GVU-Trojaner mit Webcam

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard) 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\cmnsusbser.sys -- (cmnsusbser) 
IE - HKLM\..\SearchScopes,DefaultScope = {5308E876-2F31-469D-9161-67BE894E3ED9} 
IE - HKLM\..\SearchScopes\{5308E876-2F31-469D-9161-67BE894E3ED9}: "URL" = http://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={8BB0D223-A978-4BA7-9F34-9DADFCF1F7A9}&mid=6ba9a8ca512542638d5e30e04e96b36f-72c19b577b08692757de264850fd90e1a85a1e71&lang=de&ds=hk011&pr=sa&d=2012-07-15 15:47:41&v=11.1.0.12&sap=hp 
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233} 
IE - HKCU\..\SearchScopes\{21F23D3E-D738-4718-8BAD-ABC7868C87B3}: "URL" = http://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms} 
IE - HKCU\..\SearchScopes\{5A0AE168-9790-4650-A159-95AADB107CD4}: "URL" = http://www.google.de/search?q={searchTerms} 
IE - HKCU\..\SearchScopes\{5B6F482F-6429-4FA9-82C7-EC32F9CDDF72}: "URL" = http://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2 
IE - HKCU\..\SearchScopes\{6BC0351F-04A8-449C-AD7F-6999E6F9993E}: "URL" = http://search.softonic.com/MON00015/tb_v1?q={searchTerms}&SearchSource=4&cc= 
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={8BB0D223-A978-4BA7-9F34-9DADFCF1F7A9}&mid=6ba9a8ca512542638d5e30e04e96b36f-72c19b577b08692757de264850fd90e1a85a1e71&lang=de&ds=hk011&pr=sa&d=2012-07-15 15:47:41&v=11.1.0.12&sap=dsp&q={searchTerms} 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.startup.homepage: "http://isearch.avg.com?cid=%7B51b341e3-9e13-487f-a302-67dae3628962%7D&mid=6ba9a8ca512542638d5e30e04e96b36f-72c19b577b08692757de264850fd90e1a85a1e71&ds=hk011&v=11.1.0.12&lang=de&pr=sa&d=2012-07-15%2015%3A47%3A41&sap=hp" 
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B51b341e3-9e13-487f-a302-67dae3628962%7D&mid=6ba9a8ca512542638d5e30e04e96b36f-72c19b577b08692757de264850fd90e1a85a1e71&ds=hk011&v=11.1.0.12&lang=de&pr=sa&d=2012-07-15%2015%3A47%3A41&sap=ku&q=" 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. 
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) 
O16 - DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab (Java Plug-in 1.6.0_33) 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O33 - MountPoints2\{2a8bc2ca-77d4-11e1-9b26-88ae1df44cb6}\Shell - "" = AutoRun 
O33 - MountPoints2\{2a8bc2ca-77d4-11e1-9b26-88ae1df44cb6}\Shell\AutoRun\command - "" = E:\AutoRun.exe 
O33 - MountPoints2\{2a8bc2e7-77d4-11e1-9b26-88ae1df44cb6}\Shell - "" = AutoRun 
O33 - MountPoints2\{2a8bc2e7-77d4-11e1-9b26-88ae1df44cb6}\Shell\AutoRun\command - "" = E:\AutoRun.exe 
O33 - MountPoints2\{3f1484b8-6c33-11e0-97bd-88ae1df44cb6}\Shell - "" = AutoRun 
O33 - MountPoints2\{3f1484b8-6c33-11e0-97bd-88ae1df44cb6}\Shell\AutoRun\command - "" = E:\autorun.exe 
O33 - MountPoints2\{7352d6c2-77ee-11e1-9afb-88ae1df44cb6}\Shell - "" = AutoRun 
O33 - MountPoints2\{7352d6c2-77ee-11e1-9afb-88ae1df44cb6}\Shell\AutoRun\command - "" = E:\AutoRun.exe 
O33 - MountPoints2\{9cdb7dc2-2e13-11e1-b071-88ae1df44cb6}\Shell - "" = AutoRun 
O33 - MountPoints2\{9cdb7dc2-2e13-11e1-b071-88ae1df44cb6}\Shell\AutoRun\command - "" = E:\DPFMate.exe 
O33 - MountPoints2\E\Shell - "" = AutoRun 
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe 
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] 
[2012.08.08 12:55:31 | 000,302,592 | ---- | M] () -- C:\Users\ToSa\Desktop\ett98cf7.exe 
[2012.08.07 12:38:25 | 004,503,728 | ---- | M] () -- C:\ProgramData\rat_0ybba.pad 
[2012.08.06 12:01:20 | 000,001,884 | ---- | M] () -- C:\Users\ToSa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk 
[2012.04.21 08:09:54 | 000,002,060 | ---- | M] () -- C:\Users\ToSa\AppData\Roaming\Mozilla\Firefox\Profiles\sx3smlxf.default\searchplugins\softonic.xml 
[2011.06.08 15:44:47 | 000,287,024 | ---- | C] () -- C:\Users\ToSa\SoftonicDownloader_fuer_openoffice.exe 
:Files


ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]