Hallo zusammen,

nach einigem Suchen kam mir dieses Forum am geeignetesten vor und ich hoffe, die Anleitungen für die Vorab-Schritte so gut wie möglich durchgeführt zu haben (dazu unten mehr).

Vor ein paar Tagen war mein Rechner durch eine der offenbar bereits einschlägig bekannten Varianten "gesperrt", genauer gesagt: mein User-Konto - d.h. unter einem Gastzugang konnte ich das Avira-Programm updaten, Malware identifizieren und entfernen. Daraufhin war der "Sperr"-Bildschirm weg, aber eine Fehlermeldung der Art "...konnte 0_0u_l.exe - Das angegebene Modul konnte nicht gefunden werden" erschien. Über googlen nach dieser Meldung kam ich zu diesem Forum und habe die eingangs beschriebenen Schritte mit unterschiedlichem Erfogl durchühren können:

Malwarebytes wurde ausgeführt und fand vier infizierte Objekte, die ich wie beschrieben gelöscht habe. Der Log war vorhanden aber nach einem ungeplanten Neustart durch Gmer (s.u.) später für diesen Post nicht mehr vorhanden.

Defogger hat keine Fehlermeldung ausgegeben.

Die Logs von OTL kommen hier:

OTL.txt:

OTL logfile created on: 09.07.2012 23:22:33 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Bär\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,25 Gb Total Physical Memory | 1,97 Gb Available Physical Memory | 60,77% Memory free
6,71 Gb Paging File | 5,50 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 488,28 Gb Total Space | 254,06 Gb Free Space | 52,03% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 8,94 Gb Free Space | 44,69% Space Free | Partition Type: FAT32
Drive J: | 423,23 Gb Total Space | 64,78 Gb Free Space | 15,31% Space Free | Partition Type: NTFS
Drive K: | 1863,01 Gb Total Space | 0,51 Gb Free Space | 0,03% Space Free | Partition Type: NTFS
Drive L: | 931,51 Gb Total Space | 826,68 Gb Free Space | 88,75% Space Free | Partition Type: NTFS
Drive O: | 1397,26 Gb Total Space | 65,20 Gb Free Space | 4,67% Space Free | Partition Type: NTFS

Computer Name: PC2 | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.07.09 23:20:43 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Bär\Desktop\OTL.exe
PRC - [2012.05.08 21:13:42 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 21:13:39 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 21:13:39 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.05.08 21:13:38 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2010.11.04 22:09:22 | 000,980,368 | ---- | M] (The Eraser Project) -- C:\Programme\Eraser\Eraser.exe
PRC - [2010.10.19 14:29:03 | 006,917,416 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer.exe
PRC - [2010.10.19 14:29:03 | 002,011,944 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2010.02.22 11:40:22 | 000,207,504 | ---- | M] (Geek Software GmbH) -- C:\Programme\pdf24\pdf24.exe
PRC - [2009.11.11 16:17:02 | 000,771,360 | ---- | M] (Apple Inc.) -- C:\Programme\AirPort\APAgent.exe
PRC - [2009.09.01 18:00:12 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\Cyberlink\Shared files\brs.exe
PRC - [2009.07.13 23:18:12 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2009.07.01 18:37:06 | 000,037,888 | ---- | M] () -- C:\Programme\Winamp\winampa.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.07 14:53:32 | 000,030,440 | ---- | M] () -- C:\Programme\dcmsvc\dcmsvc.exe
PRC - [2008.12.11 10:16:28 | 000,026,112 | ---- | M] () -- C:\Programme\Steganos Safe OEM\SteganosHotKeyService.exe
PRC - [2008.07.18 19:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Programme\HomeCinema\Power2Go\CLMLSvc.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.10.09 00:19:22 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007.10.09 00:19:20 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe
PRC - [2007.05.17 14:45:34 | 000,271,720 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe
PRC - [2007.04.10 14:46:44 | 000,996,712 | ---- | M] (Microsoft Corporation
) -- C:\Windows\vVX6000.exe
PRC - [2006.11.09 16:15:06 | 000,053,248 | ---- | M] (Chicony) -- C:\Windows\ModLEDKey.exe
PRC - [2006.11.09 16:01:02 | 005,585,408 | ---- | M] (Chicony) -- C:\Windows\CNYHKey.exe
PRC - [2006.10.27 00:47:42 | 000,031,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe


========== Modules (No Company Name) ==========

MOD - [2012.06.14 08:10:14 | 001,711,616 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\2467a133aee73396c830b9b0a9c7ec0d\Microsoft.VisualBasic.ni.dll
MOD - [2012.06.14 08:07:26 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.06.14 08:07:18 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.05.13 16:17:11 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.13 16:16:38 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\0f2b877ed16daa577f95be735a63d19c\System.Core.ni.dll
MOD - [2012.05.13 16:16:03 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.13 16:15:57 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.07.01 18:37:06 | 000,037,888 | ---- | M] () -- C:\Programme\Winamp\winampa.exe
MOD - [2009.04.07 14:53:32 | 000,030,440 | ---- | M] () -- C:\Programme\dcmsvc\dcmsvc.exe
MOD - [2008.12.11 10:16:28 | 000,026,112 | ---- | M] () -- C:\Programme\Steganos Safe OEM\SteganosHotKeyService.exe
MOD - [2008.10.01 15:30:08 | 000,135,168 | ---- | M] () -- C:\Programme\Steganos Safe OEM\wxbase28uh_net_vc.dll
MOD - [2008.10.01 15:30:06 | 003,162,112 | ---- | M] () -- C:\Programme\Steganos Safe OEM\wxmsw28uh_core_vc.dll
MOD - [2008.10.01 15:30:06 | 001,318,912 | ---- | M] () -- C:\Programme\Steganos Safe OEM\wxbase28uh_vc.dll
MOD - [2008.10.01 15:30:06 | 000,704,512 | ---- | M] () -- C:\Programme\Steganos Safe OEM\wxmsw28uh_adv_vc.dll
MOD - [2008.10.01 15:30:06 | 000,483,328 | ---- | M] () -- C:\Programme\Steganos Safe OEM\wxmsw28uh_html_vc.dll
MOD - [2008.08.27 16:32:36 | 000,619,816 | ---- | M] () -- C:\Programme\HomeCinema\Power2Go\CLMediaLibrary.dll
MOD - [2008.06.09 09:55:08 | 000,013,096 | ---- | M] () -- C:\Programme\HomeCinema\Power2Go\CLMLSvcPS.dll
MOD - [2003.06.16 20:13:22 | 000,049,152 | ---- | M] () -- C:\Windows\CNYUSB.dll
MOD - [2002.09.26 03:07:02 | 000,005,120 | ---- | M] () -- C:\Windows\HKCYDLL.dll


========== Win32 Services (SafeList) ==========

SRV - [2012.07.01 10:56:12 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.05.08 21:13:42 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 21:13:39 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010.10.19 14:29:03 | 002,011,944 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009.07.13 23:18:12 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.10.09 00:19:22 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2007.05.17 14:45:34 | 000,271,720 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2006.10.27 00:47:54 | 000,065,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.11.17 15:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.05.08 21:13:43 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 21:13:43 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.09.16 17:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.07.29 01:25:22 | 000,025,112 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ivusb.sys -- (ivusb)
DRV - [2009.10.08 17:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.09.01 17:59:44 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/04/22 16:10:50] [Kernel | Auto | Running] -- C:\Programme\HomeCinema\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD})
DRV - [2009.03.27 22:33:00 | 007,738,816 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.10.01 15:24:24 | 000,079,104 | ---- | M] (Softwareentwicklung Remus - ArchiCrypt ) [Driver] [Kernel | System | Running] -- C:\Windows\System32\drivers\sleen16.sys -- (SLEE_16_DRIVER)
DRV - [2008.01.21 04:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007.09.21 09:38:22 | 000,554,496 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2007.07.27 12:46:06 | 000,251,680 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acehlp10.sys -- (acehlp10)
DRV - [2007.07.27 10:13:08 | 000,330,144 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ACEDRV10.sys -- (acedrv10)
DRV - [2007.04.10 14:46:44 | 002,385,896 | ---- | M] (Microsoft Corporation
) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VX6000Xp.sys -- (VX6000)
DRV - [2006.11.10 16:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006.07.31 07:44:00 | 000,580,992 | ---- | M] (Omnivision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ov550i.sys -- (APL531)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.spiegel.de/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: fdm_ffext@freedownloadmanager.org:1.3.4
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:2.7.1.3
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\2.0.40115.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.02 20:09:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.02 20:09:59 | 000,000,000 | ---D | M]

[2009.06.05 23:41:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2011.04.28 08:03:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\qmtt8mp2.default\extensions
[2009.10.06 23:30:02 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\qmtt8mp2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.11.22 22:05:26 | 000,000,000 | ---D | M] (kikin plugin) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\qmtt8mp2.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}
[2010.07.02 22:40:41 | 000,000,000 | ---D | M] (Vuze Remote Toolbar) -- C:\Users\Admin\AppData\Roaming\mozilla\Firefox\Profiles\qmtt8mp2.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2011.04.27 17:33:20 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.03.29 22:02:03 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.07.14 20:03:53 | 000,000,000 | ---D | M] (Free Download Manager plugin) -- C:\PROGRAM FILES\FREE DOWNLOAD MANAGER\FIREFOX\EXTENSION
[2008.03.15 15:56:14 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2008.10.13 20:34:40 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2008.02.19 16:40:48 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2006.12.03 17:59:22 | 000,000,986 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2006.11.17 13:19:24 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll ()
O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll (kikin)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AirPort Base Station Agent] C:\Program Files\AirPort\APAgent.exe (Apple Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BDRegion] C:\Programme\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\HomeCinema\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [dcmsvc] C:\Programme\dcmsvc\dcmsvc.exe ()
O4 - HKLM..\Run: [Eraser] C:\Programme\Eraser\Eraser.exe (The Eraser Project)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ledpointer] C:\Windows\CNYHKey.exe (Chicony)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [MoLed] C:\Windows\ModLEDKey.exe (Chicony)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\pdf24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [SAFEOEM HotKeys] C:\Program Files\Steganos Safe OEM\SteganosHotKeyService.exe ()
O4 - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [TrayServer] C:\Programme\MAGIX\Video_deluxe_2008_PLUS\Trayserver.exe (MAGIX AG)
O4 - HKLM..\Run: [VX6000] C:\Windows\vVX6000.exe (Microsoft Corporation
)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [zzzHPSETUP] I:\Setup.exe \RESET File not found
O4 - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\System32\WerFault.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Alles mit FDM herunterladen - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Auswahl mit FDM herunterladen - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Datei mit FDM herunterladen - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Videos mit FDM herunterladen - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll (kikin)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F4B68181-A0F6-4104-A294-C42530DC7A06}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img18.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img18.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.08.27 14:03:42 | 000,000,000 | RH-D | M] - K:\autorun -- [ NTFS ]
O32 - AutoRun File - [2002.10.16 14:56:50 | 000,000,036 | RH-- | M] () - K:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010.03.01 17:05:57 | 000,000,000 | RH-D | M] - L:\autorun -- [ NTFS ]
O32 - AutoRun File - [2002.10.16 14:56:50 | 000,000,036 | RH-- | M] () - L:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009.01.02 17:40:38 | 000,000,124 | ---- | M] () - O:\Autorun.inf -- [ NTFS ]
O33 - MountPoints2\{4811dec8-51c2-11df-a721-0024210fa685}\Shell - "" = AutoRun
O33 - MountPoints2\{4811dec8-51c2-11df-a721-0024210fa685}\Shell\AutoRun\command - "" = I:\EasySuite.exe
O33 - MountPoints2\{89fb13e6-507e-11de-b26e-002243725192}\Shell - "" = AutoRun
O33 - MountPoints2\{89fb13e6-507e-11de-b26e-002243725192}\Shell\AutoRun\command - "" = K:\EasySuite.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012.07.09 22:28:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012.07.09 22:28:11 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.07.09 22:28:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.09 22:28:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.09 22:28:10 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.07.02 20:17:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.07.02 20:16:28 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.07.02 20:09:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012.07.02 20:09:38 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2012.06.14 08:04:49 | 000,000,000 | ---D | C] -- C:\Windows\Minidump

========== Files - Modified Within 30 Days ==========

[2012.07.09 23:18:34 | 008,585,554 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.07.09 23:18:34 | 007,773,948 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.07.09 23:18:33 | 026,376,324 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.07.09 23:18:33 | 008,511,448 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.07.09 23:14:02 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.09 23:13:50 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 23:13:50 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.09 23:13:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.09 23:13:13 | 3487,748,096 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.09 22:56:57 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable
[2012.07.09 22:52:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.09 22:28:12 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.09 22:01:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.02 20:17:39 | 000,001,668 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.02 20:09:53 | 000,001,730 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.07.02 14:59:00 | 000,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.06.14 08:05:12 | 000,425,112 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.06.14 07:53:58 | 149,683,964 | ---- | M] () -- C:\Windows\MEMORY.DMP

========== Files Created - No Company Name ==========

[2012.07.09 22:56:57 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable
[2012.07.09 22:28:12 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.02 20:17:39 | 000,001,668 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.02 20:09:53 | 000,001,730 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk
[2012.06.14 07:53:58 | 149,683,964 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.12.12 21:59:10 | 000,000,429 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\mdbu.bin
[2011.08.03 22:34:22 | 000,000,075 | RHS- | C] () -- C:\Windows\ICMET20.BIN
[2011.08.03 22:20:02 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2011.08.03 22:18:52 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2011.07.25 22:23:23 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2011.07.25 22:19:17 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll
[2011.04.27 21:10:57 | 000,080,896 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.08.13 13:19:37 | 000,000,680 | ---- | C] () -- C:\Users\Admin\AppData\Local\d3d9caps.dat
[2009.06.15 22:04:05 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.05.27 22:12:28 | 000,081,920 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== LOP Check ==========

[2011.03.06 13:56:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\avidemux
[2010.07.14 20:03:54 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Free Download Manager
[2010.06.13 00:15:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\FreeVideoConverter
[2009.06.05 23:04:11 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\IrfanView
[2010.11.22 22:05:29 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\kikin
[2009.06.05 23:44:01 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Opera
[2010.04.05 21:46:24 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Steganos
[2011.03.12 10:02:56 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TeamViewer
[2010.10.17 10:53:05 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\uTorrent
[2010.07.25 18:07:35 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Xilisoft
[2012.07.09 23:11:17 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >

Extra.txt:

OTL Extras logfile created on: 09.07.2012 23:22:33 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Bär\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,25 Gb Total Physical Memory | 1,97 Gb Available Physical Memory | 60,77% Memory free
6,71 Gb Paging File | 5,50 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 488,28 Gb Total Space | 254,06 Gb Free Space | 52,03% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 8,94 Gb Free Space | 44,69% Space Free | Partition Type: FAT32
Drive J: | 423,23 Gb Total Space | 64,78 Gb Free Space | 15,31% Space Free | Partition Type: NTFS
Drive K: | 1863,01 Gb Total Space | 0,51 Gb Free Space | 0,03% Space Free | Partition Type: NTFS
Drive L: | 931,51 Gb Total Space | 826,68 Gb Free Space | 88,75% Space Free | Partition Type: NTFS
Drive O: | 1397,26 Gb Total Space | 65,20 Gb Free Space | 4,67% Space Free | Partition Type: NTFS

Computer Name: PC2 | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\dm\dm-Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm-Fotowelt] -- "C:\Program Files\dm\dm-Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MI1933~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{040B5B60-A5AD-4400-B778-B8182069E89B}" = rport=137 | protocol=17 | dir=out | app=system |
"{08CD505F-3ACA-4819-B884-DAF9C2A798D3}" = lport=137 | protocol=17 | dir=in | app=system |
"{14D0DA54-10B8-4EBE-B4F7-ADB22F9D650D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{219E217A-BDEF-4909-970E-0CB54E853602}" = rport=445 | protocol=6 | dir=out | app=system |
"{56696065-60CE-4100-BBC1-68EBE5C1C3B0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{5C7A80E2-D877-41A8-888C-A069DF3BD925}" = rport=139 | protocol=6 | dir=out | app=system |
"{AC663CB7-87C0-40FC-B14B-BAB23BD59474}" = lport=139 | protocol=6 | dir=in | app=system |
"{BD29434C-DB96-47AE-AAEB-06030005758B}" = rport=138 | protocol=17 | dir=out | app=system |
"{C3927D80-FFD0-4A87-B705-DF4EEED25D90}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C448B656-9672-483B-BCC8-70FF220B5AC6}" = lport=445 | protocol=6 | dir=in | app=system |
"{CDB8808C-7BFC-4918-9FCD-818C52BD3A36}" = lport=138 | protocol=17 | dir=in | app=system |
"{DB418B11-BAF7-4C66-86FB-8D073F2668FC}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{F0D89D6D-C918-4BF5-9A4E-325318B8A669}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03A2725F-07CA-4B77-AFA2-A89A74D4F480}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{06AC5F42-BB56-45DB-B083-A63469679ABD}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{08F9959D-EC99-40F7-86B2-3685E68C9833}" = protocol=6 | dir=in | app=c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\xeuujpm0\index[1].cfm_dl=dlmhelp |
"{0D46303B-E0F3-416C-BE0A-CDA2D27E29BC}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{161225CB-5A9E-4A13-BD4C-F7822CCB1416}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{1B75B6EE-03F1-460E-8CC7-5F61136EBDB8}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{1C6DE16D-0129-422A-AEBC-ACC57F698AD1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1DF35855-09EE-48A7-A331-6737CEF62663}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{291B7E0D-51A5-43D3-BA46-8F8FC8068CB3}" = dir=in | app=c:\program files\airport\apagent.exe |
"{2BE58F8D-9CE9-4885-8183-03E1DB283215}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{32A075CB-5CCD-4C50-A772-F9874AF7915E}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{44E3F3DA-D2F3-46F4-954A-4CD56F505E7E}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{45763259-4285-48FA-BDDB-131D06D4E365}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{45D26AFF-0772-42DF-955A-E2DEE3B73E40}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{539392D0-7DBC-4248-AF3C-7BE03A70195F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{5B46585A-C0E7-4CCB-82FE-0B402D6E2D8A}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{5BA2808F-60FB-47D0-876B-0CC409132910}" = dir=in | app=c:\program files\homecinema\powerdvd9\powerdvd cinema\powerdvdcinema.exe |
"{5E706DE4-5427-43E5-A9B0-FAA5AD10272E}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe |
"{7ED6433C-88E2-4809-8F47-37F67CBCE6A2}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{7F9E1484-2DE9-451A-AA46-BBCED8466ABE}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{8A02394E-994F-4780-8DCC-1990B011AFE6}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{90B2AE16-9F5B-4320-A848-9074569B1764}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{958A1FD7-FB69-4E91-AB6C-F21A22112F58}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9A6C00D5-FD86-4179-BE82-92D1D4FE3DCC}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{A7C1FFA0-E11B-44A5-B4AD-6625966B44C7}" = protocol=17 | dir=in | app=c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\xeuujpm0\index[1].cfm_dl=dlmhelp |
"{AE3F2C94-CF21-46BC-A951-8597F2A00A1F}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe |
"{B5B45DD2-33CC-40EA-8D86-47726938A66C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B631A994-1197-43D6-A08F-9768C5810172}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{BA23F2C5-39EB-4AB2-BA3A-88B00E90FA63}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BDA30BF2-C41B-43AB-98ED-F5E0CEBCFB9F}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{C6EB1591-5865-4589-89C2-E3915E42F284}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe |
"{CCDA5612-71CF-49FB-BDDC-6AEA96251530}" = dir=in | app=c:\program files\homecinema\powerdvd9\powerdvd9.exe |
"{CEED1899-01E9-4432-862A-EE182F5FC089}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe |
"{D0F2AE75-CFCB-4890-AC20-D4DA9CB9AB35}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{D9B45D27-07F0-447D-A126-75A60FFFEE78}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{DC021A15-3ABC-49BC-A36E-DE7EA3C5DEA8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{DEF76B72-F126-4FD2-8937-9562C4C74BD1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"TCP Query User{3AE71E12-D28C-45AF-B335-F21E9CEFC571}C:\program files\quicktime\quicktimeplayer.exe" = protocol=6 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
"TCP Query User{3F48BEAB-6FA5-4E98-99FA-B69945A13113}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"TCP Query User{3F5E7FC5-79CA-4467-954B-6CF55FDBAB97}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{764E5FC8-95BB-49A0-B6E1-12CB7E9B165D}C:\program files\dvd profiler\dvdpro.exe" = protocol=6 | dir=in | app=c:\program files\dvd profiler\dvdpro.exe |
"TCP Query User{84A76E00-D7B9-43A5-A67E-349F2FEDF3FB}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{E0E2E4D8-A510-4687-ADC5-8FA9951C304B}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{EABB0C65-CE53-4961-86B5-9F35DE289E64}C:\program files\free download manager\fdmwi.exe" = protocol=6 | dir=in | app=c:\program files\free download manager\fdmwi.exe |
"UDP Query User{01AB5518-595A-4BB9-98F2-DE7CCECC8B9A}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"UDP Query User{0AE3A2F1-5CC8-4736-A3CC-1CFCD853E9C2}C:\program files\dvd profiler\dvdpro.exe" = protocol=17 | dir=in | app=c:\program files\dvd profiler\dvdpro.exe |
"UDP Query User{5BBAEFFB-F311-441E-9228-A709A354548F}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{7002B9BC-6F6F-48C8-B830-F1F9DFA67120}C:\program files\quicktime\quicktimeplayer.exe" = protocol=17 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
"UDP Query User{8F7BD217-398A-4FED-B450-C5A1E85B0473}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{A800B355-A662-49FB-A7F1-C9B64A131982}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{A95A3566-D3E4-4A4F-B479-347A65BE3AF7}C:\program files\free download manager\fdmwi.exe" = protocol=17 | dir=in | app=c:\program files\free download manager\fdmwi.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{063E409E-3D7C-4A4A-95AB-2F124B9224B3}" = ArcSoft PhotoImpression 6
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0E6EC2D7-5C9B-28B7-C848-171EDACB9625}" = Warner Bros. Digital Copy Manager
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan
"{392A74D0-4DFE-49F7-87C3-8A61708F8856}" = Eraser 6.0.8.2273
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40184457-4514-4B18-84A8-6BB8A3AB6A81}" = AirPort
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4A9849CA-E11C-4F24-8BB1-97C717A1C898}" = LightScribe System Software
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{53480870-02D8-48FB-BC27-72C956885168}" = O&O MediaRecovery
"{580EC579-E476-469F-9EBF-F82D696FC67A}" = iClone SE
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5A613A09-8F96-4F7E-BD71-69A89F37150D}" = hpg4850QFolder
"{5BA43E5C-66FD-48D2-AB40-B807D457EF83}" = ElsterFormular 2007/2008
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{6B566EFE-DC1D-471F-93DD-84832663F140}" = OVT Scanner X86
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{710BF966-43C8-4216-A8EC-BC4E169FF7C1}" = MobileMe Control Panel
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{726DBFE3-BE2B-4FFA-9787-D6495765CFD2}" = Microsoft LifeCam
"{730837D4-FF5E-48DB-BA49-33E732DFF0B3}" = PanoStandAlone
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4F72EE-8378-49BD-8C10-301E25907B5B}" = Steganos Safe OEM
"{A062A15F-9CAC-4B88-98DF-87628A0BD721}" = Corel MediaOne
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A334F1BA-0A1D-4ED6-B4F9-4066157CA15D}" = DE
"{A5A8D74C-61B6-46ce-B6E7-527BDD687787}" = HP Scanjet 4800 series 9.0
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ADDBE07D-95B8-4789-9C76-187FFF9624B4}" = CorelDRAW Essential Edition 3
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B480BD2A-F1BA-4FE6-8C8E-34C6111B72C9}" = ElsterFormular 2007/2008
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}" = Microsoft SQL Server 2005 Compact Edition [DEU]
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BF34527D-7B27-43AD-9994-7B3ABCEF3625}" = Phoenix Backup Professional
"{BF962E1B-D17A-4713-A100-6531A132D83D}_is1" = Foto-Mosaik-Edda Standard V5.7.1
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CBBCBE04-EA5E-4201-A924-E7ED3E8686AE}" = ElsterFormular 2006/2007
"{CC77E110-0ACB-4E15-9A92-6AEB96DA8C06}" = hpg4850
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEC0C2C2-921F-4EB8-8D7E-4F2F03ED02AA}" = ScannerCopy
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{DD1865F0-AD73-40FB-B23E-1822E02396FF}" = NVIDIA PhysX
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E18792FF-B11E-43A5-9842-B812A9F220F1}" = MICHELsoft 9.0.29 Easy
"{E1BBBAC5-2857-4155-82A6-54492CE88620}" = Opera 9.64
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = kikin plugin 2.5
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EDC66A92-4603-4D72-B28C-570075B55DF0}" = USB Wireless Keyboard Driver
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"8461-7759-5462-8226" = Vuze
"ABC Amber Audio Converter" = ABC Amber Audio Converter
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.5
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.13 (Unicode)
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber Lame-MP3-Plugin
"Avidemux 2.5" = Avidemux 2.5
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVS Audio Editor_is1" = AVS Audio Editor version 7.0
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.1" = Warner Bros. Digital Copy Manager
"dcmsvc_is1" = dcmsvc 1.0
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"dm-Fotowelt" = dm-Fotowelt
"DVD Shrink_is1" = DVD Shrink 3.2
"DVDStyler_is1" = DVDStyler v1.8.4
"ElsterFormular 10.3.3.990" = ElsterFormular
"ElsterFormular für Privatanwender 12.1.1.6214p" = ElsterFormular für Privatanwender
"ENTERPRISER" = Microsoft Office Enterprise 2007
"ffdshow_is1" = ffdshow v1.1.3814 [2011-04-11]
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition
"FKC22153088_is1" = fotokasten comfort
"Free Download Manager_is1" = Free Download Manager 3.0
"Free Video Converter_is1" = Free Video Converter V 2.8
"Google Updater" = Google Updater
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HP-Color LaserJet 1600" = Color LaserJet 1600
"HPOCR" = HP OCR Software 9.0
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"InvelosDVDProfiler_is1" = DVD Profiler Version 3.7.2
"IrfanView" = IrfanView (remove only)
"MAGIX Fotobuch" = MAGIX Fotobuch 3.2
"MAGIX Online Druck Service D" = MAGIX Online Druck Service 2.3.2.0 (D)
"MAGIX PC Visit D" = MAGIX PC Visit
"MAGIX Video deluxe 2008 PLUS D" = MAGIX Video deluxe 2008 PLUS 7.5.0.20 (D)
"MAGIX Xtreme Foto Designer 6 D" = MAGIX Xtreme Foto Designer 6 6.0.22.0 (D)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"NVIDIA Drivers" = NVIDIA Drivers
"OVT Scanner" = Uninstall OVT Scanner
"Picasa 3" = Picasa 3
"ProtectDisc Driver 10" = ProtectDisc Helper Driver 10
"RonyaSoft CD DVD Label Maker" = RonyaSoft CD DVD Label Maker 3.01
"Sigel Professional Label Software SE" = Sigel Professional Label Software SE
"TeamViewer 5" = TeamViewer 5
"UnderCoverXP_is1" = UnderCoverXP 1.23
"uTorrent" = µTorrent
"VLC media player" = VLC media player 0.9.9
"Vuze_Remote Toolbar" = Vuze Remote Toolbar
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinX DVD Author_is1" = WinX DVD Author 5.9
"Xilisoft DVD Creator 6" = Xilisoft DVD Creator 6

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 19.06.2011 09:02:53 | Computer Name = PC2 | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6001.18000, Zeitstempel
0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel 0x4cb73436,
Ausnahmecode 0xc0000374, Fehleroffset 0x000b06fc, Prozess-ID 0x8b4, Anwendungsstartzeit
01cc2e61fcf81e1c.

Error - 19.06.2011 10:29:22 | Computer Name = PC2 | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 19.06.2011 10:29:22 | Computer Name = PC2 | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 19.06.2011 10:31:59 | Computer Name = PC2 | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 19.06.2011 10:31:59 | Computer Name = PC2 | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 19.06.2011 10:32:58 | Computer Name = PC2 | Source = WinMgmt | ID = 10
Description =

Error - 19.06.2011 10:36:05 | Computer Name = PC2 | Source = LoadPerf | ID = 3012
Description =

Error - 19.06.2011 10:36:05 | Computer Name = PC2 | Source = LoadPerf | ID = 3012
Description =

Error - 19.06.2011 10:36:05 | Computer Name = PC2 | Source = LoadPerf | ID = 3011
Description =

Error - 19.06.2011 12:44:36 | Computer Name = PC2 | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung svchost.exe, Version 6.0.6001.18000, Zeitstempel
0x47918b89, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18327, Zeitstempel 0x4cb73436,
Ausnahmecode 0xc0000374, Fehleroffset 0x000b06fc, Prozess-ID 0xa18, Anwendungsstartzeit
01cc2e8d9b6883b6.

[ OSession Events ]
Error - 07.03.2010 14:11:14 | Computer Name = PC2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session
lasted 6425 seconds with 1320 seconds of active time. This session ended with a
crash.

Error - 08.03.2010 18:37:37 | Computer Name = PC2 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session
lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4375
Description =

Error - 01.07.2012 04:28:48 | Computer Name = PC2 | Source = Microsoft-Windows-Servicing | ID = 4385
Description =

Error - 02.07.2012 14:13:50 | Computer Name = PC2 | Source = Service Control Manager | ID = 7031
Description =

Error - 09.07.2012 14:36:03 | Computer Name = PC2 | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 04.07.2012 um 21:59:36 unerwartet heruntergefahren.


< End of report >


Mit GMER hatte ich dann ein Problem: Habe Netzwerkverbindungen wie beschrieben gekappt und Virenscanne und Firewall deaktiviert. Gmer wie beschrieben gestartet und beim ersten Mal "Programm hat ein Problem festgestellt und muss geschlossen werde"-Meldung erhalten. Beim zweiten Versuch folgte in Blue Screen gefolgt von einem sofortigem automatischen Systemneustart.

Helfen diese Punkte schon einmal? Wäre klasse, wenn jemand Zeit fände, mich zu unterstützen. Besten Dank vorab und viele Grüße in die Nacht!

hi
öffne mal bitte malwarebytes, berichte, dort sind alle logs, die werden automatisch gespeichert, bitte die, mit funden, posten

Hi! Vielen Dank für die schnelle Antwort. Tja, da habe ich ja leider keine Berichte/Logs mehr gefunden und bin mir sicher, es vorher durchgeführt zu haben. Die Liste ist nun leer. Macht es Sinn, den Scan zu diesem Zeitpunkt erneut laufen zu lassen?

Besten Dank!

schau unter quarantäne, obs dort funde gibt, wenn ja posten bitte

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop

• Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Leider ist auch der Ordner Quarantäne leer.

ComboFix ist gelaufen. Hier das Log:

Combofix Logfile:

ComboFix 12-07-12.02 - Admin 12.07.2012  22:06:58.1.4 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3325.2042 [GMT 2:00]
ausgeführt von:: c:\users\Bõr\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\kikin
c:\program files\kikin\default_settings.xml
c:\program files\kikin\file_list.txt
c:\program files\kikin\ie_kikin.dll
c:\program files\kikin\KikinBroker.exe
c:\program files\kikin\KikinCrashReporter.exe
c:\program files\kikin\uninst.exe
c:\users\Admin\AppData\Roaming\kikin
c:\users\Admin\AppData\Roaming\kikin\ff_kkes.xml
c:\users\Admin\AppData\Roaming\kikin\ie_configuration.xml
c:\users\Admin\AppData\Roaming\kikin\ie_kkes.xml
c:\users\Admin\AppData\Roaming\kikin\ie_settings.xml
c:\users\Public\invokesi.exe
K:\autorun.inf
L:\autorun.inf
O:\Autorun.inf
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-12 bis 2012-07-12  ))))))))))))))))))))))))))))))
.
.
2012-07-12 20:15 . 2012-07-12 20:15	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-12 20:15 . 2012-07-12 20:15	--------	d-----w-	c:\users\Bär\AppData\Local\temp
2012-07-12 19:25 . 2012-05-31 03:41	6762896	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{58DF0F0C-A122-4A26-ACB5-5CFE36BD1296}\mpengine.dll	ERROR(0x00000005)
2012-07-11 23:38 . 2012-06-13 13:40	2047488	----a-w-	c:\windows\system32\win32k.sys
2012-07-11 19:52 . 2012-06-05 16:47	708608	----a-w-	c:\program files\Common Files\System\ado\msado15.dll
2012-07-11 19:52 . 2012-06-05 16:47	1401856	----a-w-	c:\windows\system32\msxml6.dll
2012-07-11 19:52 . 2012-06-05 16:47	1248768	----a-w-	c:\windows\system32\msxml3.dll
2012-07-11 19:52 . 2012-06-04 15:26	440704	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-07-11 19:52 . 2012-06-02 00:04	278528	----a-w-	c:\windows\system32\schannel.dll
2012-07-11 19:52 . 2012-06-02 00:03	204288	----a-w-	c:\windows\system32\ncrypt.dll
2012-07-09 22:28 . 2012-07-09 22:28	--------	d-----w-	c:\users\Bär\AppData\Roaming\Malwarebytes
2012-07-09 20:28 . 2012-07-09 20:28	--------	d-----w-	c:\users\Admin\AppData\Roaming\Malwarebytes
2012-07-09 20:28 . 2012-04-04 13:56	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-07-09 20:28 . 2012-07-09 20:28	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-07-02 18:16 . 2012-07-02 18:16	--------	d-----w-	c:\program files\iPod
2012-07-01 08:24 . 2012-06-02 22:19	53784	----a-w-	c:\windows\system32\wuauclt.exe
2012-07-01 08:24 . 2012-06-02 22:19	45080	----a-w-	c:\windows\system32\wups2.dll
2012-07-01 08:24 . 2012-06-02 22:19	1933848	----a-w-	c:\windows\system32\wuaueng.dll
2012-07-01 08:24 . 2012-06-02 22:12	2422272	----a-w-	c:\windows\system32\wucltux.dll
2012-07-01 08:20 . 2012-06-02 22:19	35864	----a-w-	c:\windows\system32\wups.dll
2012-07-01 08:20 . 2012-06-02 22:19	577048	----a-w-	c:\windows\system32\wuapi.dll
2012-07-01 08:20 . 2012-06-02 22:12	88576	----a-w-	c:\windows\system32\wudriver.dll
2012-07-01 08:20 . 2012-06-02 13:19	171904	----a-w-	c:\windows\system32\wuwebv.dll
2012-07-01 08:20 . 2012-06-02 13:12	33792	----a-w-	c:\windows\system32\wuapp.exe
2012-06-13 06:13 . 2012-04-23 16:00	984064	----a-w-	c:\windows\system32\crypt32.dll
2012-06-13 06:13 . 2012-04-23 16:00	98304	----a-w-	c:\windows\system32\cryptnet.dll
2012-06-13 06:13 . 2012-04-23 16:00	133120	----a-w-	c:\windows\system32\cryptsvc.dll
2012-06-13 06:12 . 2012-05-01 14:03	180736	----a-w-	c:\windows\system32\drivers\rdpwd.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-11 19:52 . 2012-04-01 08:20	426184	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-07-11 19:52 . 2011-05-17 06:08	70344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-31 03:41 . 2009-03-25 16:06	6762896	----a-w-	c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll	ERROR(0x00000005)
2012-05-08 19:13 . 2012-02-25 19:39	137928	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-05-08 19:13 . 2009-06-03 21:25	83392	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-04-18 18:56 . 2012-04-18 18:56	94208	----a-w-	c:\windows\system32\QuickTimeVR.qtx
2012-04-18 18:56 . 2012-04-18 18:56	69632	----a-w-	c:\windows\system32\QuickTime.qts
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	1044480	----a-w-	c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02	200704	----a-w-	c:\program files\opera\program\plugins\ssldivx.dll
2006-05-03 10:06	163328	--sha-r-	c:\windows\System32\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\System32\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\System32\nbDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\System32\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-06-13 2734688]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
2010-06-13 17:10	2734688	----a-w-	c:\program files\Vuze_Remote\tbVuze.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2010-06-13 2734688]
.
[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-03-09 26100520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"zzzHPSETUP"="i:\setup.exe \RESET" [X]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-08 178712]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-09-01 75048]
"CLMLServer"="c:\program files\HomeCinema\Power2Go\CLMLSvc.exe" [2008-07-18 104936]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-03 6724128]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-02-03 1833504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 92704]
"ledpointer"="CNYHKey.exe" [2006-11-09 5585408]
"MoLed"="ModLEDKey.exe" [2006-11-09 53248]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX6000"="c:\windows\vVX6000.exe" [2007-04-10 996712]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"dcmsvc"="c:\program files\dcmsvc\dcmsvc.exe" [2009-04-07 30440]
"PDFPrint"="c:\program files\pdf24\pdf24.exe" [2010-02-22 207504]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
"SAFEOEM HotKeys"="c:\program files\Steganos Safe OEM\SteganosHotKeyService.exe" [2008-12-11 26112]
"Eraser"="c:\progra~1\Eraser\Eraser.exe" [2010-11-04 980368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_2008_PLUS\TrayServer.exe" [2007-03-29 90112]
"AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2009-11-11 771360]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 acedrv10;acedrv10;c:\windows\system32\drivers\acedrv10.sys [x]
S2 acehlp10;acehlp10;c:\windows\system32\drivers\acehlp10.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-01-27 20:28	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 19:52]
.
2012-07-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-27 18:34]
.
2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 16:58]
.
2012-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 16:58]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Alles mit FDM herunterladen - file://c:\program files\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://c:\program files\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://c:\program files\Free Download Manager\dllink.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay - eine der größten deutschen Shopping-Websites
IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - c:\program files\kikin\ie_kikin.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qmtt8mp2.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - %profile%\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{E601996F-E400-41CA-804B-CD6373A7EEE2} - c:\program files\kikin\ie_kikin.dll
AddRemove-OVT Scanner - c:\windows\omniuns.exe USB\Vid_05a9&PID_1550 OVT Scanner
AddRemove-_{ADDBE07D-95B8-4789-9C76-187FFF9624B4} - c:\program files\Corel\CorelDRAW Essential Edition 3\Programs\MSILauncher {ADDBE07D-95B8-4789-9C76-187FFF9624B4}
AddRemove-{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA} - c:\program files\kikin\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-07-12 22:15
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
.
c:\windows\TEMP\TMP0000003800C9B49B5B6DD2B3 524288 bytes
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\program files\HomeCinema\PowerDVD9\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*%W%’
]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*%W%’
\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*%W%’
]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*%W%’
\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*P%w**]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*P%w**\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*]%~*¸*]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1678308919-4042785047-3860293362-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*]%~*¸*\OpenWithList]
@Class="Shell"
.
Zeit der Fertigstellung: 2012-07-12  22:17:39
ComboFix-quarantined-files.txt  2012-07-12 20:17
.
Vor Suchlauf: 7 Verzeichnis(se), 272.862.171.136 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 286.141.353.984 Bytes frei
.
- - End Of File - - 9A8080B7FF1BB6C7AFD322C6513673CF
         

--- --- ---

lade den CCleaner standard:
CCleaner Download - CCleaner 3.20.1750
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

OK, dann wäre das diese Liste hier:

ABC Amber Audio Converter 04.08.2011 1,47MB UNNÖTIG
Adobe AIR Adobe Systems Inc. 16.01.2010 30,6MB 1.5.3.9120 UNNÖTIG
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 27.05.2009 10.0.22.87 UNBEKANNT
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 11.07.2012 11.3.300.265 UNBEKANNT
Adobe Reader X (10.1.3) - Deutsch Adobe Systems Incorporated 12.04.2012 121MB 10.1.3 NOTWENDIG
Adobe Shockwave Player 11.5 Adobe Systems, Inc. 27.05.2009 21,2MB 11.5 UNBEKANNT
AirPort Apple Inc. 15.10.2011 11,5MB 5.5.3.2 NOTWENDIG
Amazon MP3-Downloader 1.0.5 04.07.2009 1,67MB UNNÖTIG
Apple Application Support Apple Inc. 02.07.2012 60,9MB 2.1.9 UNBEKANNT
Apple Mobile Device Support Apple Inc. 02.07.2012 24,2MB 5.2.0.6 UNBEKANNT
Apple Software Update Apple Inc. 06.08.2011 2,38MB 2.1.3.127 NOTWENDIG
ArcSoft PhotoImpression 6 ArcSoft 05.12.2010 50,9MB 6.1.8.146 UNBEKANNT
Audacity 1.3.13 (Unicode) Audacity Team 05.08.2011 42,3MB UNNÖTIG
Audiograbber 1.83 SE Audiograbber Deutschland 26.07.2009 1.83 SE NOTWENDIG
Audiograbber Lame-MP3-Plugin AG 26.07.2009 4,41MB 1.0 NOTWENDIG
Avidemux 2.5 05.03.2011 33,5MB 2.5.4.6714 NOTWENDIG
Avira Free Antivirus Avira 08.05.2012 60,2MB 12.0.0.1125 NOTWENDIG
AVS Audio Editor version 7.0 Online Media Technologies Ltd. 05.08.2011 19,3MB UNNÖTIG
AVS Update Manager 1.0 Online Media Technologies Ltd. 05.08.2011 11,8MB UNNÖTIG
AVS4YOU Software Navigator 1.4 Online Media Technologies Ltd. 05.08.2011 6,75MB UNNÖTIG
Bonjour Apple Inc. 15.10.2011 749KB 3.0.0.10 UNBEKANNT
CCleaner Piriform 22.06.2012 4,76MB 3.20 NOTWENDIG
CDBurnerXP CDBurnerXP 19.07.2009 7,01MB 4.2.4.1430 NOTWENDIG
Color LaserJet 1600 03.06.2009 1,42MB NOTWENDIG
Corel MediaOne Corel Corporation 02.04.2009 181MB 2.100.0000 UNBEKANNT
CyberLink LabelPrint CyberLink Corp. 22.04.2009 126MB 2.5.1616 UNBEKANNT
CyberLink MediaShow CyberLink Corp. 22.04.2009 182MB 4.1.2609 UNBEKANNT
CyberLink PhotoNow CyberLink Corp. 22.04.2009 21,7MB 1.1.5615 UNBEKANNT
CyberLink Power2Go CyberLink Corp. 22.04.2009 102MB 6.1.2806 UNBEKANNT
CyberLink PowerDirector CyberLink Corp. 22.04.2009 324MB 7.0.2718 UNBEKANNT
CyberLink PowerDVD 9 CyberLink Corp. 22.04.2009 195MB 9.0.1531 UNBEKANNT
CyberLink PowerDVD Copy CyberLink Corp. 27.05.2009 11,5MB 1.0.5611 UNBEKANNT
CyberLink PowerProducer CyberLink Corp. 22.04.2009 166MB 5.0.1.1412 UNBEKANNT
dcmsvc 1.0 16.01.2010 720KB UNBEKANNT
DivX Codec DivX, Inc. 26.07.2009 1,31MB 6.8.5 NOTWENDIG
DivX Converter DivX, Inc. 26.07.2009 45,3MB 7.1.0 NOTWENDIG
DivX Player DivX, Inc. 26.07.2009 8,43MB 7.2.0 NOTWENDIG
DivX Plus DirectShow Filters DivX, Inc. 26.07.2009 1,58MB NOTWENDIG
DivX Web Player DivX,Inc. 26.07.2009 2,83MB 1.5.0 NOTWENDIG
dm-Fotowelt 18.11.2010 397MB UNNÖTIG
DVD Profiler Version 3.7.2 17.10.2011 18,3MB NOTWENDIG
DVD Shrink 3.2 DVD Shrink 19.07.2009 996KB NOTWENDIG
DVDStyler v1.8.4 31.07.2011 30,9MB NOTWENDIG
ElsterFormular Landesfinanzdirektion Thüringen 18.12.2010 156MB 10.3.3.990 NOTWENDIG
ElsterFormular 2006/2007 Steuerverwaltung des Bundes und der Länder 10.07.2009 63,6MB 8.3.1.0 NOTWENDIG
ElsterFormular 2007/2008 Steuerverwaltung des Bundes und der Länder 18.12.2010 154MB 9.6.2.0 NE NOTWENDIG
ElsterFormular 2007/2008 Steuerverwaltung des Bundes und der Länder 10.07.2009 116MB 9.5.1.0 NOTWENDIG
ElsterFormular 2008/2009 Steuerverwaltung des Bundes und der Länder 11.07.2009 168MB 10.2.1.0 NOTWENDIG
ElsterFormular für Privatanwender Landesfinanzdirektion Thüringen 11.03.2011 453MB 12.1.1.6214p NOTWENDIG
Eraser 6.0.8.2273 The Eraser Project 29.04.2011 3,17MB 6.0.2273 NOTWENDIG
ffdshow v1.1.3814 [2011-04-11] 27.04.2011 14,7MB 1.1.3814.0 UNBEKANNT
Firebird SQL Server - MAGIX Edition MAGIX AG 03.08.2011 6,03MB 2.0.1.8 UNBEKANNT
Foto-Mosaik-Edda Standard V5.7.1 Steffen Schirmer 21.11.2010 3,46MB UNNÖTIG
fotokasten comfort 07.11.2010 18,1MB UNNÖTIG
Free Download Manager 3.0 FreeDownloadManager.ORG 14.07.2010 18,8MB UNNÖTIG
Free Video Converter V 2.8 Koyote Soft 13.06.2010 11,5MB 2.8.0.0 UNNÖTIG
Google Earth Google 19.11.2011 92,7MB 6.1.0.5001 NOTWENDIG
Google Updater Google Inc. 29.09.2011 4,56MB 2.4.2432.1652 UNBEKANNT
HP Imaging Device Functions 9.0 HP 08.06.2009 4,21MB 9.0 UNBEKANNT
HP OCR Software 9.0 HP 08.06.2009 4,20MB 9.0 UNBEKANNT
HP Photosmart Essential HP 08.06.2009 10,7MB 1.12.0.46 UNBEKANNT
HP Scanjet 4800 series 9.0 HP 08.06.2009 9,35MB 9.0 NOTWENDIG
HP Solution Center 9.0 HP 08.06.2009 4,20MB 9.0 UNBEKANNT
HP Update Hewlett-Packard 08.06.2009 3,71MB 4.000.006.002 UNBEKANNT
iClone SE Reallusion Inc. 03.08.2011 419MB 2.1 UNBEKANNT
iCloud Apple Inc. 25.12.2011 22,4MB 1.0.2.17 UNBEKANNT
Intel(R) Matrix Storage Manager 27.05.2009 8,14MB UNBEKANNT
IrfanView (remove only) 05.06.2009 10,2MB NOTWENDIG
iTunes Apple Inc. 02.07.2012 181MB 10.6.3.25 NOTWENDIG
Java(TM) 6 Update 13 Sun Microsystems, Inc. 26.03.2009 97,0MB 6.0.130 UNBEKANNT
LightScribe System Software LightScribe 22.04.2009 23,0MB 1.18.1.1 UNBEKANNT
MAGIX Fotobuch 3.2 MAGIX AG 03.08.2011 14,1MB 3.2 NOTWENDIG
MAGIX Online Druck Service 2.3.2.0 (D) MAGIX AG 03.08.2011 8,97MB 2.3.2.0 UNBEKANNT
MAGIX PC Visit MAGIX AG 03.08.2011 1,68MB 4.3.6.1987 UNBEKANNT
MAGIX Video deluxe 2008 PLUS 7.5.0.20 (D) MAGIX AG 03.08.2011 438MB 7.5.0.20 NOTWENDIG
MAGIX Xtreme Foto Designer 6 6.0.22.0 (D) MAGIX AG 03.08.2011 28,5MB 6.0.22.0 UNBEKANNT
Malwarebytes Anti-Malware Version 1.61.0.1400 Malwarebytes Corporation 09.07.2012 11,6MB 1.61.0.1400 NOTWENDIG
MCE Software Encoder 1.1 CyberLink Corporation 27.05.2009 1,50MB 1.1.0.1918 UNBEKANNT
MICHELsoft 9.0.29 Easy Schwaneberger Verlag GmbH 22.04.2012 23,1MB 9.0.29 UNNÖTIG
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 24.03.2009 37,3MB UNBEKANNT
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 24.03.2009 37,3MB UNBEKANNT
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 25.06.2010 120MB 4.0.30319 UNBEKANNT
Microsoft LifeCam Microsoft 15.06.2009 57,6MB 1.40.164.0 NOTWENDIG
Microsoft Office Enterprise 2007 Microsoft Corporation 21.06.2009 615MB 12.0.4518.1014 NOTWENDIG
Microsoft Silverlight Microsoft Corporation 24.03.2009 12,0MB 2.0.40115.0 UNBEKANNT
Microsoft SQL Server 2005 Compact Edition [DEU] Microsoft Corporation 26.03.2009 332KB 3.1.0000 UNBEKANNT
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 26.03.2009 1,74MB 3.1.0000 UNBEKANNT
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 05.08.2011 294KB 8.0.61001 UNBEKANNT
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 25.07.2010 2,86MB 9.0.21022 UNBEKANNT
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 17.11.2010 597KB 9.0.30729 UNBEKANNT
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 03.06.2009 590KB 9.0.30729 UNBEKANNT
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 24.02.2012 11,1MB 10.0.40219 UNBEKANNT
Microsoft Works Microsoft Corporation 02.04.2009 378MB 9.7.0621 UNBEKANNT
MobileMe Control Panel Apple Inc. 25.12.2011 12,9MB 3.1.8.0 UNBEKANNT
Mozilla Firefox (3.0.10) Mozilla 05.06.2009 28,0MB 3.0.10 (de) UNNÖTIG
MSXML 4.0 SP2 (KB936181) Microsoft Corporation 02.04.2009 1,27MB 4.20.9848.0 UNBEKANNT
MSXML 4.0 SP2 (KB941833) Microsoft Corporation 02.04.2009 1,27MB 4.20.9849.0 UNBEKANNT
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 02.04.2009 1,29MB 4.20.9870.0 UNBEKANNT
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 24.11.2009 1,33MB 4.20.9876.0 UNBEKANNT
NVIDIA Drivers NVIDIA Corporation 27.05.2009 2,83GB 1.3 UNBEKANNT
NVIDIA PhysX NVIDIA Corporation 17.04.2009 119MB 9.09.0203 UNBEKANNT
O&O MediaRecovery O&O Software GmbH 02.04.2010 6,39MB 4.1.1322 UNBEKANNT
Opera 9.64 Opera Software ASA 05.06.2009 15,7MB 9.64 NOTWENDIG
OVT Scanner X86 OVT 05.12.2010 1,69MB 1.00.0000 UNBEKANNT
PDF24 Creator PDF24.org 02.03.2010 38,8MB NOTWENDIG
Phoenix Backup Professional SYDATEC 02.04.2010 13,4MB 3.5.000 UNBEKANNT
Picasa 3 Google, Inc. 07.11.2009 74,3MB 3.1 UNNÖTIG
ProtectDisc Helper Driver 10 03.08.2011 96,0KB 10.0.0.3 UNBEKANNT
QuickTime Apple Inc. 02.07.2012 73,2MB 7.72.80.56 NOTWENDIG
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 02.04.2009 9,78MB 6.0.1.5783 UNBEKANNT
RonyaSoft CD DVD Label Maker 3.01 RonyaSoft 06.08.2011 7,70MB 3.01 NOTWENDIG
Safari Apple Inc. 25.12.2011 43,2MB 5.34.52.7 UNNÖTIG
Sigel Professional Label Software SE 06.08.2011 9,67MB UNBEKANNT
Skype Toolbars Skype Technologies S.A. 29.03.2010 5,25MB 1.0.4051 UNBEKANNT
Skype™ 4.2 Skype Technologies S.A. 29.03.2010 31,6MB 4.2.155 NOTWENDIG
Spelling Dictionaries Support For Adobe Reader 9 Adobe Systems Incorporated 26.03.2009 64,6MB 9.0.0 UNBEKANNT
Steganos Safe OEM Steganos GmbH 02.04.2010 64,3MB 10.0.2 UNBEKANNT
SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49 eRightSoft 25.07.2011 40,0MB v2011.build.49 UNBEKANNT
TeamViewer 5 TeamViewer GmbH 17.11.2010 24,4MB 5.1.9385 NOTWENDIG
UnderCoverXP 1.23 Wicked & Wild Inc. 06.08.2011 2,25MB UNBEKANNT
USB Wireless Keyboard Driver My Company Name 27.05.2009 1,02MB V1.1 NOTWENDIG
VLC media player 0.9.9 VideoLAN Team 05.06.2009 63,1MB 0.9.9 NOTWENDIG
VoiceOver Kit Apple Inc. 24.11.2011 41,7MB 1.42.128.0 NOTWENDIG
Vuze Vuze Inc. 13.08.2010 19,1MB 4.5 UNNÖTIG
Vuze Remote Toolbar Vuze Remote 02.07.2010 2,81MB 5.7.2.2 UNNÖTIG
Warner Bros. Digital Copy Manager Warner Bros. Entertainment Inc. 16.01.2010 2,98MB 1.1 UNNÖTIG
Winamp Nullsoft, Inc 06.10.2009 35,2MB 5.56 NOTWENDIG
Windows Live Anmelde-Assistent Microsoft Corporation 17.04.2009 1,93MB 5.000.818.6 UNBEKANNT
Windows Live Essentials Microsoft Corporation 26.03.2009 136MB 14.0.8050.1202 UNBEKANNT
Windows Live Sync Microsoft Corporation 26.03.2009 2,79MB 14.0.8050.1202 UNBEKANNT
Windows Live-Uploadtool Microsoft Corporation 26.03.2009 225KB 14.0.8014.1029 UNBEKANNT
WinX DVD Author 5.9 DigiartySoft, Inc. 31.07.2011 38,8MB NOTWENDIG
Xilisoft DVD Creator 6 Xilisoft 25.07.2010 84,4MB 6.0.5.0305 NOTWENDIG
µTorrent 17.10.2010 388KB 2.0.3 UNNÖTIG

deinstaliere:
ABC
Adobe AIR
deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok



deinstaliere:
Adobe Shockwave
Amazon
ArcSoft
Audacity
AVS alle
CyberLink ^: alle
dm
Foto: beide
Free Video
iCloud
Java
Download der kostenlosen Java-Software
downloade java jre instalieren


deinstaliere:
LightScribe
MAGIX : alle die du nicht benötigst
MICHELsoft
Mozilla
OO
Phoenix
Picasa
Safari
Sigel
Skype toolbar
Spelling
Steganos
SUPER ©
UnderCoverXP
Vuze : beide
Warner
Windows Live : alle die die du nicht nutzt
µTorrent
öffne ccleaner, analysiern, starten
öffne otl, cleanup, nach neustart testen wie der pc läuft