Hallo Leute!

Wie im Titel beschrieben, wurde auch mein Computer gesperrt und es wird von mir verlangt 50€ zu zahlen.

Natürlich mach ich das nicht

Ich hab bereits in einigen Threads gesucht und hab dann dieses OTLPE mit "run scan drüber laufen lassen"

Das ist dabei heruasgekommen (siehe anhang)

Es wär super wenn ihr mir helfen könntet. Danke

Hier nochmal als Code-Tag

OTL logfile created on: 5/18/2012 7:42:03 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Ultimate  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = G: | %SystemRoot% = G:\Windows | %ProgramFiles% = G:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 74.05 Mb Free Space | 74.06% Space Free | Partition Type: NTFS
Drive D: | 1863.01 Gb Total Space | 1068.88 Gb Free Space | 57.37% Space Free | Partition Type: NTFS
Drive E: | 931.51 Gb Total Space | 792.08 Gb Free Space | 85.03% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 238.96 Gb Free Space | 25.65% Space Free | Partition Type: NTFS
Drive G: | 148.95 Gb Total Space | 13.26 Gb Free Space | 8.90% Space Free | Partition Type: NTFS
Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/11/07 18:45:05 | 001,431,888 | ---- | M] (Flexera Software, Inc.) [On_Demand] -- G:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2011/09/29 10:27:00 | 000,067,584 | ---- | M] (Nevigo GmbH) [Auto] -- G:\Program Files\articy server\server\ArticyServer.exe -- (ArticyServer)
SRV:64bit: - [2010/02/01 09:45:34 | 006,159,656 | ---- | M] (Wacom Technology, Corp.) [Auto] -- G:\Windows\System32\Wacom_Tablet.exe -- (TabletServiceWacom)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- G:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 21:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- G:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009/05/04 10:47:36 | 000,809,984 | ---- | M] (OptionNV) [Auto] -- G:\Program Files\Option\GlobeTrotter Connect\GtDetectSc.exe -- (GtDetectSc)
SRV - [2012/05/08 17:19:55 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- G:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/08 17:19:53 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- G:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/04/26 02:56:56 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand] -- G:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/02/29 20:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto] -- G:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/02/29 08:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto] -- G:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/02/29 02:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto] -- G:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/02/14 02:26:25 | 000,481,064 | ---- | M] (Valve Corporation) [On_Demand] -- G:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/12/14 07:23:34 | 002,123,584 | ---- | M] (TuneUp Software) [Auto] -- G:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011/04/01 17:52:24 | 000,403,456 | ---- | M] () [Auto] -- G:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe -- (AVerScheduleService)
SRV - [2011/01/28 21:50:38 | 000,348,160 | ---- | M] (AVerMedia) [Auto] -- G:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe -- (AVerRemote)
SRV - [2010/05/31 08:42:20 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand] -- G:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- G:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/09 20:10:38 | 000,086,016 | ---- | M] () [Auto] -- G:\Program Files (x86)\Autodesk\3ds Max 2011\mentalimages\satellite\raysat_3dsmax2011_32server.exe -- (mi-raysat_3dsmax2011_32)
SRV - [2010/02/19 07:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- G:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- G:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/05/21 16:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto] -- G:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2008/09/24 08:32:48 | 000,935,208 | ---- | M] (Nero AG) [Auto] -- G:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- G:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/05/08 17:19:55 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System] -- G:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012/05/08 17:19:55 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto] -- G:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012/01/10 22:56:58 | 002,839,168 | ---- | M] (AVerMedia TECHNOLOGIES, Inc. ) [Kernel | On_Demand] -- G:\Windows\System32\drivers\AVerTM62_x64.sys -- (TRIDCap)
DRV:64bit: - [2011/10/24 14:16:19 | 000,507,392 | ---- | M] (ITETech                  ) [Kernel | On_Demand] -- G:\Windows\System32\drivers\AF15BDA.sys -- (AF15BDA)
DRV:64bit: - [2011/09/16 11:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System] -- G:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/05/10 02:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/02/10 15:06:39 | 000,314,016 | ---- | M] () [Kernel | Auto] -- G:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2011/02/10 15:06:39 | 000,043,680 | ---- | M] () [Kernel | Auto] -- G:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2010/06/15 21:28:10 | 000,191,960 | ---- | M] (EldoS Corporation) [Kernel | System] -- G:\Windows\System32\drivers\cbfs64.sys -- (CbFs)
DRV:64bit: - [2010/06/09 19:01:10 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot] -- G:\Windows\System32\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010/05/27 11:25:21 | 000,828,912 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- G:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010/02/03 09:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV:64bit: - [2010/01/24 09:32:24 | 000,018,216 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- G:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV:64bit: - [2009/09/21 10:29:22 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- G:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2009/07/13 20:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/06/11 09:23:16 | 000,086,528 | ---- | M] (Option N.V.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\gt72ubus.sys -- (GT72UBUS)
DRV:64bit: - [2009/06/11 09:22:44 | 000,010,496 | ---- | M] (Option N.V.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\gtptser.sys -- (GTPTSER)
DRV:64bit: - [2009/06/11 09:22:30 | 000,130,048 | ---- | M] (Option N.V.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\Gt51Ip.sys -- (GT72NDISIPXP)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- G:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- G:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- G:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2007/02/16 05:12:36 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- G:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV:64bit: - [2005/03/28 19:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand] -- G:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2011/12/12 14:31:38 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand] -- G:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
IE - HKU\Rene_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddr
IE - HKU\Rene_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Rene_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Rene_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 70 EA A6 CB B4 01 CB 01  [binary data]
IE - HKU\Rene_ON_G\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Rene_ON_G\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: G:\Windows\System32\Macromed\Flash\NPSWF64_11_1_102.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: G:\Windows\System32\npdeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: G:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: G:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: G:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: G:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: G:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: G:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: G:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: G:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010/06/18 06:30:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/12/27 17:25:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/04/26 02:56:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/03/14 20:17:32 | 000,000,000 | ---D | M]
 
[2012/03/14 20:17:33 | 000,000,000 | ---D | M] (No name found) -- G:\Program Files (x86)\Mozilla Firefox\extensions
[2012/04/16 09:14:07 | 000,000,000 | ---D | M] (Skype Click to Call) -- G:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/08/31 09:28:51 | 000,000,000 | ---D | M] ("Citavi Picker") -- G:\Program Files (x86)\Mozilla Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}
[2010/07/28 16:32:57 | 000,000,000 | ---D | M] (G Data WebFilter) -- G:\Program Files (x86)\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2012/04/26 02:56:56 | 000,097,208 | ---- | M] (Mozilla Foundation) -- G:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010/03/27 12:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- G:\Program Files (x86)\mozilla firefox\plugins\npContribute.dll
[2012/03/13 01:23:34 | 000,001,392 | ---- | M] () -- G:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/03/13 01:06:36 | 000,002,252 | ---- | M] () -- G:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/03/13 01:23:34 | 000,001,153 | ---- | M] () -- G:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010/12/13 08:36:54 | 000,002,035 | ---- | M] () -- G:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2012/03/13 01:23:34 | 000,006,805 | ---- | M] () -- G:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/03/13 01:23:34 | 000,001,178 | ---- | M] () -- G:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/03/13 01:23:34 | 000,001,105 | ---- | M] () -- G:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010/06/18 06:13:31 | 000,000,854 | ---- | M]) - G:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - G:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (no name) - {64182481-4F71-486b-A045-B233BD0DA8FC} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - G:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - G:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVCpl] G:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] G:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [SwitchBoard] G:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\LocalService_ON_G..\Run: [Sidebar] G:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_G..\Run: [Sidebar] G:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Rene_ON_G..\Run: [ALYQ3CgTRBSYLwE] G:\Users\Rene\AppData\Roaming\bauesch.exe ()
O4 - HKU\UpdatusUser_ON_G..\Run: [Sidebar] G:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_G..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_G..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_G..\RunOnce: [mctadmin]  File not found
O4 - Startup: G:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\Administrator_ON_G\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Rene_ON_G\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - G:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - G:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - G:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - G:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.1)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.186.211.21 195.34.133.21
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - G:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - G:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - G:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/03/26 05:06:51 | 000,000,000 | ---D | M] - G:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk /r \??\D:) -  File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/14 16:03:27 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012/05/13 17:45:25 | 000,000,000 | ---D | C] -- G:\Windows\System32\SPReview
[2012/05/13 17:36:16 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012/05/09 04:42:04 | 001,541,120 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\DWrite.dll
[2012/05/09 04:42:03 | 001,837,568 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\d3d10warp.dll
[2012/05/09 04:42:03 | 001,170,944 | ---- | C] (Microsoft Corporation) -- G:\Windows\SysWow64\d3d10warp.dll
[2012/05/09 04:42:03 | 001,074,176 | ---- | C] (Microsoft Corporation) -- G:\Windows\SysWow64\DWrite.dll
[2012/05/09 04:42:03 | 000,902,656 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\d2d1.dll
[2012/05/09 04:42:03 | 000,739,840 | ---- | C] (Microsoft Corporation) -- G:\Windows\SysWow64\d2d1.dll
[2012/05/09 04:42:03 | 000,320,512 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\d3d10_1core.dll
[2012/05/09 04:42:03 | 000,218,624 | ---- | C] (Microsoft Corporation) -- G:\Windows\SysWow64\d3d10_1core.dll
[2012/05/09 04:42:03 | 000,197,120 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\d3d10_1.dll
[2012/05/09 04:42:03 | 000,161,792 | ---- | C] (Microsoft Corporation) -- G:\Windows\SysWow64\d3d10_1.dll
[2012/05/09 04:41:29 | 005,504,880 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\ntoskrnl.exe
[2012/05/09 04:41:27 | 003,958,128 | ---- | C] (Microsoft Corporation) -- G:\Windows\SysWow64\ntkrnlpa.exe
[2012/05/09 04:41:27 | 003,902,320 | ---- | C] (Microsoft Corporation) -- G:\Windows\SysWow64\ntoskrnl.exe
[2012/05/07 17:13:19 | 000,000,000 | ---D | C] -- G:\Users\Rene\Documents\Eigene Scans
[2012/04/26 19:33:15 | 000,000,000 | ---D | C] -- G:\Program Files (x86)\1ClickDownload
[2012/04/26 02:58:02 | 000,000,000 | ---D | C] -- G:\Program Files (x86)\Mozilla Maintenance Service
[2012/04/26 02:58:02 | 000,000,000 | ---D | C] -- G:\ProgramData\Mozilla
[2012/04/22 18:12:35 | 000,000,000 | ---D | C] -- G:\ProgramData\Caphyon
[2012/04/22 18:12:28 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\VIRTUALSAT 2.0
[2012/04/22 18:12:28 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\VIRTUALSAT
[2012/04/22 18:12:28 | 000,000,000 | ---D | C] -- G:\Program Files (x86)\TeleOne GmbH
[2012/04/22 18:11:37 | 000,000,000 | ---D | C] -- G:\Users\Rene\AppData\Roaming\TeleOne GmbH
[2012/04/20 12:57:53 | 000,000,000 | ---D | C] -- G:\Users\Rene\Documents\Diablo III
[2012/04/20 12:29:06 | 000,000,000 | ---D | C] -- G:\ProgramData\Battle.net
[2012/04/19 19:23:53 | 000,000,000 | ---D | C] -- G:\Users\Rene\AppData\Local\TSVNCache
[2012/04/19 18:55:02 | 000,000,000 | ---D | C] -- G:\Users\Rene\AppData\Roaming\TortoiseSVN
[2012/04/19 18:47:23 | 000,000,000 | ---D | C] -- G:\Users\Rene\AppData\Roaming\Subversion
[2012/04/19 18:47:23 | 000,000,000 | ---D | C] -- G:\Users\Rene\AppData\Local\CrashRpt
[2012/04/19 18:43:15 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\TortoiseSVN
[2012/04/19 18:43:13 | 000,000,000 | ---D | C] -- G:\Program Files (x86)\Common Files\TortoiseOverlays
[2012/04/19 18:43:12 | 000,000,000 | ---D | C] -- G:\Program Files\TortoiseSVN
[2012/04/19 18:43:12 | 000,000,000 | ---D | C] -- G:\Program Files\Common Files\TortoiseOverlays
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/18 12:27:21 | 000,067,584 | --S- | M] () -- G:\Windows\bootstat.dat
[2012/05/18 11:40:16 | 000,014,016 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/18 11:40:16 | 000,014,016 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/18 11:29:37 | 000,231,936 | ---- | M] () -- G:\Users\Rene\AppData\Roaming\bauesch.exe
[2012/05/17 15:45:18 | 000,705,196 | ---- | M] () -- G:\Windows\System32\perfh007.dat
[2012/05/17 15:45:18 | 000,659,212 | ---- | M] () -- G:\Windows\System32\perfh009.dat
[2012/05/17 15:45:18 | 000,151,690 | ---- | M] () -- G:\Windows\System32\perfc007.dat
[2012/05/17 15:45:18 | 000,123,886 | ---- | M] () -- G:\Windows\System32\perfc009.dat
[2012/05/15 11:47:24 | 000,000,132 | ---- | M] () -- G:\Users\Rene\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012/05/14 16:28:27 | 000,000,939 | ---- | M] () -- G:\Users\Public\Desktop\Diablo III.lnk
[2012/05/14 16:28:26 | 000,000,000 | R--D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/05/14 16:28:25 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012/05/14 11:39:42 | 018,284,046 | ---- | M] () -- G:\Users\Rene\Desktop\Lintest_E13 Kopie.psd
[2012/05/13 17:36:16 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012/05/10 16:56:06 | 000,000,600 | ---- | M] () -- G:\Users\Rene\AppData\Roaming\winscp.rnd
[2012/05/10 03:04:05 | 004,989,728 | ---- | M] () -- G:\Windows\System32\FNTCACHE.DAT
[2012/05/08 17:19:55 | 000,132,832 | ---- | M] (Avira GmbH) -- G:\Windows\System32\drivers\avipbb.sys
[2012/05/08 17:19:55 | 000,098,848 | ---- | M] (Avira GmbH) -- G:\Windows\System32\drivers\avgntflt.sys
[2012/05/07 17:49:39 | 021,368,244 | ---- | M] () -- G:\Users\Rene\Desktop\GameStop.psd
[2012/04/29 04:37:31 | 000,514,176 | ---- | M] () -- G:\Users\Rene\Desktop\DailyDeal.pdf
[2012/04/22 18:12:33 | 000,002,122 | ---- | M] () -- G:\Users\Public\Desktop\VIRTUALSAT 2.0.lnk
[2012/04/22 18:12:33 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\VIRTUALSAT 2.0
[2012/04/22 18:12:33 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\VIRTUALSAT
[2012/04/19 18:43:16 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\TortoiseSVN
 
========== Files Created - No Company Name ==========
 
[2012/05/18 11:29:43 | 000,231,936 | ---- | C] () -- G:\Users\Rene\AppData\Roaming\bauesch.exe
[2012/05/14 16:03:27 | 000,000,939 | ---- | C] () -- G:\Users\Public\Desktop\Diablo III.lnk
[2012/05/14 11:39:41 | 018,284,046 | ---- | C] () -- G:\Users\Rene\Desktop\Lintest_E13 Kopie.psd
[2012/05/07 17:39:52 | 021,368,244 | ---- | C] () -- G:\Users\Rene\Desktop\GameStop.psd
[2012/04/29 04:37:31 | 000,514,176 | ---- | C] () -- G:\Users\Rene\Desktop\DailyDeal.pdf
[2012/04/22 18:12:33 | 000,002,122 | ---- | C] () -- G:\Users\Public\Desktop\VIRTUALSAT 2.0.lnk
[2012/03/26 05:01:05 | 000,120,846 | ---- | C] () -- G:\Windows\The Face Machine for Maya 2012 (64-bit edition) Uninstaller.exe
[2012/03/23 16:32:06 | 000,049,152 | ---- | C] () -- G:\Windows\SysWow64\AVerIO.dll
[2012/03/23 16:32:06 | 000,003,456 | ---- | C] () -- G:\Windows\SysWow64\AVerIO.sys
[2012/03/23 16:32:04 | 000,614,400 | ---- | C] () -- G:\Windows\SysWow64\sptlib21.dll
[2012/03/23 16:32:04 | 000,421,888 | ---- | C] () -- G:\Windows\SysWow64\sptlib02.dll
[2012/03/23 16:32:04 | 000,311,296 | ---- | C] () -- G:\Windows\SysWow64\sptlib01.dll
[2012/03/23 16:32:04 | 000,307,200 | ---- | C] () -- G:\Windows\SysWow64\sptlib22.dll
[2012/03/23 16:32:04 | 000,307,200 | ---- | C] () -- G:\Windows\SysWow64\sptlib03.dll
[2012/03/23 16:32:04 | 000,294,912 | ---- | C] () -- G:\Windows\SysWow64\sptlib11.dll
[2012/03/23 16:32:04 | 000,135,168 | ---- | C] () -- G:\Windows\SysWow64\sptlib12.dll
[2012/02/29 08:26:56 | 000,416,064 | ---- | C] () -- G:\Windows\SysWow64\nvStreaming.exe
[2012/02/28 19:38:56 | 000,107,614 | ---- | C] () -- G:\Windows\The Setup Machine for Maya 2012 (64-bit edition) Uninstaller.exe
[2012/02/03 22:14:02 | 000,001,456 | ---- | C] () -- G:\Users\Rene\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2012/02/01 14:07:36 | 000,000,600 | ---- | C] () -- G:\Users\Rene\AppData\Roaming\winscp.rnd
[2011/12/27 17:17:54 | 000,241,119 | ---- | C] () -- G:\Windows\hpwins28.dat
[2011/10/24 13:54:27 | 000,000,014 | ---- | C] () -- G:\Windows\SysWow64\systeminfo.dll
[2011/10/09 08:11:14 | 000,120,846 | ---- | C] () -- G:\Windows\The Face Machine for Maya 2011 (64-bit edition) Uninstaller.exe
[2011/10/09 08:10:23 | 000,107,614 | ---- | C] () -- G:\Windows\The Setup Machine for Maya 2011 (64-bit edition) Uninstaller.exe
[2011/08/28 02:34:48 | 000,000,000 | ---- | C] () -- G:\Users\Rene\AppData\Local\{42A3F39C-9DBD-4C39-9CCD-4DBB2A46CCED}
[2011/07/23 08:59:18 | 000,003,584 | ---- | C] () -- G:\Users\Rene\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/03 05:35:08 | 000,001,025 | ---- | C] () -- G:\Windows\SysWow64\sysprs7.dll
[2011/04/03 05:35:08 | 000,000,205 | ---- | C] () -- G:\Windows\SysWow64\lsprst7.dll
[2011/03/15 19:13:46 | 000,057,344 | R--- | C] () -- G:\Windows\SysWow64\XSIChooser.exe
[2010/10/18 15:51:30 | 000,000,132 | ---- | C] () -- G:\Users\Rene\AppData\Roaming\Adobe Targa Format CS5 Prefs
[2010/09/23 09:51:09 | 000,000,056 | -H-- | C] () -- G:\Windows\SysWow64\ezsidmv.dat
[2010/09/16 18:38:39 | 000,004,987 | ---- | C] () -- G:\ProgramData\ywasvxup.hvs
[2010/09/16 17:46:48 | 000,090,231 | ---- | C] () -- G:\Windows\File Buddy Uninstaller.exe
[2010/09/15 15:05:04 | 001,612,646 | ---- | C] () -- G:\Windows\SysWow64\PerfStringBackup.INI
[2010/06/22 14:48:28 | 000,000,132 | ---- | C] () -- G:\Users\Rene\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2010/06/08 09:19:24 | 000,692,224 | ---- | C] () -- G:\Windows\SysWow64\libeay32.dll
[2010/06/08 09:19:24 | 000,151,552 | ---- | C] () -- G:\Windows\SysWow64\ssleay32.dll
[2010/06/07 12:53:29 | 000,000,180 | ---- | C] () -- G:\Users\Rene\AppData\Roaming\default.rss
[2010/05/31 06:14:31 | 000,000,132 | ---- | C] () -- G:\Users\Rene\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010/05/29 16:31:50 | 000,002,516 | -HS- | C] () -- G:\ProgramData\KGyGaAvL.sys
[2010/05/29 16:31:50 | 000,000,008 | RHS- | C] () -- G:\ProgramData\E6DF3DC77A.sys
[2010/04/20 10:31:43 | 000,936,832 | ---- | C] () -- G:\Windows\SysWow64\M2ElevatedCalls.dll
[2009/08/18 03:18:40 | 000,000,418 | ---- | C] () -- G:\Windows\hpwmdl28.dat
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- G:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- G:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- G:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- G:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- G:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- G:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- G:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- G:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- G:\Windows\SysWow64\mlang.dat
[2007/07/31 23:39:28 | 000,012,536 | ---- | C] () -- G:\Windows\SysWow64\drivers\ASUSHWIO.SYS
 
========== LOP Check ==========
 
[2010/05/27 03:02:41 | 000,000,000 | -HSD | M] -- G:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- G:\ProgramData\Application Data
[2011/11/09 07:46:03 | 000,000,000 | ---D | M] -- G:\ProgramData\Autodesk
[2012/03/23 16:33:56 | 000,000,000 | ---D | M] -- G:\ProgramData\AVer MediaCenter 3D
[2012/04/20 12:29:14 | 000,000,000 | ---D | M] -- G:\ProgramData\Battle.net
[2011/10/24 14:33:47 | 000,000,000 | ---D | M] -- G:\ProgramData\BlazeVideo
[2012/05/15 06:17:19 | 000,000,000 | ---D | M] -- G:\ProgramData\boost_interprocess
[2010/08/24 09:24:45 | 000,000,000 | ---D | M] -- G:\ProgramData\Boss Media
[2012/04/22 18:12:35 | 000,000,000 | ---D | M] -- G:\ProgramData\Caphyon
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- G:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- G:\ProgramData\Documents
[2010/05/27 03:02:41 | 000,000,000 | -HSD | M] -- G:\ProgramData\Dokumente
[2010/07/28 12:15:27 | 000,000,000 | ---D | M] -- G:\ProgramData\Driver Whiz
[2010/05/27 03:02:41 | 000,000,000 | -HSD | M] -- G:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- G:\ProgramData\Favorites
[2011/06/10 15:18:58 | 000,000,000 | ---D | M] -- G:\ProgramData\G Data
[2011/05/11 14:22:38 | 000,000,000 | ---D | M] -- G:\ProgramData\Gibraltar
[2010/09/16 18:42:16 | 000,000,000 | ---D | M] -- G:\ProgramData\Movavi Video Converter 6
[2011/02/13 13:45:19 | 000,000,000 | ---D | M] -- G:\ProgramData\mquadr.at
[2011/03/14 12:42:54 | 000,000,000 | ---D | M] -- G:\ProgramData\PACE Anti-Piracy
[2010/08/15 17:49:24 | 000,000,000 | ---D | M] -- G:\ProgramData\PC Drivers HeadQuarters Inc
[2010/06/14 16:09:41 | 000,000,000 | ---D | M] -- G:\ProgramData\regid.1986-12.com.adobe
[2011/04/03 05:38:52 | 000,000,000 | ---D | M] -- G:\ProgramData\SafeNet Sentinel
[2011/04/03 05:37:05 | 000,000,000 | ---D | M] -- G:\ProgramData\SPSS
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- G:\ProgramData\Start Menu
[2010/05/27 03:02:41 | 000,000,000 | -HSD | M] -- G:\ProgramData\Startmenü
[2011/05/11 12:54:19 | 000,000,000 | ---D | M] -- G:\ProgramData\Swiss Academic Software
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- G:\ProgramData\Templates
[2011/09/11 21:02:01 | 000,000,000 | ---D | M] -- G:\ProgramData\The Foundry
[2012/01/30 04:24:23 | 000,000,000 | ---D | M] -- G:\ProgramData\TuneUp Software
[2010/08/15 17:49:41 | 000,000,000 | ---D | M] -- G:\ProgramData\UAB
[2010/05/27 03:02:41 | 000,000,000 | -HSD | M] -- G:\ProgramData\Vorlagen
[2012/01/27 21:14:11 | 000,000,000 | -HSD | M] -- G:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2010/05/31 16:41:33 | 000,000,000 | ---D | M] -- G:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2010/08/03 14:42:23 | 000,000,000 | -HSD | M] -- G:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2012/03/12 17:29:05 | 000,032,640 | ---- | M] () -- G:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 1074 bytes -> G:\Users\Rene\AppData\Local:2QFbTFqrvknmonlX2crK
< End of report >
         

Bitte helft mir!

hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

:OTL
O4 - HKU\Rene_ON_G..\Run: [ALYQ3CgTRBSYLwE] G:\Users\Rene\AppData\Roaming\bauesch.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
:Files
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Ich hab leider das Problem, dass er von alleine nicht rebooten kann. Heißt:

Ich hab deine Anleitung zwar befolgt und den fix.txt eingegeben und ausgeführt...aber wenn er mich fragt ob ich nun neustarten möchte und ich auf "yes" klicke, macht er nichts mehr....und wenn ich über Start auf "shutdown" -> "restart" gehe, dann hängt sich das System leider auf

was kann ich tun?

Wenn ich danach nämlich über den reboot-knopf neustarte (also den harten weg nehme), dann taucht beim Windows-start leider wieder das AKM auf und ich kann somit nichts mehr machen.

Nachtrag:

Hab jetzt im abgesicherten Modus gestartet....wo zum glück das AKM nicht aufgetaucht ist und hab dort den Ordner "MovedFiles" gefunden. Hab die zip-datei wie beschrieben dann auf den UploadChannel gegeben. Hoffe, so kannst du mir weiterhelfen.

Aber wie gesagt....beim normalen Windows-Start bin ich das AKM leider immer noch nicht los :'(

Hallo!

ich bin wieder einen Schritt weitergekommen.

Ich hab vorher das OTLPE auf CD gebrannt und von dort booten lassen.

dort hat es wie oben beschrieben nicht ganz geklappt, da ich sich das system beim restart aufgehängt hat.

jetzt hab ich das OTLPE im abgesichteren Modus mit netzwerktreiber nochmal ausgeführt, dort hat alles soweit geklappt...neustart hat auch funktioniert und OTL hat sich beim Start auch geöffnet. Leider öffnet sich aber immer noch das AKM-Fenster und ich bin immer noch nicht am Ziel.

Ich hab es trotzdem irgendwie geschafft, das geöffnete OTL-file zu speichern ->

All processes killed
========== OTL ==========
Registry key HKEY_USERS\Rene_ON_G\Software\Microsoft\Windows\CurrentVersion\Run not found.
File G:\Users\Rene\AppData\Roaming\bauesch.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: Administrator
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Rene
->Flash cache emptied: 3267393 bytes
 
User: UpdatusUser
->Flash cache emptied: 41620 bytes
 
Total Flash Files Cleaned = 3,00 mb
 
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Rene
->Temp folder emptied: 595456 bytes
->Temporary Internet Files folder emptied: 326722562 bytes
->Java cache emptied: 13166566 bytes
->FireFox cache emptied: 48720429 bytes
->Google Chrome cache emptied: 6138516 bytes
->Flash cache emptied: 0 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5716 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 2305856159 bytes
 
Total Files Cleaned = 2.576,00 mb
 
 
OTL by OldTimer - Version 3.2.43.0 log created on 01012008_040851

Files\Folders moved on Reboot...
C:\Users\Rene\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
         

bitte um drigende Hilfe. Danke schonmal

ok....hab es soeben geschafft....hab die bauesch.exe manuell gelöscht (da er die ja sichtlich nicht finden und löschen konnte).....jetzt klappt wieder alles *schnauf*


sollte ich irgendwas noch sicherheitshalber machen oder kann ich wieder normal arbeiten?

Viel Dank schonmal für eure große Hilfe!

hi

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.