Hallo liebe Community,

auch ich habe mir diesen GEMA Virus eingefangen, und habe mir die verschiedenen Loesungsvorschlaege angesehen und habe sie ausprobiert. Funktioniert hat es soweit dass ich mir das OTLPE auf CD gebrannt habe und jetzt habe ich die Ergebnisse vom OTL.txt vorliegen.
Ich hoffe ihr koennt damit was anfangen und mir helfen, dass ich jedenfalls meine Dateien sichern koennte ...

Mir fehlt jedoch die extras.txt, die kann ich nicht finden?

Vielen Dank im Voraus!






OTL logfile created on: 4/5/2012 12:36:38 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 84.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 127.99 Gb Total Space | 5.39 Gb Free Space | 4.21% Space Free | Partition Type: NTFS
Drive D: | 337.77 Gb Total Space | 224.21 Gb Free Space | 66.38% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand] -- -- (WinDefend)
SRV - File not found [Auto] -- -- (MSCamSvc)
SRV - [2012/03/21 06:51:31 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/03/12 13:58:05 | 000,918,880 | ---- | M] () [Auto] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\10.2.0\ToolbarUpdater.exe -- (vToolbarUpdater10.2.0)
SRV - [2011/11/10 09:17:31 | 000,167,264 | ---- | M] () [On_Demand] -- C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2011/08/03 07:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/08/02 21:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011/07/20 00:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2010/09/22 11:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010/09/21 09:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto] -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010/07/21 05:18:14 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)
SRV - [2010/07/17 06:04:35 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)
SRV - [2010/02/11 07:42:32 | 000,172,328 | ---- | M] (TeamViewer GmbH) [Auto] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009/12/16 13:26:00 | 003,453,712 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2009/09/25 21:31:58 | 000,149,336 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009/08/10 09:59:50 | 000,178,720 | ---- | M] () [Auto] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2009/08/10 09:59:48 | 000,387,616 | ---- | M] () [Auto] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2009/07/28 10:07:42 | 000,073,528 | ---- | M] (AVM Berlin) [Auto] -- C:\Program Files\FRITZ!DSL\IGDCTRL.EXE -- (IGDCTRL)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (ManyCam)
DRV - File not found [Kernel | On_Demand] -- -- (kbeepm)
DRV - [2011/09/13 10:07:17 | 000,029,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- C:\Windows\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2011/08/03 07:50:00 | 010,304,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011/05/06 04:08:50 | 000,243,152 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2010/12/13 08:37:46 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/07/17 06:03:57 | 000,216,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010/04/08 19:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2010/03/29 15:15:53 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009/11/11 09:47:16 | 000,295,272 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009/11/09 13:12:42 | 000,025,088 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV - [2009/11/02 10:29:48 | 000,281,760 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009/11/02 10:29:48 | 000,025,888 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009/07/13 18:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009/03/18 11:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/10/21 04:22:48 | 000,114,600 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017mdm.sys -- (s0017mdm)
DRV - [2008/10/21 04:22:48 | 000,109,736 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017unic.sys -- (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM)
DRV - [2008/10/21 04:22:48 | 000,108,328 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017mgmt.sys -- (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM)
DRV - [2008/10/21 04:22:48 | 000,104,616 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017obex.sys -- (s0017obex)
DRV - [2008/10/21 04:22:48 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017bus.sys -- (s0017bus) Sony Ericsson Device 0017 driver (WDM)
DRV - [2008/10/21 04:22:48 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017nd5.sys -- (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS)
DRV - [2008/10/21 04:22:48 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\s0017mdfl.sys -- (s0017mdfl)
DRV - [2008/06/01 03:13:10 | 000,034,064 | ---- | M] (CACE Technologies) [Kernel | Auto] -- C:\Windows\System32\drivers\npf.sys -- (npf)
DRV - [2007/01/23 10:44:00 | 000,020,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2005/11/03 10:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005/08/10 08:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005/05/16 09:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004/12/03 06:20:41 | 000,020,544 | ---- | M] (Protection Technology) [Kernel | Boot] -- C:\Windows\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x)
DRV - [2004/05/17 05:21:54 | 000,017,280 | ---- | M] (Intellon, Inc.) [Kernel | Auto] -- C:\Windows\system32\plcndis5.sys -- (PLCNDIS5)
DRV - [2003/04/18 19:32:04 | 000,004,736 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\tandpl.sys -- (tandpl)
DRV - [2003/03/02 12:44:26 | 000,007,552 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\enodpl.sys -- (enodpl)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = ${URL_SEARCHPAGE}
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2096149
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3B 67 DC 8B B5 81 CA 01 [binary data]
IE - HKU\Administrator_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Administrator_ON_C\..\URLSearchHook: {69b6939f-c70d-45c5-9bbd-e2e2cc3dd8e5} - Reg Error: Key error. File not found
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\Mcx1-PIK-ROYAL-PC_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 9C E6 56 10 00 EF CA 01 [binary data]
IE - HKU\Pik-Royal_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\Pik-Royal_ON_C\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Pik-Royal_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid=%7B196608a0-1da8-4fac-85f7-0ba9c4da54d7%7D&mid=191fd291985f758639ab4cd64bc10603-d666df2a23e0ffd552c16dbf9714f8d23766b908&ds=AVG&v=10.2.0.3&lang=de&pr=fr&d=2011-12-07%2010%3A26%3A55&sap=ku&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Pik-Royal\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\support@predictad.com: C:\Program Files\AutocompletePro\support@predictad.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\10.2.0.3\ [2012/03/12 13:58:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 2\components [2012/03/30 16:43:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 2\plugins [2012/03/30 16:43:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: E:\Program Files\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: E:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Components: E:\Program Files\Mozilla Thunderbird\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 10.0.1\extensions\\Plugins: E:\Program Files\Mozilla Thunderbird\plugins

[2009/10/23 08:14:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Extensions
[2012/03/23 12:10:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\extensions
[2011/04/18 15:48:04 | 000,002,059 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\daemon-search.xml
[2012/03/29 12:08:46 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-2.xml
[2010/04/20 04:10:15 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-3.xml
[2010/06/28 18:02:58 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-4.xml
[2010/07/01 05:06:53 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-5.xml
[2010/07/15 06:39:41 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-6.xml
[2010/07/25 05:33:14 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-7.xml
[2010/08/04 13:41:41 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin-8.xml
[2009/12/10 05:50:44 | 000,000,947 | ---- | M] () -- C:\Users\Pik-Royal\AppData\Roaming\Mozilla\Firefox\Profiles\gedgzxy9.default\searchplugins\icqplugin.xml
File not found (No name found) --
[2012/03/12 13:58:23 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\PROGRAMDATA\AVG SECURE SEARCH\10.2.0.3
() (No name found) -- C:\USERS\PIK-ROYAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GEDGZXY9.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI
() (No name found) -- C:\USERS\PIK-ROYAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GEDGZXY9.DEFAULT\EXTENSIONS\TESTPILOT@LABS.MOZILLA.COM.XPI

O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O2 - BHO: (no name) - {d2350351-c7d6-e908-7405-4e22016c1513} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\Pik-Royal_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\Pik-Royal_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [gema] C:\Windows\System32\gema.exe (Veoj)
O4 - HKLM..\Run: [gema.] C:\ProgramData\gema\gema.exe (Veoj)
O4 - HKLM..\Run: [LifeCam] File not found
O4 - HKLM..\Run: [ROC_roc_dec12] File not found
O4 - HKLM..\Run: [vProt] File not found
O4 - HKU\.DEFAULT..\Run: [FRITZ!protect] File not found
O4 - HKU\Administrator_ON_C..\Run: [EA Core] File not found
O4 - HKU\Administrator_ON_C..\Run: [gema] C:\Users\Administrator\AppData\Roaming\gema\gema.exe (Veoj)
O4 - HKU\Administrator_ON_C..\Run: [msnmsgr] File not found
O4 - HKU\Administrator_ON_C..\Run: [RGSC] File not found
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] File not found
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] File not found
O4 - HKU\Pik-Royal_ON_C..\Run: [gema] C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe (Veoj)
O4 - HKU\Pik-Royal_ON_C..\Run: [MobileDocuments] C:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\UpdatusUser_ON_C..\Run: [Sidebar] File not found
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\Mcx1-PIK-ROYAL-PC_ON_C..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG9\Notification\SPChecker1.exe ()
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 1
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - File not found
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\10.2.0\ViProtocol.dll ()
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\ProgramData\gema\gema.exe) - C:\ProgramData\gema\gema.exe (Veoj)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\gema.exe) - C:\Windows\System32\gema.exe (Veoj)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Administrator_ON_C Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\gema\gema.exe) - C:\Users\Administrator\AppData\Roaming\gema\gema.exe (Veoj)
O20 - HKU\Administrator_ON_C Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Pik-Royal_ON_C Winlogon: Shell - (C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe) - C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe (Veoj)
O20 - HKU\Pik-Royal_ON_C Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{13745413-c882-11de-91fe-00044b16a369}\Shell - "" = AutoRun
O33 - MountPoints2\{4f502308-df9f-11e0-aaf1-00044b16a369}\Shell - "" = AutoRun
O33 - MountPoints2\{4f502308-df9f-11e0-aaf1-00044b16a369}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{add1f55e-c98d-11e0-b00f-00044b16a369}\Shell - "" = AutoRun
O33 - MountPoints2\{add1f55e-c98d-11e0-b00f-00044b16a369}\Shell\AutoRun\command - "" = F:\aubi.exe
O33 - MountPoints2\{de006ac7-bf5b-11de-a0f3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{de006ac7-bf5b-11de-a0f3-806e6f6e6963}\Shell\AutoRun\command - "" = D:\reatogoMenu.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/03/31 15:53:16 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\gema
[2012/03/31 15:49:43 | 000,237,568 | ---- | C] (Veoj) -- C:\Windows\System32\gema.exe
[2012/03/31 12:37:14 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Roaming\gema
[2012/03/31 12:37:14 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
[2012/03/30 16:49:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/03/28 17:46:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows
[2012/03/14 19:51:24 | 000,000,000 | ---D | C] -- C:\c536818869ea40f56aef0e9e2f7f
[2012/03/14 19:50:01 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/03/14 19:50:01 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/03/14 19:44:59 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{2F4F6F6C-168E-4847-8B85-57B47A2FA6D8}
[2012/03/14 19:44:37 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{05E7B1A6-B6CD-4F8D-91C1-310D61E6294B}
[2012/03/14 15:51:53 | 002,343,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/03/14 15:51:52 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012/03/14 11:50:20 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{C12441CE-6460-4621-9C49-CFE785399BB0}
[2012/03/14 11:49:39 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{B42B40CF-ABAA-4E15-9810-183D7B9443CD}
[2012/03/14 11:48:58 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{BF3EE700-B7B8-477B-A532-6FDEB2DA9C46}
[2012/03/14 11:41:25 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012/03/14 11:41:25 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012/03/14 11:41:25 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012/03/14 11:40:49 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012/03/11 15:32:23 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2012/03/11 14:50:00 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{7B533C81-28B9-4CCE-9B13-E04EACB61163}
[2012/03/11 14:49:29 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{B1D7529A-670F-4D3A-A949-91587B8FCC45}
[2012/03/10 07:23:07 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\Desktop\Deutsch
[2012/03/09 15:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Logs
[2012/03/09 15:21:32 | 000,000,000 | -H-D | C] -- C:\Program Files\Common Files\EAInstaller
[2012/03/09 15:21:31 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_7.dll
[2012/03/09 15:21:31 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_7.dll
[2012/03/09 15:21:31 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_5.dll
[2012/03/09 15:21:30 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll
[2012/03/09 15:21:30 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_43.dll
[2012/03/09 15:21:30 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_43.dll
[2012/03/09 15:21:30 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_43.dll
[2012/03/09 15:21:29 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll
[2012/03/09 14:26:31 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\Origin
[2012/03/09 14:24:51 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Roaming\Origin
[2012/03/09 13:57:06 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{1979B9D0-E361-4E8F-804A-4DC68D616F05}
[2012/03/09 13:56:39 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{E55A1E54-470E-47B8-B861-307765FC41EC}
[2012/03/08 11:40:32 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{063C97A0-60EA-491F-AA3B-D42F6B0199A2}
[2012/03/08 11:40:07 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{76A797B8-54FE-4ECB-9060-FC11331AF2E6}
[2012/03/07 16:24:29 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Local\{E684F488-70BE-46BB-9F35-E4F10F944EDB}
[6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/05 05:04:30 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/05 05:04:30 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/05 05:04:00 | 002,770,278 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/04/05 05:04:00 | 000,796,418 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/04/05 05:04:00 | 000,299,742 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/05 05:04:00 | 000,037,606 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/05 04:56:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/05 04:56:40 | 1609,461,760 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/01 16:33:08 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012/03/31 12:41:14 | 000,001,053 | ---- | M] () -- C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/03/31 12:37:13 | 000,237,568 | ---- | M] (Veoj) -- C:\Windows\System32\gema.exe
[2012/03/31 11:31:45 | 000,413,216 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/03/31 09:28:12 | 000,210,166 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch.pdf
[2012/03/31 09:28:12 | 000,210,166 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch - Kopie.pdf
[2012/03/31 09:28:03 | 000,140,422 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster.pdf
[2012/03/31 09:28:03 | 000,140,422 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster - Kopie.pdf
[2012/03/31 09:27:55 | 000,181,444 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx.pdf
[2012/03/31 09:27:55 | 000,181,444 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx - Kopie.pdf
[2012/03/31 09:27:43 | 000,419,467 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900.pdf
[2012/03/31 09:27:43 | 000,419,467 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900 - Kopie.pdf
[2012/03/31 09:27:41 | 000,465,370 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800.pdf
[2012/03/31 09:27:41 | 000,465,370 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800 - Kopie.pdf
[2012/03/31 09:27:03 | 000,323,277 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation.pdf
[2012/03/31 09:27:03 | 000,323,277 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation - Kopie.pdf
[2012/03/31 05:44:19 | 076,426,081 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2012/03/30 16:49:09 | 000,001,672 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/03/30 16:49:09 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/03/22 13:59:22 | 000,673,894 | ---- | M] () -- C:\Users\Pik-Royal\Desktop\Einschulung II 001.jpg
[2012/03/11 15:26:16 | 000,001,099 | ---- | M] () -- C:\Users\Public\Desktop\Mass Effect 3.lnk
[2012/03/11 15:26:03 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/03/09 14:24:50 | 000,000,821 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[6 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/03/31 11:31:31 | 000,413,216 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/03/31 09:33:00 | 000,465,370 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800 - Kopie.pdf
[2012/03/31 09:33:00 | 000,419,467 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900 - Kopie.pdf
[2012/03/31 09:33:00 | 000,323,277 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation - Kopie.pdf
[2012/03/31 09:33:00 | 000,210,166 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch - Kopie.pdf
[2012/03/31 09:33:00 | 000,181,444 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx - Kopie.pdf
[2012/03/31 09:33:00 | 000,140,422 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster - Kopie.pdf
[2012/03/31 09:28:09 | 000,210,166 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3-Semester_Reflexion_über_Sprache_und_Sprachgebrauch.pdf
[2012/03/31 09:27:59 | 000,140,422 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\Die_Geschichte_der_DDR_-_1._Semster.pdf
[2012/03/31 09:27:53 | 000,181,444 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\3.-Semester_Literatur_und_Sprache_von_1945_bis_zur_Gegenwartdocx.pdf
[2012/03/31 09:27:39 | 000,419,467 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\2-Semester_Literatur_und_Sprache_um_1900.pdf
[2012/03/31 09:27:36 | 000,465,370 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Literatur_und_Sprache_um_1800.pdf
[2012/03/31 09:26:58 | 000,323,277 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\1-Semester_Drama_und_Kommunikation.pdf
[2012/03/30 16:49:09 | 000,001,672 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012/03/23 08:45:26 | 002,276,746 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\CIMG9023.JPG
[2012/03/23 08:42:48 | 001,438,900 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\DSC_1888.JPG
[2012/03/22 14:08:08 | 000,673,894 | ---- | C] () -- C:\Users\Pik-Royal\Desktop\Einschulung II 001.jpg
[2012/03/11 15:26:16 | 000,001,099 | ---- | C] () -- C:\Users\Public\Desktop\Mass Effect 3.lnk
[2012/03/09 14:24:50 | 000,000,821 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2011/08/02 21:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe
[2011/06/21 05:52:56 | 000,252,928 | ---- | C] () -- C:\Windows\System32\DShowRdpFilter.dll
[2011/06/01 11:27:54 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
[2011/04/09 12:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011/02/18 11:09:27 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2011/02/13 14:02:21 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011/01/10 04:05:59 | 001,474,832 | ---- | C] () -- C:\Windows\System32\drivers\sfi.dat
[2010/07/28 15:25:58 | 000,036,864 | ---- | C] () -- C:\Windows\System32\LckFldService.exe
[2010/05/07 09:17:17 | 000,053,248 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010/04/27 12:28:10 | 000,000,008 | RHS- | C] () -- C:\ProgramData\72735B0F81.sys
[2010/04/27 12:28:09 | 000,002,516 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010/03/31 12:22:22 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010/03/21 12:36:16 | 000,007,552 | ---- | C] () -- C:\Windows\System32\drivers\enodpl.sys
[2010/03/21 12:36:16 | 000,004,736 | ---- | C] () -- C:\Windows\System32\drivers\tandpl.sys
[2010/02/01 10:47:04 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2010/02/01 10:47:04 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2010/01/29 16:21:22 | 000,003,584 | ---- | C] () -- C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/05 15:48:02 | 000,006,656 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/12/14 08:22:35 | 000,001,210 | ---- | C] () -- C:\Windows\eReg.dat
[2009/12/12 13:12:09 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2009/12/07 12:23:48 | 000,009,548 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2009/11/09 03:07:26 | 000,000,097 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Local\fusioncache.dat
[2009/10/24 09:35:38 | 000,000,017 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Local\resmon.resmoncfg
[2009/10/24 08:59:14 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009/10/24 08:59:13 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009/10/23 15:33:03 | 000,022,328 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009/10/23 15:33:03 | 000,022,328 | ---- | C] () -- C:\Users\Pik-Royal\AppData\Roaming\PnkBstrK.sys
[2009/10/23 15:32:40 | 000,107,832 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2009/10/23 15:32:37 | 002,337,865 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2009/10/23 15:32:37 | 000,066,872 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009/10/23 08:46:43 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009/07/14 04:47:43 | 002,770,278 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009/07/14 04:47:43 | 000,796,418 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009/07/14 04:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009/07/14 04:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:05:48 | 000,299,742 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,037,606 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2008/06/01 03:13:10 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2004/01/26 11:15:29 | 000,233,472 | R--- | C] () -- C:\Windows\System32\MafiaSetup.exe

========== LOP Check ==========

[2012/03/31 15:53:16 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\gema
[2010/01/29 15:45:40 | 000,000,000 | ---D | M] -- C:\Users\Administrator\AppData\Roaming\ICQ
[2011/06/05 12:30:26 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\.minecraft
[2011/07/25 16:59:45 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Advanced Chemistry Development
[2011/08/13 11:21:21 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Audacity
[2010/03/06 10:21:38 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Facebook
[2010/09/28 14:00:12 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\FreeAudioPack
[2011/07/23 13:03:19 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\FRITZ!
[2012/03/31 12:37:14 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\gema
[2010/01/23 10:40:58 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\gnupg
[2011/06/26 18:15:26 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\gtk-2.0
[2011/12/05 13:58:41 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\ICQ
[2011/06/13 09:54:49 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Opera
[2012/03/09 14:26:33 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Origin
[2011/04/18 10:06:22 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\PunkBuster
[2010/03/14 13:21:00 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\TeamViewer
[2011/12/13 14:40:01 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Thunderbird
[2011/08/24 09:25:00 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\TS3Client
[2009/12/06 08:14:44 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\Windows Live Writer
[2010/06/29 17:33:29 | 000,000,000 | ---D | M] -- C:\Users\Pik-Royal\AppData\Roaming\XRay Engine
[2010/10/29 09:58:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Advanced Chemistry Development
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/03/12 13:58:23 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG Secure Search
[2010/10/26 03:22:24 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG Security Toolbar
[2009/12/22 07:24:46 | 000,000,000 | ---D | M] -- C:\ProgramData\avg9
[2010/04/27 12:32:32 | 000,000,000 | ---D | M] -- C:\ProgramData\Bitstream
[2010/03/10 02:58:38 | 000,000,000 | ---D | M] -- C:\ProgramData\BVRP Software
[2011/07/25 07:15:58 | 000,000,000 | ---D | M] -- C:\ProgramData\Caphyon
[2011/03/15 05:18:08 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files
[2011/04/18 15:49:51 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2012/03/11 15:32:23 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Core
[2012/03/13 08:49:23 | 000,000,000 | ---D | M] -- C:\ProgramData\EA Logs
[2012/03/11 15:32:36 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/03/31 12:37:14 | 000,000,000 | ---D | M] -- C:\ProgramData\gema
[2010/01/05 11:15:32 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/07/25 06:30:36 | 000,000,000 | ---D | M] -- C:\ProgramData\IObit
[2010/12/25 08:01:09 | 000,000,000 | ---D | M] -- C:\ProgramData\MFAData
[2012/03/09 15:24:13 | 000,000,000 | ---D | M] -- C:\ProgramData\Origin
[2010/05/18 05:52:29 | 000,000,000 | ---D | M] -- C:\ProgramData\PIXELA
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010/04/05 09:58:45 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/08/06 13:08:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Ubisoft
[2009/10/22 18:50:59 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2012/03/30 08:39:18 | 000,000,000 | ---D | M] -- C:\ProgramData\Windows
[2010/10/23 12:40:03 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/03/02 14:03:55 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/02/28 10:52:19 | 000,000,472 | ---- | M] () -- C:\Windows\Tasks\Wise Registry Cleaner 4.job
[2009/12/21 18:22:07 | 000,000,248 | -H-- | M] () -- C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2009/12/21 18:23:29 | 000,000,296 | -H-- | M] () -- C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:05EE1EEF
< End of report >

hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

:OTL
O4 - HKU\Pik-Royal_ON_C..\Run: [gema] C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe (Veoj)
O4 - HKLM..\Run: [gema.] C:\ProgramData\gema\gema.exe (Veoj)
O4 - HKLM..\Run: [gema] C:\Windows\System32\gema.exe (Veoj)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O2 - BHO: (no name) - {d2350351-c7d6-e908-7405-4e22016c1513} - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {69B6939F-C70D-45C5-9BBD-E2E2CC3DD8E5} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\Pik-Royal_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\Pik-Royal_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O20 - HKLM Winlogon: UserInit - (C:\ProgramData\gema\gema.exe) - C:\ProgramData\gema\gema.exe (Veoj)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\gema.exe) - C:\Windows\System32\gema.exe (Veoj)
O20 - HKU\Administrator_ON_C Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\gema\gema.exe) - C:\Users\Administrator\AppData\Roaming\gema\gema.exe
(Veoj)
O20 - HKU\Pik-Royal_ON_C Winlogon: Shell - (C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe) - C:\Users\Pik-Royal\AppData\Roaming\gema\gema.exe (Veoj)
[2012/03/31 15:53:16 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\gema
[2012/03/31 15:49:43 | 000,237,568 | ---- | C] (Veoj) -- C:\Windows\System32\gema.exe
[2012/03/31 12:37:14 | 000,000,000 | ---D | C] -- C:\Users\Pik-Royal\AppData\Roaming\gema
[2012/03/31 12:37:14 | 000,000,000 | ---D | C] -- C:\ProgramData\gema
:Files
C:\Users\Pik-Royal\AppData\Roaming\gema
C:\ProgramData\gema
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Hallo,

vielen Dank für die sehr schnelle Antwort. Ich habe auf meinem zweiten PC eine txt datei mit dem Namen fix.txt erstellt, deinen Code hineinkopiert und auf meinem USB stick gespeichert.
Auf dem befallenen Rechner habe ich dann das Programm ausgeführt und auf den Button "Run fix" geklickt. Es öffnete sich ein Fenster in dem ich meine Datei auswählen sollte. Sobald ich aber auf einen anderen Ordner zugreifen wollte (z.B. My Computer) reagierte das Programm nicht mehr (mehrfach probiert).

Wie kann ich die Datei manuell einfügen? Es tut mir Leid, ich bin auf dem Gebiet nicht sehr bewandert.
Bevor das Problem später auftaucht: Ich habe schon mal versucht ohne das OTL Programm meinen Stick zu öffnen, ich finde ihn aber nicht. Der Rechner erkennt ihn, da ich in "sicher entfernen" kann ...

Liebe Grüße

hi,
nimm den stick mal raus, starte die otl cd neu, erst dann stecke den stick ein, versuche ob er erkannt wird, lade das script falls möglich.
wenn nicht, musst du es per hand eingeben.

Alles klar, werde ich machen. Falls er ihn nicht erkennt, und ich das Script nicht laden können sollte, wie bzw. wo muss ich den Spaß per Hand eingeben?

genau die position kann ich dir nicht sagen, aber das feld müsste ja eig farblich zu erkennen sein.

Ok. Ich habe den PC selbst ohne CD neugestartet. Er wollte nur dass ich die System Disc einlege und konnte dann (auch ohne von CD zu booten) starten. Jetzt habe ich erstmal alle meine Dateien gesichert, also VIELEN DANK!!!

Jetzt werde ich die Datei suchen und sie im Upchannel hochladen!


EDIT:

Als ich auf "Senden an -> Zip komprimierten Ordner" klickte sagte mir mein Antiviren programm dass die Datei infiziert sei (oh welche überraschung, ein Trojaner!) . Wie soll ich vorgehen?

Datei ist hochgeladen.

hi, danke.
wie willst du verfahren, neu aufsetzen, da du die dateien gesichert hast, oder weiter analysieren.

Neu draufspielen ist die einzige möglichkeit den trojaner sicher zu entfernen, oder?

wir könns so machen, wenn du willst:
1. Datenrettung:

• deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
• dann sichere Daten auf nen externen datenträger: http://www.trojaner-board.de/82533-d...ted-magic.html
  Bider, Dokumente, Musik Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neu instalieren:

• nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
• recovery cd oder recovery partition.
• falls dies ein fertig pc ist, nenne hersteller + typ.
• Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.