,265,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2009.05.01 00:55:32 | 000,013,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2009.04.30 23:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.07.31 13:27:00 | 000,641,024 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2008.07.29 04:45:00 | 000,904,192 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athrusb.sys -- (athrusb)
DRV - [2007.11.18 03:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007.10.12 04:00:42 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007.08.09 18:12:30 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007.07.27 12:46:06 | 000,251,680 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acehlp10.sys -- (acehlp10)
DRV - [2007.07.27 10:13:08 | 000,330,144 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\ACEDRV10.sys -- (acedrv10)
DRV - [2007.04.03 10:43:28 | 001,131,136 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32)
DRV - [2006.11.02 09:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006.11.01 22:18:15 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2006.10.30 04:31:58 | 000,043,648 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2006.10.27 02:55:48 | 002,814,080 | ---- | M] (ASUSTeK) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\3xHybrid.sys -- (3xHybrid)
DRV - [2006.02.07 12:52:58 | 000,006,912 | ---- | M] (JMicron ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\JGOGO.sys -- (JGOGO)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://supertoolbar.ask.com/redirect?client=ie&tb=TRL&o=101823&src=crm&q={searchTerms}
IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = hxxp://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=60452
IE - HKCU\..\SearchScopes\{38E81A65-5C20-47BF-98EB-4FEC36B300EB}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{4BB039BC-3395-4299-829B-EB2CF63F7A3F}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{7D267784-E7F6-4A58-AA01-298AD30FA24C}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = hxxp://int.search-results.com/web?q={SEARCHTERMS}&o=15527&l=dis&prt=NIS&chn=retail&geo=DE&ver=18
IE - HKCU\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\..\SearchScopes\{B5F6A7DE-6CC9-4F2B-8CDA-C9CBFE90AE88}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\VWPT: "URL" = hxxp://search.viewpoint.com/pl/search?tab=1&k={searchTerms}&addr=1&query=vb=1%26tn%3D0%26addr%3D1%26type%3Drel39%5fvista%26instid%3DViewpointV39%5fvista
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: "DVDVideoSoftTB Customized Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:5.6
FF - prefs.js..keyword.URL: "hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60452&qkw="
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll (Viewpoint Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\DIRK\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\DIRK\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\DIRK\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Program Files\Crawler\Toolbar\firefox\ [2010.12.04 17:33:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [2012.03.27 14:29:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_4_3 [2012.03.27 14:29:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.12.05 21:20:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.12.02 09:22:35 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{0E810812-F4BB-4309-942A-755587587A5E}: C:\Program Files\BullGuard Software\BullGuard\antispam\tbspamfilter
 
[2009.12.03 19:40:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DIRK\AppData\Roaming\mozilla\Extensions
[2009.01.14 00:58:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DIRK\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2012.03.23 18:51:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DIRK\AppData\Roaming\mozilla\Firefox\Profiles\3pgw7tyx.default\extensions
[2010.09.20 17:30:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\DIRK\AppData\Roaming\mozilla\Firefox\Profiles\3pgw7tyx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.12.26 16:40:48 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\DIRK\AppData\Roaming\mozilla\Firefox\Profiles\3pgw7tyx.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.08.09 23:37:27 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\DIRK\AppData\Roaming\mozilla\Firefox\Profiles\3pgw7tyx.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.03.23 18:51:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DIRK\AppData\Roaming\mozilla\Firefox\Profiles\3pgw7tyx.default\extensions\staged
[2011.12.26 16:41:10 | 000,000,933 | ---- | M] () -- C:\Users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\searchplugins\11-suche.xml
[2011.07.24 15:30:04 | 000,000,931 | ---- | M] () -- C:\Users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\searchplugins\conduit.xml
[2011.12.26 16:41:10 | 000,002,419 | ---- | M] () -- C:\Users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\searchplugins\englische-ergebnisse.xml
[2011.12.26 16:41:10 | 000,010,525 | ---- | M] () -- C:\Users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\searchplugins\gmx-suche.xml
[2011.12.26 16:41:10 | 000,002,457 | ---- | M] () -- C:\Users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\searchplugins\lastminute.xml
[2010.11.02 09:28:16 | 000,002,449 | ---- | M] () -- C:\Users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\searchplugins\safesearch.xml
[2011.12.26 16:41:10 | 000,005,508 | ---- | M] () -- C:\Users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\searchplugins\webde-suche.xml
[2011.12.06 08:23:06 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.03.27 14:29:58 | 000,000,000 | ---D | M] (Norton Toolbar) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\COFFPLGN_2011_7_4_3
[2012.03.27 14:29:21 | 000,000,000 | ---D | M] (Symantec Intrusion Prevention) -- C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPLGN
() (No name found) -- C:\USERS\DIRK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3PGW7TYX.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2011.12.05 21:20:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.11.04 18:57:50 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.04 18:57:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2007.07.26 14:05:16 | 000,001,329 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml
[2011.11.04 18:57:50 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.04 18:57:50 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.04 18:57:50 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.04 18:57:50 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome ==========
 
CHR - default_search_provider: Conduit (Enabled)
CHR - default_search_provider: search_url = hxxp://search.conduit.com/Results.aspx?q={searchTerms}&hl=en&SelfSearch=1&SearchSource=49&ctid=CT2269050
CHR - default_search_provider: suggest_url = hxxp://search.conduit.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\DIRK\AppData\Local\Google\Chrome\Application\15.0.874.120\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\DIRK\AppData\Local\Google\Chrome\Application\15.0.874.120\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\DIRK\AppData\Local\Google\Chrome\Application\15.0.874.120\pdf.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\DIRK\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\DIRK\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Gloss Blue = C:\Users\DIRK\AppData\Local\Google\Chrome\User Data\Default\Extensions\nheaocaplknjkpcnbadlgfpdfjaabiml\1.0_0\
CHR - Extension: DVDVideoSoftTB = C:\Users\DIRK\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo\2.0.1.4_0\
CHR - Extension: DVDVideoSoftTB = C:\Users\DIRK\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo\2.3.1.12_0\
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Viewpoint Toolbar BHO) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Programme\Viewpoint\Viewpoint Toolbar\3.9.0\ViewBarBHO.dll (Viewpoint Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O2 - BHO: (WEB.DE Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll ()
O2 - BHO: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\Supertoolbar\GenericAskToolbar.dll (TODO: <Company name>)
O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (WEB.DE Toolbar) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O3 - HKLM\..\Toolbar: (Ask.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\Supertoolbar\GenericAskToolbar.dll (TODO: <Company name>)
O3 - HKLM\..\Toolbar: (Viewpoint Toolbar) - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Programme\Common Files\Viewpoint\Toolbar Runtime\3.9.0\IEViewBar.dll (Viewpoint Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE Toolbar) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AuditVista] File not found
O4 - HKLM..\Run: [Corel Photo Downloader] C:\Programme\Corel\Corel Photo Album 6\MediaDetect.exe (Corel, Inc.)
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark Pro800-Pro900 Series\ezprint.exe ()
O4 - HKLM..\Run: [HostManager] C:\Programme\Common Files\aol\1177927144\ee\aolsoftware.exe (America Online, Inc.)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\JM\JMInsIDE.exe ()
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [ledpointer] C:\Windows\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [Lexmark 6500 Series Fax Server] C:\Program Files\Lexmark 6500 Series\fm3032.exe ()
O4 - HKLM..\Run: [Lexmark Pro800-Pro900 Series Fax Server] C:\Program Files\Lexmark Pro800-Pro900 Series\fm3032.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [lxdfamon] C:\Program Files\Lexmark 6500 Series\lxdfamon.exe ()
O4 - HKLM..\Run: [lxdfmon.exe] C:\Program Files\Lexmark 6500 Series\lxdfmon.exe ()
O4 - HKLM..\Run: [lxecmon.exe] C:\Program Files\Lexmark Pro800-Pro900 Series\lxecmon.exe ()
O4 - HKLM..\Run: [MoLed] C:\Windows\ModLEDKey.exe (Chicony)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [TVEService] C:\Program Files\CyberLink\TV Enhance\TVEService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Vid HD\Vid.exe (Logitech Inc.)
O4 - HKCU..\Run: [MobileDocuments] C:\Programme\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKCU..\Run: [SkypePM] C:\Users\DIRK\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation)
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1103470 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.1; .NET CLR 3.5.30729; .NET CLR 3.0.30729)" -"hxxp://cdn.kaisergames.de/loads/rallypoint/rallypoint.html" File not found
O4 - Startup: C:\Users\DIRK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk = C:\Programme\Trillian\trillian.exe (Cerulean Studios)
O8 - Extra context menu item: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation)
O8 - Extra context menu item: Add to Windows &Live Favorites - hxxp://favorites.live.com/quickadd.aspx File not found
O8 - Extra context menu item: Crawler Search - tbr:iemenu File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DIRK\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Programme\WordPerfect Office X3\Programs\WPLauncher.hta ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: maris.com ([www.redshift] http in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab (DLM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {BF3CD111-6278-11D2-9EA3-00A0C9251384} hxxp://www.o2c.de/download/O2CPlayer.CAB (O2C-Player Version 1.x)
O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} https://as.photoprintit.de/ips-opdata/layout/default_cms01/activex/IPSUploader4.cab (IPSUploader4 Control)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{05DC692C-795B-456B-811D-B5EB7AFB9C8D}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{51F00A11-9D7A-4E7A-81AB-BF0E4121E562}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{85860EFB-46BA-4FD2-8D01-F910C8EDA450}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AFD2FD51-F5E3-46A7-B1BE-9EACB280C596}: DhcpNameServer = 192.168.15.155 192.168.5.57 192.168.5.56
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\DIRK\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\DIRK\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.08.22 07:57:52 | 000,230,728 | R--- | M] (Konami Digital Entertainment Co., Ltd.) - D:\autorun.exe -- [ UDF ]
O32 - AutoRun File - [2008.05.30 08:54:04 | 000,000,047 | R--- | M] () - D:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{419e8587-3712-11dd-99b5-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{419e8587-3712-11dd-99b5-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe -- [2008.08.22 07:57:52 | 000,230,728 | R--- | M] (Konami Digital Entertainment Co., Ltd.)
O33 - MountPoints2\{5f615dc4-ec16-11df-9a55-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{5f615dc4-ec16-11df-9a55-00038a000015}\Shell\AutoRun\command - "" = J:\iStudio.exe
O33 - MountPoints2\{65121cd9-e1a2-11dd-84aa-00038a000015}\Shell\AutoRun\command - "" = J:\InstallTomTomHOME.exe
O33 - MountPoints2\D\Shell - "" = AutoRun
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\setup.exe -- [2008.08.31 05:04:46 | 002,231,280 | R--- | M] (KONAMI)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.27 14:29:56 | 000,000,000 | ---D | C] -- C:\Users\DIRK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012.03.18 12:13:10 | 002,044,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.03.18 12:13:08 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012.03.18 12:13:08 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012.03.18 12:13:08 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012.03.18 12:13:08 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012.03.18 12:13:08 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012.03.18 12:12:45 | 000,613,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll
[2012.03.10 14:22:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.03.10 14:21:54 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.03.03 16:53:27 | 000,000,000 | ---D | C] -- C:\Users\DIRK\Documents\Redshift_7
[2012.03.03 16:52:08 | 000,816,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDMOD.DLL
[2012.03.03 16:52:08 | 000,760,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSDMOD.DLL
[2012.03.03 16:52:08 | 000,384,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDMOD.DLL
[2012.03.03 16:52:08 | 000,316,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP43DMOD.DLL
[2012.03.03 16:52:08 | 000,278,559 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMV8DS32.AX
[2012.03.03 16:52:08 | 000,258,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDS32.AX
[2012.03.03 16:52:08 | 000,241,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MPG4DMOD.DLL
[2012.03.03 16:52:08 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSADDS32.AX
[2012.03.03 16:52:08 | 000,121,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscal.ocx
[2012.03.03 16:52:07 | 000,000,000 | ---D | C] -- C:\Windows\System32\AIM
[2012.03.03 16:52:06 | 000,074,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrclr40.dll
[2012.03.03 16:52:06 | 000,028,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrecr40.dll
[2012.03.03 16:52:00 | 001,046,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSJET35.DLL
[2012.03.03 16:52:00 | 000,415,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSREPL35.DLL
[2012.03.03 16:52:00 | 000,330,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSEXCH35.DLL
[2012.03.03 16:52:00 | 000,287,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSXBSE35.DLL
[2012.03.03 16:52:00 | 000,252,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSRD2X35.DLL
[2012.03.03 16:52:00 | 000,250,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSPDOX35.DLL
[2012.03.03 16:52:00 | 000,250,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSEXCL35.DLL
[2012.03.03 16:52:00 | 000,166,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSLTUS35.DLL
[2012.03.03 16:52:00 | 000,165,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSTEXT35.DLL
[2012.03.03 16:52:00 | 000,148,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSJINT35.DLL
[2012.03.03 16:52:00 | 000,024,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSJTER35.DLL
[2012.03.03 16:51:58 | 000,368,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\VBAR332.DLL
[2012.03.03 16:50:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Redshift 7 Launcher
[2012.03.03 16:50:07 | 000,000,000 | ---D | C] -- C:\Program Files\Maris Technologies
[2012.03.03 16:44:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kosmos
[2012.03.03 16:42:42 | 000,000,000 | ---D | C] -- C:\Program Files\Kosmos
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[11 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[11 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.27 14:40:37 | 000,008,592 | ---- | M] () -- C:\Users\DIRK\AppData\Local\d3d9caps.dat
[2012.03.27 14:36:24 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.27 14:36:24 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.27 14:36:24 | 000,125,676 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.27 14:36:24 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.27 14:31:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.27 14:28:55 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.27 14:28:55 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.27 09:41:05 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1415130864-2451929093-3127007980-1001UA.job
[2012.03.22 14:43:46 | 000,002,037 | ---- | M] () -- C:\Users\DIRK\Desktop\Google Chrome.lnk
[2012.03.22 10:47:28 | 000,001,854 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2012.03.19 09:21:29 | 000,454,464 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.13 08:41:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1415130864-2451929093-3127007980-1001Core.job
[2012.03.10 14:22:52 | 000,001,664 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.03.08 20:49:40 | 262,905,162 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.02.29 08:55:04 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[11 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[11 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.10 14:22:52 | 000,001,664 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.03.03 16:52:07 | 000,000,696 | ---- | C] () -- C:\Windows\System32\jetodbc.rsp
[2011.11.08 22:16:16 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxecvs.dll
[2011.11.08 22:16:14 | 000,442,368 | ---- | C] ( ) -- C:\Windows\System32\lxeccoin.dll
[2011.11.08 22:16:07 | 000,086,016 | ---- | C] () -- C:\Windows\System32\lxecgcfg.dll
[2011.11.08 22:16:05 | 000,294,912 | ---- | C] () -- C:\Windows\System32\lxeccui.dll
[2011.11.08 22:16:05 | 000,110,592 | ---- | C] () -- C:\Windows\System32\lxeccuir.dll
[2011.11.08 22:12:07 | 000,000,044 | -H-- | C] () -- C:\Windows\System32\lxecrwrd.ini
[2011.11.08 22:11:54 | 000,331,776 | ---- | C] () -- C:\Windows\System32\LXECinst.dll
[2011.11.08 22:11:53 | 001,048,576 | ---- | C] ( ) -- C:\Windows\System32\lxecserv.dll
[2011.11.08 22:11:53 | 000,847,872 | ---- | C] ( ) -- C:\Windows\System32\lxecusb1.dll
[2011.11.08 22:11:53 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxecinpa.dll
[2011.11.08 22:11:53 | 000,356,352 | ---- | C] ( ) -- C:\Windows\System32\LXEChcp.dll
[2011.11.08 22:11:53 | 000,344,064 | ---- | C] ( ) -- C:\Windows\System32\lxeciesc.dll
[2011.11.08 22:11:52 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxecpmui.dll
[2011.11.08 22:11:52 | 000,577,536 | ---- | C] ( ) -- C:\Windows\System32\lxeclmpm.dll
[2011.11.08 22:11:52 | 000,324,264 | ---- | C] ( ) -- C:\Windows\System32\lxecih.exe
[2011.11.08 22:11:52 | 000,323,584 | ---- | C] () -- C:\Windows\System32\lxecins.dll
[2011.11.08 22:11:52 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lxecinsb.dll
[2011.11.08 22:11:52 | 000,114,688 | ---- | C] () -- C:\Windows\System32\lxecinsr.dll
[2011.11.08 22:11:52 | 000,057,344 | ---- | C] () -- C:\Windows\System32\lxecjswr.dll
[2011.11.08 22:11:51 | 000,802,816 | ---- | C] ( ) -- C:\Windows\System32\lxeccomc.dll
[2011.11.08 22:11:51 | 000,688,128 | ---- | C] ( ) -- C:\Windows\System32\lxechbn3.dll
[2011.11.08 22:11:51 | 000,598,696 | ---- | C] ( ) -- C:\Windows\System32\lxeccoms.exe
[2011.11.08 22:11:51 | 000,372,736 | ---- | C] ( ) -- C:\Windows\System32\lxeccomm.dll
[2011.11.08 22:11:51 | 000,253,952 | ---- | C] () -- C:\Windows\System32\lxeccu.dll
[2011.11.08 22:11:51 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxecgrd.dll
[2011.11.08 22:11:51 | 000,090,112 | ---- | C] () -- C:\Windows\System32\lxeccub.dll
[2011.11.08 22:11:51 | 000,036,864 | ---- | C] () -- C:\Windows\System32\lxeccur.dll
[2011.11.08 22:11:50 | 000,373,416 | ---- | C] ( ) -- C:\Windows\System32\lxeccfg.exe
[2011.11.08 22:01:45 | 000,000,220 | ---- | C] () -- C:\Windows\WinInit.Ini
[2011.11.08 20:49:17 | 000,049,152 | ---- | C] () -- C:\Windows\System32\LXECPMON.DLL
[2011.11.08 20:49:17 | 000,032,768 | ---- | C] () -- C:\Windows\System32\LXECFXPU.DLL
[2011.11.08 20:48:57 | 004,485,120 | ---- | C] () -- C:\Windows\System32\LXECoem.dll
[2011.11.08 20:45:14 | 000,024,064 | ---- | C] () -- C:\Windows\System32\LXECsmr.dll
[2011.11.08 20:45:13 | 000,299,008 | ---- | C] () -- C:\Windows\System32\LXECsm.dll
[2011.09.27 20:45:35 | 000,005,632 | ---- | C] () -- C:\Users\DIRK\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.06 00:18:58 | 000,003,636 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011.04.03 15:48:18 | 000,000,054 | ---- | C] () -- C:\Windows\Felix2.ini
[2011.03.18 11:12:44 | 000,008,592 | ---- | C] () -- C:\Users\DIRK\AppData\Local\d3d9caps.dat
[2011.03.17 08:55:45 | 000,082,289 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2010.12.04 17:32:01 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll
 
========== LOP Check ==========
 
[2011.12.20 20:46:24 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\1&1 Mail & Media GmbH
[2008.09.26 20:41:24 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\6500 Series
[2011.08.09 23:52:29 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\DVDVideoSoft
[2011.08.09 23:37:26 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\DVDVideoSoftIEHelpers
[2009.11.23 00:31:22 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Leadertech
[2008.09.24 21:21:14 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Lexmark Productivity Studio
[2010.06.28 20:58:15 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Lurs-Minimator
[2008.07.12 01:27:04 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\MAGIX
[2011.04.05 23:21:43 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\PeerNetworking
[2011.11.09 09:02:21 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Pro800-Pro900 Series
[2011.12.26 19:53:06 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Rovio
[2008.06.13 14:41:38 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Sierra
[2011.10.01 15:22:42 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\TeamViewer
[2011.04.05 22:44:46 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Tific
[2009.01.14 00:58:00 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\TomTom
[2011.03.14 23:26:16 | 000,000,000 | ---D | M] -- C:\Users\DIRK\AppData\Roaming\Uniblue
[2008.06.19 18:54:04 | 000,000,252 | ---- | M] () -- C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
[2012.03.27 12:14:37 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
< End of report >
         

--- --- ---


B. Otl ExtraOTL Logfile:

OTL Extras logfile created on: 27.03.2012 14:34:42 - Run 3
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\********\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,54 Gb Available Physical Memory | 76,93% Memory free
4,22 Gb Paging File | 3,93 Gb Available in Paging File | 93,14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 452,08 Gb Total Space | 358,59 Gb Free Space | 79,32% Space Free | Partition Type: NTFS
Drive D: | 7,38 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive J: | 3,74 Gb Total Space | 0,00 Gb Free Space | 0,02% Space Free | Partition Type: FAT32
 
Computer Name: DIRK-PC | User Name: DIRK | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027BA199-FF48-4E4F-825F-7DAED032845E}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{57168D56-BDC5-4F08-A3C4-08649998F366}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{6E8D9F3E-D684-4DA4-8F7C-6B7D967EBE3B}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{B3F4ADD3-C671-4E8F-9AAC-CD757FC98A96}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01C8DD92-2B1B-4328-94D9-0E418D0D46B9}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{098BB6D7-E503-4DD5-B77C-EE3B4FC6A667}" = protocol=6 | dir=in | app=c:\program files\logitech\vid hd\vid.exe | 
"{0C0F0CFB-2E04-4933-AD57-5EE1B3FCEA7D}" = protocol=17 | dir=in | app=c:\program files\lexmark 6500 series\lxdfamon.exe | 
"{0E6259C6-FE2D-4C88-9F4D-FF49CA1E7B2A}" = protocol=17 | dir=in | app=c:\windows\system32\lxdfcoms.exe | 
"{188B226D-BD62-4BB8-B962-9017DC49B317}" = dir=in | app=c:\windows\system32\lxeccoms.exe | 
"{18AD5D75-39D9-48F9-99D5-5234CCB735AD}" = protocol=17 | dir=in | app=c:\program files\lexmark pro800-pro900 series\lxecfax.exe | 
"{19A39B9A-B2AC-46DE-BF69-C12722F7CDC5}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{1A7CD527-B28B-47B1-90C0-CC16E8E16425}" = protocol=17 | dir=in | app=c:\users\dirk\appdata\local\temp\lxdf\wireless\german\lxdfwpss.exe | 
"{1D6B1510-580E-40E8-897A-CE81F4A777BE}" = protocol=6 | dir=in | app=c:\program files\lexmark pro800-pro900 series\lxecfax.exe | 
"{1FE34031-513A-4179-82EB-D90EE053F6C5}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{1FF54A82-0E5B-416E-99FD-6B358518A04B}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{24299B42-6FEC-4985-BCBE-87AB69BC247E}" = protocol=6 | dir=in | app=c:\program files\lexmark 6500 series\lxdfamon.exe | 
"{2E9B0FCD-33D7-425B-9E0E-D9CD9C0D4AB1}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{2F751AA9-C631-48FB-8A0F-1546DFB4916E}" = protocol=17 | dir=in | app=c:\program files\lexmark 6500 series\wireless\lxdfwpss.exe | 
"{37534758-2CFE-4359-BC19-6C13F493C0DB}" = protocol=17 | dir=in | app=c:\program files\lexmark 6500 series\frun.exe | 
"{3CD0EB47-92EA-415A-89CA-3104C215AB99}" = protocol=6 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{3E2EA079-160C-47FC-89CE-EEAAE9A21329}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe | 
"{4404E995-CFC7-4252-8A14-7D83535182BA}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{4A776384-B704-4365-A341-03CC2230661F}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{4BC68465-D570-49FD-A3C1-8FBDD994B656}" = protocol=6 | dir=in | app=c:\program files\lexmark 6500 series\lxdffax.exe | 
"{512B6109-792B-450B-8E58-C171306A678A}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{556057A4-E6F4-4B33-93FC-EC7FECBA7C8B}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdfjswx.exe | 
"{5F6B9488-029B-4F8D-9F1D-2AD6697B98CB}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{6081818D-4975-41FC-A9AA-73E40E224B0E}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{649C8FFA-94DE-4525-897C-6F3965669BD0}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdfpswx.exe | 
"{6F2E2273-3D7B-4327-90BB-F05B2048C624}" = protocol=6 | dir=in | app=c:\program files\lexmark 6500 series\wireless\lxdfwpss.exe | 
"{6F4C299D-06DB-4507-8786-6D737C76DB74}" = protocol=17 | dir=in | app=c:\program files\lexmark 6500 series\lxdfmon.exe | 
"{762AE388-9024-428A-B817-A73259AFB7E4}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{7DBA2D8F-18FB-4776-AC63-72307C9E727D}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{8108F220-0341-44A0-8809-3A47CFDDE8B9}" = protocol=17 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{8166A4EF-853C-4C2F-9C29-56EC475A0A80}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe | 
"{829FCA3A-5A62-4017-A5AA-F598211760F6}" = dir=in | app=c:\program files\cyberlink\tv enhance\tvenhance.exe | 
"{86726C34-CCEF-4B5E-AF83-75E803D043E7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{87D52BF9-BA63-4938-8512-E67879D761CA}" = protocol=17 | dir=in | app=c:\windows\system32\lxdfcfg.exe | 
"{91248B9E-EEBD-4006-A591-2799AF239F9E}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdftime.exe | 
"{95C90F14-F5B0-44DE-A15F-4BDEB7519465}" = protocol=17 | dir=in | app=c:\program files\lexmark 6500 series\lxdffax.exe | 
"{982E0CA5-B757-436B-B78D-67649C945970}" = protocol=6 | dir=in | app=c:\program files\lexmark 6500 series\lxdfmon.exe | 
"{985B50ED-6BE8-4765-8FD0-D538A548593F}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe | 
"{99C29138-6515-4ADE-AE33-18E96DB3C468}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdftime.exe | 
"{A709B00C-23B0-4F79-A03F-DA7F54812FE5}" = dir=in | app=c:\program files\cyberlink\tv enhance\tveservice.exe | 
"{ACCD0D87-F05D-4872-86ED-6638A3442111}" = protocol=6 | dir=in | app=c:\windows\system32\lxdfcfg.exe | 
"{AE62E146-DAD8-4CE3-A931-175F367CA0B9}" = protocol=6 | dir=in | app=c:\users\dirk\appdata\local\temp\lxdf\wireless\german\lxdfwpss.exe | 
"{AFC37C7D-AACD-4076-9F1F-6CF6EF0B450C}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"{B3C43553-9DAC-469E-9E3C-194F15A980E3}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"{BEAD9E02-365F-4602-8C2C-9C3EBC1B0E45}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdfjswx.exe | 
"{CF7BC0B1-4DEF-4F29-9358-3DE582B30ECF}" = protocol=17 | dir=in | app=c:\program files\logitech\vid hd\vid.exe | 
"{D17D3C84-7013-4CA0-8EB0-7D2D0E3B357F}" = protocol=6 | dir=in | app=c:\program files\lexmark 6500 series\frun.exe | 
"{D5E9DEF9-B7D2-41B8-82CA-3716898DA0EE}" = protocol=17 | dir=in | app=c:\program files\aol 9.0 vr\waol.exe | 
"{D68B0B1E-0F17-46EA-B0DD-EAE3E656D1E1}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | 
"{D9285951-99CF-461A-A2C9-F2DF76AA14DB}" = dir=in | app=c:\windows\system32\lxeccoms.exe | 
"{DAA8B399-6CF7-46AE-B712-4DD5565966B1}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe | 
"{E6D775BF-CCE3-414B-8E42-90D798A33ED9}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe | 
"{EE6E05F6-9240-4EC1-8588-0072C49A8D4D}" = protocol=6 | dir=in | app=c:\windows\system32\lxdfcoms.exe | 
"{F121AF88-011A-4938-B8E3-4E04680AC181}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{F1334107-C5CD-429D-BE55-118EE2FF9E5B}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe | 
"{F76D7706-B2D2-43B5-8C62-30162543365F}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdfpswx.exe | 
"{F7F741DA-4E1C-43D1-9097-A9B0B2D1A129}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe | 
"{F84F64DB-BDFB-4F2F-8787-65BC2FE99BA2}" = protocol=6 | dir=in | app=c:\program files\abbyy finereader 6.0 sprint\scan\scanman6.exe | 
"{FCF00565-EB86-46F0-818E-FFBF3A0D9D33}" = dir=in | app=c:\windows\system32\lxeccoms.exe | 
"{FF48138C-55A4-4C68-8B3B-23AE71BBDD97}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe | 
"TCP Query User{DEBA5BC2-2BF7-4ED1-B8AC-83B23E3E7BC0}C:\program files\microsoft games\age of empires ii\empires2.icd" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires ii\empires2.icd | 
"TCP Query User{FA16AFA4-4C99-46AE-A80F-10767EBF7817}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{822D93B0-E901-48DA-AAFF-B13A0DEF5034}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{EBFA877B-C6A5-46C5-96CD-A43C9C3FCA6F}C:\program files\microsoft games\age of empires ii\empires2.icd" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires ii\empires2.icd | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00D0200F-3B4D-4A2F-869E-533ED835A943}" = Hervorhebe-Funktion (Windows Live Toolbar)
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07E4F3CE-A34E-4667-8DE9-147249FAE468}" = Mein Geld Professional
"{08BE0A17-0AB8-4B0C-88E2-EB1B4977A511}" = Lernwerkstatt 8
"{0AC49543-9CE2-4434-AD42-5AA6E2967FA5}" = Windows Live Toolbar
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{1148E85C-E1AF-48E0-A29C-68DACE07E054}" = Pro Evolution Soccer 2011
"{1A15507A-8551-4626-915D-3D5FA095CC1B}" = Corel Paint Shop Pro X
"{218761F6-CBF6-4973-B910-A33E6563A1EA}" = Windows Live Toolbar-Erweiterung (Windows Live Toolbar)
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 26
"{2B091530-69AA-442E-AB09-39ED06B58220}" = Windows Live Messenger
"{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34}" = Smart Menus (Windows Live Toolbar)
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AE51FB1-58D3-49A1-8C71-46616EB8DEC3}" = Marco Polo EuroRoute 2007
"{54971F17-9D16-4D43-95D6-3A86E3D20EDB}" = Office-Bibliothek 4.1
"{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}" = WordPerfect Office X3
"{581CE7EA-A30D-0000-A215-088635773309}" = Atheros AR5007 Wireless LAN - USB
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{600F0720-D5D6-4B3C-9D1D-A6D5813793D7}" = NVIDIA VISTA Kiosk
"{635EDAAB-BF20-414D-A87A-3D43BFA3EDB9}" = Targa VFD Display
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{710BF966-43C8-4216-A8EC-BC4E169FF7C1}" = MobileMe Control Panel
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites für Windows Live Toolbar
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7926B7E2-57EC-4ADC-9C9D-3627DB24C235}" = Redshift 7 Launcher
"{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6}" = Windows Live installer
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7F5A4EAD-FAB1-48BE-9EDF-A975FF7D1031}" = Nero 7 Essentials
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask.com Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A9B8148-DDD7-448F-BD6C-358386D32354}" = Corel Photo Album 6
"{8B92D97D-DB3D-4926-A8F7-718FE7C5EE18}" = iTunes
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Hama Wireless LAN Adapter
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90170407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{90510407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{910D3FB9-E341-4DD9-B52A-3B3C0C340AF6}" = Angry Birds
"{A08BAD08-9AA3-410F-98F3-C92C8EE37218}" = Safari
"{A7A67796-6D49-4DE3-8B37-A618E5DCFB01}" = Himmelsjahr 2012
"{A8DB611A-D80E-450D-85F6-3ACDD164BE31}" = Pro Evolution Soccer 2009
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{AC86ECA1-FA14-11D1-B4F6-00609781F44C}" = Der Brockhaus multimedial
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B0098545-64BC-44DA-96D2-E2916935067C}" = Toggolino Sachabenteuer
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC4BBCBA-89F6-47C3-9B0F-5CE5BB1C316C}" = WEB.DE Toolbar MSVC100 CRT x86
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark 
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow! 1.0
"{DA7DF8E2-4B8F-4286-97FE-DE3FFFE9B728}" = iCloud
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Codeur Windows Media Série 9
"{E4C891D6-6844-41B8-86E8-633CACCC644F}" = TV Enhance
"{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster 2010
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EDC66A92-4603-4D72-B28C-570075B55DF0}" = USB Wireless Keyboard Driver
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = WEB.DE Softwareaktualisierung
"1&1 Mail & Media GmbH Toolbar FF" = WEB.DE Toolbar für Mozilla Firefox
"1&1 Mail & Media GmbH Toolbar IE8" = WEB.DE Toolbar für Internet Explorer
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Mythology 1.0" = Age of Mythology
"AOL Deinstallation" = AOL Deinstallation
"Bauskript Software 2009-12 Standard" = Bauskript Software 2009-12 Standard
"Cheat Engine 5.6.1_is1" = Cheat Engine 5.6.1
"Cheat Engine 6.0_is1" = Cheat Engine 6.0
"CheckStage2" = CheckStage2 Version 1.0 
"CToolbar_UNINSTALL" = Crawler Toolbar with Web Security Guard
"DasTelefonbuch Deutschland" = DasTelefonbuch Deutschland
"DivX Codec" = DivX Codec
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.7.804
"FUSSBALL MANAGER 12" = FUSSBALL MANAGER 12
"InstallShield_{08BE0A17-0AB8-4B0C-88E2-EB1B4977A511}" = Lernwerkstatt 8
"InstallShield_{A7A67796-6D49-4DE3-8B37-A618E5DCFB01}" = Himmelsjahr 2012
"Intelli-studio" = SAMSUNG Intelli-studio
"IPIX ActiveX Viewer" = IPIX ActiveX Viewer
"IPIX Netscape Plugin Viewer" = IPIX Netscape Plugin Viewer
"IPIX Viewer" = IPIX Viewer
"Kleiner Eisbär 2" = Kleiner Eisbär 2
"LetsTrade" = LetsTrade Komponenten
"Lexmark 6500 Series" = Lexmark 6500 Series
"Lexmark Pro800-Pro900 Series" = Lexmark Pro800-Pro900 Series
"lgx4.lgx.server" = G DATA Logox4 Speechengine
"LIDL Fotoservice_is1" = LIDL Fotoservice
"Logitech Vid" = Logitech Vid HD
"lvdrivers_12.10" = Logitech Webcam Software-Treiberpaket
"MAGIX Music Maker 2008 Producer Edition D" = MAGIX Music Maker 2008 Producer Edition 13.0.0.16 (D)
"MAGIX PC Visit D" = MAGIX PC Visit
"McDonald's Dragons " = McDonald's Dragons
"McDonald's Fairies " = McDonald's Fairies
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 8.0.1 (x86 de)" = Mozilla Firefox 8.0.1 (x86 de)
"Mufin MusicFinder D" = Mufin MusicFinder 1.0.0.217 (D)
"NIS" = Norton Internet Security
"NVIDIA Drivers" = NVIDIA Drivers
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"TeamViewer 6" = TeamViewer 6
"TomTom HOME" = TomTom HOME 2.7.3.1894
"Trillian" = Trillian
"Viewpoint Manager" = Viewpoint Manager (Remove Only)
"Viewpoint Toolbar" = Viewpoint Toolbar
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Live Toolbar" = Windows Live Toolbar
"Windows Media Encoder 9" = Codeur Windows Media Série 9
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Europa Casino" = Europa Casino
"Google Chrome" = Google Chrome
"Kellogg's Clip Studio" = Kellogg's Clip Studio
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"UnityWebPlayer" = Unity Web Player
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         

--- --- ---

C. Alle Programme geschlossen und Quick Scan ausgeführt.
Aufgrund zu großer Daten Menge nicht dabei. Falls notwendig
melden.



Ich hoffe Ihr könnt was damit anfangen und mir helfen.
Falls was fehlt einfach melden.
Vielen Dank im Voraus

Gruß

DST

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [SkypePM] C:\Users\DIRK\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation)
 :Files
C:\Users\DIRK\AppData\Local\Skype
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Hallo markusg,

einfach sensationell genial. Vielen Dank für die tolle und schnelle Hilfe.
Bisher hat alles Einwandfrei geklappt.
Von mir für Dich dazu 5 Sterne pus Zusatz Stern.
Anbei wie von Dir gewünscht das Skript. Ich werde danach versuchen, wie von Dir beschrieben, die Movedfiles zu hinterlegen.
Auf jeden Fall werde ich euch auch weiter empfehlen.

Wenn was fehlt bitte melden.
Ich wünsche Dir einen schönen Abend.

Gruß
DST


All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SkypePM deleted successfully.
C:\Users\DIRK\AppData\Local\Skype\SkypePM.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default

User: Default User

User: DIRK
->Flash cache emptied: 513 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: DIRK
->Temp folder emptied: 482686308 bytes
->Temporary Internet Files folder emptied: 16832553 bytes
->Java cache emptied: 79577139 bytes
->FireFox cache emptied: 554901418 bytes
->Google Chrome cache emptied: 113662085 bytes
->Apple Safari cache emptied: 8974336 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 4669 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 195178018 bytes
RecycleBin emptied: 300448 bytes

Total Files Cleaned = 1.385,00 mb


OTL by OldTimer - Version 3.2.39.2 log created on 03272012_194047

Files\Folders moved on Reboot...

danke für den upload

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hi,

habe alles so wie von dir beschrieben ausgeführt.
Hatte dabei wärend der Ausführung folgende Meldung.

- PEV.3Xe funktioniert nicht mehr.Programm wird geschlossen.
Wenn eine Lösung gefunden wird werde ich informiert.

Weis nicht ob das was zu sagen hat? Ansonsten hat aus meiner
Sicht alles geklappt.

Anbei Combofix Logfile.

Combofix Logfile:

ComboFix 12-03-28.01 - DIRK 28.03.2012  16:03:10.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.931 [GMT 2:00]
ausgeführt von:: c:\users\DIRK\Downloads\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\SPL1932.tmp
c:\programdata\SPL3C68.tmp
c:\programdata\SPL4CBF.tmp
c:\programdata\SPL6971.tmp
c:\programdata\SPL6BC2.tmp
c:\programdata\SPL947.tmp
c:\programdata\SPL9F0F.tmp
c:\programdata\SPL9F98.tmp
c:\programdata\SPLA2C8.tmp
c:\programdata\SPLAAB2.tmp
c:\programdata\SPLB125.tmp
c:\windows\IsUn0407.exe
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_usnjsvc
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-02-28 bis 2012-03-28  ))))))))))))))))))))))))))))))
.
.
2012-03-28 14:19 . 2012-03-28 14:19	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-03-27 17:40 . 2012-03-27 18:39	--------	d-----w-	C:\_OTL
2012-03-18 10:13 . 2012-01-31 10:59	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
2012-03-18 10:13 . 2012-02-02 15:16	2044416	----a-w-	c:\windows\system32\win32k.sys
2012-03-18 10:13 . 2012-02-14 15:45	219648	----a-w-	c:\windows\system32\d3d10_1core.dll
2012-03-18 10:13 . 2012-02-14 15:45	160768	----a-w-	c:\windows\system32\d3d10_1.dll
2012-03-18 10:13 . 2012-02-13 14:12	1172480	----a-w-	c:\windows\system32\d3d10warp.dll
2012-03-18 10:13 . 2012-02-13 13:47	683008	----a-w-	c:\windows\system32\d2d1.dll
2012-03-18 10:13 . 2012-02-13 13:44	1068544	----a-w-	c:\windows\system32\DWrite.dll
2012-03-18 10:12 . 2012-01-09 15:54	613376	----a-w-	c:\windows\system32\rdpencom.dll
2012-03-18 10:12 . 2012-01-09 13:58	180736	----a-w-	c:\windows\system32\drivers\rdpwd.sys
2012-03-10 12:21 . 2012-03-10 12:21	--------	d-----w-	c:\program files\iPod
2012-03-03 14:51 . 1998-04-23 23:00	368912	----a-w-	c:\windows\system32\VBAR332.DLL
2012-03-03 14:50 . 2012-03-03 14:50	--------	d-----w-	c:\program files\Maris Technologies
2012-03-03 14:48 . 2003-02-27 15:12	696320	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2012-03-03 14:48 . 2002-12-05 13:10	155648	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2012-03-03 14:48 . 2002-12-02 14:22	5632	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2012-03-03 14:48 . 2002-12-02 12:33	57344	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2012-03-03 14:48 . 2002-12-02 12:33	237568	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2012-03-03 14:48 . 2012-03-03 14:48	282756	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2012-03-03 14:48 . 2012-03-03 14:48	163972	----a-w-	c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2012-03-03 14:42 . 2012-03-03 14:42	--------	d-----w-	c:\program files\Kosmos
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-29 06:55 . 2011-05-20 05:48	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-15 10:01 . 2012-02-15 10:01	4547944	----a-w-	c:\windows\system32\usbaaplrc.dll
2012-02-15 10:01 . 2012-02-15 10:01	43520	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2011-12-05 19:20 . 2011-05-18 16:44	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2011-05-09 09:49	176936	----a-w-	c:\program files\DVDVideoSoftTB\prxtbDVD0.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF42D4A8-016E-4fcd-B1EB-837659FD77C6}]
2012-02-02 18:11	1602664	----a-w-	c:\program files\WEB.DE Toolbar\IE\uitb.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2008-10-21 11:13	741768	----a-w-	c:\program files\Ask.com\Supertoolbar\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\Supertoolbar\GenericAskToolbar.dll" [2008-10-21 741768]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-05-09 176936]
"{C424171E-592A-415a-9EB1-DFD6D95D3530}"= "c:\program files\WEB.DE Toolbar\IE\uitb.dll" [2012-02-02 1602664]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{c424171e-592a-415a-9eb1-dfd6d95d3530}]
[HKEY_CLASSES_ROOT\uitb.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{99F77431-0658-476F-99CE-A05F35CDC7BA}]
[HKEY_CLASSES_ROOT\uitb.Toolbar]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-05-09 176936]
"{C424171E-592A-415A-9EB1-DFD6D95D3530}"= "c:\program files\WEB.DE Toolbar\IE\uitb.dll" [2012-02-02 1602664]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{c424171e-592a-415a-9eb1-dfd6d95d3530}]
[HKEY_CLASSES_ROOT\uitb.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{99F77431-0658-476F-99CE-A05F35CDC7BA}]
[HKEY_CLASSES_ROOT\uitb.Toolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-11-13 247144]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2008-11-18 21633320]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"Logitech Vid"="c:\program files\Logitech\Vid HD\Vid.exe" [2011-01-13 6129496]
"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TVEService"="c:\program files\CyberLink\TV Enhance\TVEService.exe" [2007-05-08 155648]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-12-06 69216]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"MoLed"="ModLEDKey.exe" [2006-11-09 53248]
"lxdfmon.exe"="c:\program files\Lexmark 6500 Series\lxdfmon.exe" [2007-06-11 455600]
"lxdfamon"="c:\program files\Lexmark 6500 Series\lxdfamon.exe" [2007-06-01 20480]
"Lexmark 6500 Series Fax Server"="c:\program files\Lexmark 6500 Series\fm3032.exe" [2007-06-11 308144]
"ledpointer"="CNYHKey.exe" [2006-11-09 5585408]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"HostManager"="c:\program files\Common Files\AOL\1177927144\ee\AOLSoftware.exe" [2006-11-14 50736]
"Corel Photo Downloader"="c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe" [2007-02-21 112208]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"lxecmon.exe"="c:\program files\Lexmark Pro800-Pro900 Series\lxecmon.exe" [2011-01-24 770728]
"EzPrint"="c:\program files\Lexmark Pro800-Pro900 Series\ezprint.exe" [2011-01-24 148280]
"Lexmark Pro800-Pro900 Series Fax Server"="c:\program files\Lexmark Pro800-Pro900 Series\fm3032.exe" [2011-01-24 316072]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
.
c:\users\DIRK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Trillian.lnk - c:\program files\Trillian\trillian.exe [2008-11-26 1873280]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
DasTelefonbuch Browserlösung.lnk - c:\program files\TVG\DasTelefonbuch Deutschland\http_tfd.exe [2007-4-30 18912]
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2010-2-25 1597440]
Targa VFD Display.lnk - c:\windows\Installer\{635EDAAB-BF20-414D-A87A-3D43BFA3EDB9}\_240FB530969C6B2372E60D.exe [2007-4-30 11166]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R3 3xHybrid;ASUSTek SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2006-10-27 2814080]
S2 acedrv10;acedrv10;c:\windows\system32\drivers\acedrv10.sys [2007-07-27 330144]
S2 acehlp10;acehlp10;c:\windows\system32\drivers\acehlp10.sys [2007-07-27 251680]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2008-06-19 c:\windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 09:20]
.
2012-03-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1415130864-2451929093-3127007980-1001Core.job
- c:\users\DIRK\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-15 07:56]
.
2012-03-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1415130864-2451929093-3127007980-1001UA.job
- c:\users\DIRK\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-15 07:56]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - hxxp://favorites.live.com/quickadd.aspx
IE: Crawler Search - tbr:iemenu
IE: Free YouTube to MP3 Converter - c:\users\DIRK\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Öffnen mit WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta
Trusted Zone: maris.com\www.redshift
TCP: DhcpNameServer = 192.168.2.1
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - c:\program files\WEB.DE Toolbar\IE\uitb.dll
DPF: {BF3CD111-6278-11D2-9EA3-00A0C9251384} - hxxp://www.o2c.de/download/O2CPlayer.CAB
FF - ProfilePath - c:\users\DIRK\AppData\Roaming\Mozilla\Firefox\Profiles\3pgw7tyx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - DVDVideoSoftTB Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60452&qkw=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-AuditVista - (no file)
.
.
.
**************************************************************************
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1415130864-2451929093-3127007980-1001\Software\AppDataLow\Software\Conduit\Community Alerts\Settings\Locales\e*n**m–M+4]
"LP_LastUpdateTime"="0"
"LP_LastCheckTime"=dword:4eb996ad
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\spool\DRIVERS\W32X86\3\lxdfserv.exe
c:\windows\system32\lxdfcoms.exe
c:\windows\system32\lxeccoms.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
c:\windows\system32\PSIService.exe
c:\program files\Hama\Common\RalinkRegistryWriter.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\TeamViewer\Version6\TeamViewer_Service.exe
c:\program files\TomTom HOME 2\TomTomHOMEService.exe
c:\program files\CyberLink\TV Enhance\Kernel\TV\TVECapSvc.exe
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
c:\windows\system32\WUDFHost.exe
c:\program files\TeamViewer\Version6\TeamViewer.exe
c:\program files\CyberLink\TV Enhance\Kernel\TV\TVESched.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\conime.exe
c:\windows\ModLEDKey.exe
c:\windows\CNYHKey.exe
c:\program files\Windows Media Player\wmplayer.exe
c:\program files\Targa VFD Display\Targa VFD Display.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Apple\Apple Application Support\distnoted.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\ehome\mcupdate.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-28  16:33:59 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-28 14:33
.
Vor Suchlauf: 14 Verzeichnis(se), 380.559.413.248 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 381.258.657.792 Bytes frei
.
- - End Of File - - 34DD204FD615F353EE49B8A10CC74AF2
         

--- --- ---

nö scheint alles geklappt zu haben.
malwarebytes:
Downloade Dir bitte Malwarebytes

• Installiere
  das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche
  nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet
  ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste
  das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Hi,

habe alles so wie von dir beschrieben ausgeführt.
6 infizierte Dateien wurden gefunden die ich dann gelöscht habe.
Aus meiner Sicht alles soweit gut geklappt.

Gruß
DST

Anbei mbam-log.

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.30.02

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
DIRK :: DIRK-PC [Administrator]

30.03.2012 09:22:34
mbam-log-2012-03-30 (09-22-34).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 499517
Laufzeit: 3 Stunde(n), 39 Minute(n), 40 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Europa Casino (PUP.Casino) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 5
C:\Windows\Installer\{90110407-6000-11D3-8CFE-0150048383C9}\misc.exe (Backdoor.Bifrose) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{90170407-6000-11D3-8CFE-0150048383C9}\misc.exe (Backdoor.Bifrose) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\{90510407-6000-11D3-8CFE-0150048383C9}\misc.exe (Backdoor.Bifrose) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\03272012_194047\C_Users\DIRK\AppData\Local\Skype\SkypePM.exe (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Casino\Europa Casino\_SetupCasino_6ec454_de[1].exe (PUP.Casino) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

hi

lade den CCleaner standard:
CCleaner Download - CCleaner 3.17.1689
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.