Guten Morgen,

nun hat es auch mich erwischt. Leider.

Schritte bisher:
- Malwarescan unter PE -> alle Funde gelöscht leider kein Log
- Scan mit Spybot unter PE -> alles beseitigt
- Malwarescan unter XP (Rechner läuft also wieder halbwegs) -> ohne Befund
- Ausführung OTL wie hier im Forum beschrieben, Logs anbei

Meine Bitte: könntet ihr drüberschauen ob es der Rechner wieder tut? Vielen Dank für eure Hilfe

OTL.txt

OTL logfile created on: 16.08.2012 15:23:35 - Run 3
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Dokumente und Einstellungen\aaaa\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,48 Mb Total Physical Memory | 498,32 Mb Available Physical Memory | 48,69% Memory free
2,40 Gb Paging File | 1,93 Gb Available in Paging File | 80,39% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,66 Gb Total Space | 66,60 Gb Free Space | 68,19% Space Free | Partition Type: NTFS
Drive D: | 200,43 Gb Total Space | 196,20 Gb Free Space | 97,89% Space Free | Partition Type: NTFS
 
Computer Name: AAAA-94A8731DCE | User Name: aaaa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\aaaa\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
PRC - C:\Programme\Motorola Media Link\Lite\NServiceEntry.exe (Nero AG)
PRC - C:\Programme\Motorola\MotoHelper\MotoHelperService.exe ()
PRC - C:\Programme\Motorola\MotoHelper\MotoHelperAgent.exe ()
PRC - C:\Programme\Join Air\AssistantServices.exe ()
PRC - C:\Programme\Join Air\UIExec.exe ()
PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Programme\Verbindungsassistent\WTGService.exe ()
PRC - C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\PSIService.exe ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3619.39657__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3619.39629__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3619.39660__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3619.39738__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3619.39652__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3619.39643__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3619.39765__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3619.39641__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3619.39707__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3619.39692__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3619.39715__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3619.39716__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3619.39767__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3619.39714__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Dashboard\2.0.3619.39659__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Runtime\2.0.3619.39658__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Runtime\2.0.3619.39812__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3619.39782__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3619.39781__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3619.39695__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3619.39662__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3619.39728__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3619.39645__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3619.39660__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3619.39694__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3619.39702__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3619.39702__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3619.39694__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3619.39688__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3619.39692__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3619.39666__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3619.39694__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3619.39704__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3619.39622__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3619.39617__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3619.39763__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3619.39622__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3619.39774__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3619.39628__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3619.39623__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3619.39615__90ba9c70f846762e\LOG.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3619.39616__90ba9c70f846762e\NEWAEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3619.39620__90ba9c70f846762e\MOM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3619.39619__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3619.39616__90ba9c70f846762e\CLI.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3619.39765__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3619.39757__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3619.39618__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3619.39618__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Shared\2.0.3619.39658__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3619.39651__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3619.39641__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Shared\2.0.3619.39766__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3619.39617__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3619.39627__90ba9c70f846762e\DEM.Graphics.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3619.39621__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3619.39737__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3619.39781__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3619.39682__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3619.39714__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3619.39656__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3619.39642__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3619.39642__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3619.39642__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3619.39701__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3619.39628__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3619.39804__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3619.39693__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3619.39774__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3619.39706__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3619.39656__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.3619.39617__90ba9c70f846762e\APM.Foundation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3619.39623__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3619.39624__90ba9c70f846762e\AEM.Server.Shared.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3619.39750__90ba9c70f846762e\CLI.Component.Systemtray.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3619.39651__90ba9c70f846762e\CLI.Component.Wizard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3619.39758__90ba9c70f846762e\MOM.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3619.39755__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3619.39626__90ba9c70f846762e\CLI.Component.Runtime.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3619.39627__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3619.39622__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3619.39621__90ba9c70f846762e\CLI.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3619.39619__90ba9c70f846762e\LOG.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3619.39620__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3619.39650__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3619.39626__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3619.39636__90ba9c70f846762e\CLI.Component.Dashboard.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3619.39634__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3619.39757__90ba9c70f846762e\CCC.Implementation.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3619.39634__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3619.39658__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\APM.Server\2.0.3619.39625__90ba9c70f846762e\APM.Server.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3619.39624__90ba9c70f846762e\AEM.Server.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU ()
MOD - C:\Programme\Motorola Media Link\Lite\sqlite3.dll ()
MOD - C:\Programme\Motorola Media Link\Lite\NFileCacheDBAccess.dll ()
MOD - C:\Programme\Motorola Media Link\Lite\NAdvLog.dll ()
MOD - C:\Programme\Motorola Media Link\Lite\LiveupdateTactics.dll ()
MOD - C:\Programme\Motorola Media Link\Lite\DbAccess.dll ()
MOD - C:\Programme\Motorola\MotoHelper\MotoHelperService.exe ()
MOD - C:\Programme\Motorola\MotoHelper\MotoHelperAgent.exe ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b970b25b50013943b55df37d24a5b0ae\System.Runtime.Remoting.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\9e276fb38e26c54fb9bba140ab9bc9a9\System.Web.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\ceb0ee675f79ba4bbdcacb046922e461\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\4ebe925e576dca44a486e1675def5996\Accessibility.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\09f578421f8c594bbd78748ccf7b07b3\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\01f02bfc1497fa4993861da3691fc1a5\System.Windows.Forms.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\10582aeff0a6264e9b146356330ca9df\System.Drawing.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\6969bbb581ffad4e957de3c0b02d463c\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\620271c6a1ea374a95b76d2eea4b26a5\mscorlib.ni.dll ()
MOD - C:\Programme\Join Air\AssistantServices.exe ()
MOD - C:\Programme\Join Air\UIExec.exe ()
MOD - C:\Programme\Verbindungsassistent\WTGService.exe ()
MOD - C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll ()
MOD - C:\WINDOWS\system32\PSIService.exe ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (DeviceMonitorService) -- C:\Programme\Motorola Media Link\Lite\NServiceEntry.exe (Nero AG)
SRV - (MotoHelper) -- C:\Programme\Motorola\MotoHelper\MotoHelperService.exe ()
SRV - (UI Assistant Service) -- C:\Programme\Join Air\AssistantServices.exe ()
SRV - (WTGService) -- C:\Programme\Verbindungsassistent\WTGService.exe ()
SRV - (AVM WLAN Connection Service) -- C:\Programme\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (MZCCntrl) -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (ProtexisLicensing) -- C:\WINDOWS\system32\PSIService.exe ()
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (motusbdevice) -- system32\DRIVERS\motusbdevice.sys File not found
DRV - (lredbooo) -- C:\DOKUME~1\aaaa\LOKALE~1\Temp\lredbooo.sys File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (motccgp) -- C:\WINDOWS\system32\drivers\motccgp.sys (Motorola)
DRV - (motmodem) -- C:\WINDOWS\system32\drivers\motmodem.sys (Motorola)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (SCL01132) -- C:\WINDOWS\system32\drivers\SCL01132.sys (SCM Microsystems Inc.)
DRV - (Motousbnet) -- C:\WINDOWS\system32\drivers\Motousbnet.sys (Motorola)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ithsgt) -- C:\WINDOWS\system32\drivers\ithsgt.sys ()
DRV - (lilsgt) -- C:\WINDOWS\system32\drivers\lilsgt.sys ()
DRV - (atksgt) -- C:\WINDOWS\system32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\WINDOWS\system32\drivers\lirsgt.sys ()
DRV - (AtiHdmiService) -- C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (massfilter) -- C:\WINDOWS\system32\drivers\massfilter.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) -- C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) -- C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) -- C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (motccgpfl) -- C:\WINDOWS\system32\drivers\motccgpfl.sys (Motorola)
DRV - (BTCFilterService) -- C:\WINDOWS\system32\drivers\motfilt.sys (Motorola Inc)
DRV - (STCFUx32) -- C:\WINDOWS\system32\drivers\STCFUx32.sys (SCM Microsystems Inc.)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (FWLANUSB) -- C:\WINDOWS\system32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (avmeject) -- C:\WINDOWS\system32\drivers\avmeject.sys (AVM Berlin)
DRV - (nm) -- C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (MotoSwitchService) -- C:\WINDOWS\system32\drivers\motswch.sys (Motorola)
DRV - (MACNDIS5) -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MAcNdis5.sys (Marmiko IT-Solutions GmbH)
DRV - (nvata) -- C:\WINDOWS\system32\drivers\nvata.sys (NVIDIA Corporation)
DRV - (nvnetbus) -- C:\WINDOWS\system32\drivers\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\WINDOWS\system32\drivers\NVENETFD.sys (NVIDIA Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
IE - HKU\.DEFAULT\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=9a01ee13-36a2-47cd-9133-dc1efac13865&apn_sauid=F82202B2-4280-46EC-9B25-9DE0767BD9F0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
IE - HKU\S-1-5-18\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=9a01ee13-36a2-47cd-9133-dc1efac13865&apn_sauid=F82202B2-4280-46EC-9B25-9DE0767BD9F0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes,DefaultScope = {DE7C15B0-9B83-45B6-99FD-E4B07BE095E6}
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=9a01ee13-36a2-47cd-9133-dc1efac13865&apn_sauid=F82202B2-4280-46EC-9B25-9DE0767BD9F0
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{868B4BDE-5816-481A-BD0F-81E555F4DD23}: "URL" = hxxp://suche.t-online.de/cgi-bin/swl?br=ie7&q={searchTerms}
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{DE7C15B0-9B83-45B6-99FD-E4B07BE095E6}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.1.1
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8153
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.6&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{4F3D26C8-9907-48ff-BC74-B8C572D317BF}: C:\Programme\AusweisApp\mozilla\eCardClientExt_FFxx_Win [2012.02.02 16:57:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{4F0963A3-1658-4fde-9585-23A25CC288BF}: C:\Programme\AusweisApp\mozilla\eCardClientPIn_FFxx_Win [2012.02.02 16:57:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.07.20 17:28:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.05.18 00:31:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2012.07.12 21:00:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
 
[2009.02.08 21:20:17 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Extensions
[2010.10.26 16:41:18 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.08.16 15:24:34 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\extensions
[2012.08.14 07:19:25 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-1.xml
[2012.03.18 22:00:00 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-10.xml
[2012.04.02 15:54:29 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-11.xml
[2012.04.30 21:53:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-12.xml
[2012.06.13 21:19:17 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-13.xml
[2012.06.21 20:58:20 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-14.xml
[2012.07.23 19:16:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-15.xml
[2011.11.04 19:00:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-2.xml
[2011.12.21 22:36:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-3.xml
[2011.12.23 16:08:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-4.xml
[2011.12.23 16:11:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-5.xml
[2012.02.02 19:48:51 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-6.xml
[2012.02.12 03:23:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-7.xml
[2012.02.18 11:24:55 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-8.xml
[2012.02.19 12:28:30 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-9.xml
[2010.10.12 19:11:57 | 000,000,944 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin.xml
[2012.02.22 18:28:31 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.08.30 16:53:32 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.07.20 17:28:19 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.02.22 18:11:52 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 12:48:01 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 13:02:53 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001.08.23 12:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (AusweisApp 1.7.0.0) - {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} - C:\Programme\AusweisApp\siqeCardClient.ols (OpenLimit SignCubes AG)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ApnUpdater] "C:\Programme\Ask.com\Updater\Updater.exe" File not found
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup File not found
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit File not found
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [UIExec] C:\Programme\Join Air\UIExec.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [alfyqdokptvnhmb] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\alfyqdok.exe File not found
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [Huobykex] "C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Yntuo\isux.exe" File not found
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [Registry Reviver] C:\Programme\Reviversoft\Registry Reviver\RegistryReviver.exe File not found
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [RegistryBooster] "C:\Programme\Uniblue\RegistryBooster\launcher.exe" delay 20000  File not found
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00  [binary data]
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon\Easy-WebPrint\Resource.dll ()
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C212D449-8B3C-41F2-BD9A-047BD770550F} hxxp://www.fiaa.eu/OPLauncher.cab (Perparer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D66D084-28A8-4988-BCC3-7CA3F2996919}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\aaaa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\aaaa\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Programme\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.01.29 17:10:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\Shell - "" = AutoRun
O33 - MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\Shell\AutoRun\command - "" = G:\setup.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.16 13:19:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Malwarebytes
[2012.08.16 13:19:16 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\aaaa\Desktop\OTL.exe
[2012.08.16 13:18:53 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.08.16 13:18:51 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.08.16 13:18:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.08.16 13:18:50 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.08.15 14:56:39 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.08.15 13:39:25 | 000,000,000 | ---D | C] -- C:\ProgramData
[2012.08.14 08:26:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hybyccmqpkccswo
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.16 15:21:49 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.16 15:21:48 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\WinMaximizer-aaaa-Startup.job
[2012.08.16 15:20:27 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2012.08.16 15:17:25 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.08.16 15:10:06 | 000,000,239 | -HS- | M] () -- C:\boot.ini
[2012.08.16 14:57:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.16 13:19:02 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\aaaa\Desktop\OTL.exe
[2012.08.16 13:18:53 | 000,000,756 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.16 13:00:54 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2012.08.16 12:48:32 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.08.14 08:26:39 | 000,000,051 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\gcprzdkdxdxpfjs
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.16 15:10:05 | 000,001,575 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk
[2012.08.16 13:18:53 | 000,000,756 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.14 08:26:34 | 000,000,051 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\gcprzdkdxdxpfjs
[2012.05.15 20:49:25 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.05.15 19:19:18 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2012.05.15 19:19:12 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2012.05.15 18:30:34 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2011.12.22 20:35:38 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2009.11.21 14:29:33 | 000,022,328 | ---- | C] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\PnkBstrK.sys
[2009.11.20 20:27:34 | 000,065,920 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2009.03.27 18:28:45 | 000,000,137 | ---- | C] () -- C:\Dokumente und Einstellungen\aaaa\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2009.01.31 22:11:33 | 129,495,341 | ---- | C] () -- C:\Dokumente und Einstellungen\aaaa\aptmp.exe

< End of report >
         

Extras.txt

OTL Extras logfile created on: 16.08.2012 15:23:35 - Run 3
OTL by OldTimer - Version 3.2.57.0     Folder = C:\Dokumente und Einstellungen\aaaa\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,48 Mb Total Physical Memory | 498,32 Mb Available Physical Memory | 48,69% Memory free
2,40 Gb Paging File | 1,93 Gb Available in Paging File | 80,39% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 97,66 Gb Total Space | 66,60 Gb Free Space | 68,19% Space Free | Partition Type: NTFS
Drive D: | 200,43 Gb Total Space | 196,20 Gb Free Space | 97,89% Space Free | Partition Type: NTFS
 
Computer Name: AAAA-94A8731DCE | User Name: aaaa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\spiele\Ubisoft\Crytek\Far Cry\Bin32\FarCry.exe" = D:\spiele\Ubisoft\Crytek\Far Cry\Bin32\FarCry.exe:*:Enabled:Far Cry -- (Crytek)
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Programme\AVG\AVG8\avgtray.exe" = C:\Programme\AVG\AVG8\avgtray.exe:*:Disabled:AVG Free Tray Icon
"C:\Programme\AVG\AVG8\avgui.exe" = C:\Programme\AVG\AVG8\avgui.exe:*:Disabled:AVG Free User Interface
"C:\Programme\AVG\AVG8\avgemc.exe" = C:\Programme\AVG\AVG8\avgemc.exe:*:Disabled:avgemc.exe
"C:\Programme\AVG\AVG8\avgnsx.exe" = C:\Programme\AVG\AVG8\avgnsx.exe:*:Disabled:avgnsx.exe
"C:\Programme\AVG\AVG8\avgupd.exe" = C:\Programme\AVG\AVG8\avgupd.exe:*:Disabled:avgupd.exe
"C:\Programme\AVG\AVG8\avgwdsvc.exe" = C:\Programme\AVG\AVG8\avgwdsvc.exe:*:Disabled:avgwdsvc.exe
"C:\Programme\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe" = C:\Programme\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:*:Enabled:Tom Clancy's Rainbow Six Vegas 2 -- ()
"C:\Programme\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe" = C:\Programme\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe:*:Enabled:Tom Clancy's Rainbow Six Vegas 2 Update -- (Ubisoft)
"C:\Programme\Activision\Call of Duty 2\CoD2MP_s.exe" = C:\Programme\Activision\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s -- ()
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Programme\TeamViewer\Version7\TeamViewer.exe" = C:\Programme\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"C:\Programme\Motorola Media Link\Lite\MML.exe" = C:\Programme\Motorola Media Link\Lite\MML.exe:*:Enabled:MML -- (Nero AG)
"C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0339996A-1CC7-4FCD-8BE6-A32076E70272}" = Application Suite
"{044A302D-E89E-4645-8A1C-C9550E5C4695}" = Catalyst Control Center Graphics Light
"{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}" = Microsoft Games for Windows - LIVE Redistributable
"{08D2BBA3-3E66-E48A-3EB8-9D61BCA412E1}" = Catalyst Control Center Graphics Full Existing
"{101A21B2-E102-4F64-A7FA-CEF7182D0E2D}" = SCL011 Contactless Reader
"{11FE4069-3D6B-DD7F-F06C-6F8EA7F0958B}" = Catalyst Control Center Graphics Full New
"{12665B01-3F3A-4433-B179-9D8E352D7547}" = Try Corel Snapfire muvee autoProducer add on
"{15095BF3-A3D7-4DDF-B193-3A496881E003}" = Microsoft .NET Framework 3.0
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1D76A52C-87A6-4AB0-A7B0-08C8D5DF1D75}" = Motorola Mobile Drivers Installation 5.2.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{378397D6-FD32-4092-A854-6A75CB7EDA46}" = MOTOROLA MEDIA LINK
"{4094A6E0-7A56-5CE5-ED58-9268206104FB}" = CCC Help German
"{491DD792-AD81-429C-9EB4-86DD3D22E333}" = Windows Communication Foundation
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D243BA7-9AC4-46D1-90E5-EEB88974F501}" = Microsoft Games for Windows - LIVE 
"{62ED340C-678A-4841-8BD5-641410122538}" = AusweisApp
"{660787DD-68B3-4E67-9073-4A66DD7AD193}" = ASUS VGA Driver
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}" = Windows Workflow Foundation
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.1.2
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{943F6766-53F4-FE6C-4C11-44C9942EC6C8}" = ATI Catalyst Install Manager
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E31D61B-F2F0-D19B-26AA-D0DCDE714978}" = ATI AVIVO Codecs
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3F99B4B-34C0-EF98-AF11-EF7E9AD60CA0}" = Catalyst Control Center Core Implementation
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A961C6FD-C583-45F6-A0A4-5E4376C29E41}" = Catalyst Control Center - Branding
"{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}" = Join Air
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2011.10.29
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{B303F539-C566-3C0C-2CB1-6A7B137E432A}" = ccc-core-preinstall
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C9E27474-BA44-2B91-1213-4364E3E50443}" = ccc-core-static
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D10B0FAF-0BBC-4655-A31B-1C5EA3202152}" = REFLEX Modellflugsimulator
"{D45CF2D7-DA97-1ED5-2D6B-B005C245DA20}" = Catalyst Control Center InstallProxy
"{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}" = Far Cry
"{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}" = Canon PhotoRecord
"{E18FD195-D89D-0236-2703-1DD5ECDA8907}" = Catalyst Control Center Localization All
"{E38FFC95-2582-8A37-9EFC-3D08CFDD35B3}" = Skins
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{ED98C58F-EB57-009A-F948-27FA72FB2EF3}" = ccc-utility
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{FD416706-875C-4B0B-A23A-9E740DAE029E}" = Tom Clancy's Rainbow Six Vegas 2
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"CANONBJ_Deinstall_CNMCP66.DLL" = Canon PIXMA iP2000
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"Easy-WebPrint" = Easy-WebPrint
"GameSpy Arcade" = GameSpy Arcade
"Google Chrome" = Google Chrome
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}" = Far Cry
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0" = Microsoft .NET Framework 3.0
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"MotoHelper" = MotoHelper 2.0.53 Driver 5.2.0
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Picasa 3" = Picasa 3
"PokerStars.net" = PokerStars.net
"PunkBusterSvc" = PunkBuster Services
"RACE_is1" = RACE
"TeamViewer 7" = TeamViewer 7
"Verbindungsassistent" = Verbindungsassistent
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Avira SearchFree Toolbar plus Web Protection Updater
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Game Organizer" = EasyBits GO
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 13.05.2012 11:26:29 | Computer Name = AAAA-94A8731DCE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung MotoHelperService.exe, Version 2.0.53.0,
 fehlgeschlagenes Modul MotoHelperService.exe, Version 2.0.53.0, Fehleradresse 0x000055f5.
 
Error - 13.05.2012 11:26:39 | Computer Name = AAAA-94A8731DCE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung MotoHelperService.exe, Version 2.0.53.0,
 fehlgeschlagenes Modul MotoHelperService.exe, Version 2.0.53.0, Fehleradresse 0x000055f5.
 
Error - 13.05.2012 11:31:50 | Computer Name = AAAA-94A8731DCE | Source = JavaQuickStarterService | ID = 1
Description = 
 
Error - 13.05.2012 11:37:48 | Computer Name = AAAA-94A8731DCE | Source = JavaQuickStarterService | ID = 1
Description = 
 
Error - 13.05.2012 11:55:38 | Computer Name = AAAA-94A8731DCE | Source = JavaQuickStarterService | ID = 1
Description = 
 
Error - 13.05.2012 11:58:20 | Computer Name = AAAA-94A8731DCE | Source = JavaQuickStarterService | ID = 1
Description = 
 
Error - 24.05.2012 13:44:57 | Computer Name = AAAA-94A8731DCE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 12.0.0.4493, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 24.05.2012 13:48:48 | Computer Name = AAAA-94A8731DCE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 12.0.0.4493, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 17.06.2012 06:10:26 | Computer Name = AAAA-94A8731DCE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung CoD2MP_s.exe, Version 0.0.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 21.06.2012 15:32:04 | Computer Name = AAAA-94A8731DCE | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung CoD2MP_s.exe, Version 0.0.0.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
[ System Events ]
Error - 16.08.2012 09:06:06 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers
 fehlgeschlagen:   %%5
 
Error - 16.08.2012 09:06:24 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers
 fehlgeschlagen:   %%5
 
Error - 16.08.2012 09:06:24 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers
 fehlgeschlagen:   %%5
 
Error - 16.08.2012 09:06:55 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers
 fehlgeschlagen:   %%5
 
Error - 16.08.2012 09:06:55 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers
 fehlgeschlagen:   %%5
 
Error - 16.08.2012 09:06:58 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers
 fehlgeschlagen:   %%5
 
Error - 16.08.2012 09:06:58 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7006
Description = Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers
 fehlgeschlagen:   %%5
 
Error - 16.08.2012 09:22:59 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Avira Echtzeit Scanner" wurde unerwartet beendet. Dies
 ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 16.08.2012 09:23:02 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Avira Echtzeit Scanner" wurde unerwartet beendet. Dies
 ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 16.08.2012 09:23:07 | Computer Name = AAAA-94A8731DCE | Source = Service Control Manager | ID = 7034
Description = Dienst "Avira Echtzeit Scanner" wurde unerwartet beendet. Dies ist
 bereits 3 Mal passiert.
 
 
< End of report >
         

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Ersetze die *** Sternchen wieder in den Benutzernamen zurück!

:OTL
DRV - (WDICA) -- File not found 
DRV - (PDRFRAME) -- File not found 
DRV - (PDRELI) -- File not found 
DRV - (PDFRAME) -- File not found 
DRV - (PDCOMP) -- File not found 
DRV - (PCIDump) -- File not found 
DRV - (motusbdevice) -- system32\DRIVERS\motusbdevice.sys File not found 
DRV - (lredbooo) -- C:\DOKUME~1\aaaa\LOKALE~1\Temp\lredbooo.sys File not found 
DRV - (lbrtfdc) -- File not found 
DRV - (i2omgmt) -- File not found 
DRV - (Changer) -- File not found 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} 
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} 
IE - HKU\.DEFAULT\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=9a01ee13-36a2-47cd-9133-dc1efac13865&apn_sauid=F82202B2-4280-46EC-9B25-9DE0767BD9F0 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} 
IE - HKU\S-1-5-18\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=9a01ee13-36a2-47cd-9133-dc1efac13865&apn_sauid=F82202B2-4280-46EC-9B25-9DE0767BD9F0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\URLSearchHook: - No CLSID value found 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes,DefaultScope = {DE7C15B0-9B83-45B6-99FD-E4B07BE095E6} 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=9a01ee13-36a2-47cd-9133-dc1efac13865&apn_sauid=F82202B2-4280-46EC-9B25-9DE0767BD9F0 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{868B4BDE-5816-481A-BD0F-81E555F4DD23}: "URL" = http://suche.t-online.de/cgi-bin/swl?br=ie7&q={searchTerms} 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\SearchScopes\{DE7C15B0-9B83-45B6-99FD-E4B07BE095E6}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de 
IE - HKU\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.startup.homepage: "http://start.icq.com/" 
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.6&q=" 
O3 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. 
O3 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found. 
O3 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. 
O4 - HKLM..\Run: [ApnUpdater] "C:\Programme\Ask.com\Updater\Updater.exe" File not found 
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup File not found 
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit File not found 
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [alfyqdokptvnhmb] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\alfyqdok.exe File not found 
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [Huobykex] "C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Yntuo\isux.exe" File not found 
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [Registry Reviver] C:\Programme\Reviversoft\Registry Reviver\RegistryReviver.exe File not found 
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [RegistryBooster] "C:\Programme\Uniblue\RegistryBooster\launcher.exe" delay 20000 File not found 
O4 - HKU\S-1-5-21-1801674531-261903793-725345543-1003..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found 
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 
O7 - HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data] 
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Reg Error: Key error.) 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) 
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2009.01.29 17:10:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] 
O33 - MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\Shell - "" = AutoRun 
O33 - MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\Shell\AutoRun - "" = Auto&Play 
O33 - MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\Shell\AutoRun\command - "" = G:\setup.exe -a 
[2012.08.15 13:39:25 | 000,000,000 | ---D | C] -- C:\ProgramData 
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] 
[2009.01.31 22:11:33 | 129,495,341 | ---- | C] () -- C:\Dokumente und Einstellungen\aaaa\aptmp.exe 
[2012.08.14 07:19:25 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-1.xml 
[2012.03.18 22:00:00 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-10.xml 
[2012.04.02 15:54:29 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-11.xml 
[2012.04.30 21:53:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-12.xml 
[2012.06.13 21:19:17 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-13.xml 
[2012.06.21 20:58:20 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-14.xml 
[2012.07.23 19:16:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-15.xml 
[2011.11.04 19:00:02 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-2.xml 
[2011.12.21 22:36:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-3.xml 
[2011.12.23 16:08:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-4.xml 
[2011.12.23 16:11:27 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-5.xml 
[2012.02.02 19:48:51 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-6.xml 
[2012.02.12 03:23:15 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-7.xml 
[2012.02.18 11:24:55 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-8.xml 
[2012.02.19 12:28:30 | 000,000,950 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-9.xml 
[2010.10.12 19:11:57 | 000,000,944 | ---- | M] () -- C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin.xml 
[2012.02.16 13:02:53 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012.02.16 13:02:53 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml 
[2012.02.16 13:02:53 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012.02.16 13:02:53 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012.02.16 13:02:53 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml 
[2012.02.16 12:48:01 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml 
[2012.08.16 15:21:49 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job 
[2012.08.16 15:21:48 | 000,000,290 | ---- | M] () -- C:\WINDOWS\tasks\WinMaximizer-aaaa-Startup.job 
[2012.08.16 15:20:27 | 000,000,322 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job 
[2012.08.16 14:57:00 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Guten Morgen,

Vielen Dank für den Fix. Habe ihn direkt angewandt hier das Ergebnis:

All processes killed
========== OTL ==========
Service WDICA stopped successfully!
Service WDICA deleted successfully!
File  File not found not found.
Service PDRFRAME stopped successfully!
Service PDRFRAME deleted successfully!
File  File not found not found.
Service PDRELI stopped successfully!
Service PDRELI deleted successfully!
File  File not found not found.
Service PDFRAME stopped successfully!
Service PDFRAME deleted successfully!
File  File not found not found.
Service PDCOMP stopped successfully!
Service PDCOMP deleted successfully!
File  File not found not found.
Service PCIDump stopped successfully!
Service PCIDump deleted successfully!
File  File not found not found.
Service motusbdevice stopped successfully!
Service motusbdevice deleted successfully!
File  system32\DRIVERS\motusbdevice.sys File not found not found.
Service lredbooo stopped successfully!
Service lredbooo deleted successfully!
File  C:\DOKUME~1\aaaa\LOKALE~1\Temp\lredbooo.sys File not found not found.
Service lbrtfdc stopped successfully!
Service lbrtfdc deleted successfully!
File  File not found not found.
Service i2omgmt stopped successfully!
Service i2omgmt deleted successfully!
File  File not found not found.
Service Changer stopped successfully!
Service Changer deleted successfully!
File  File not found not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Registry key HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{868B4BDE-5816-481A-BD0F-81E555F4DD23}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{868B4BDE-5816-481A-BD0F-81E555F4DD23}\ not found.
Registry key HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\SearchScopes\{DE7C15B0-9B83-45B6-99FD-E4B07BE095E6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE7C15B0-9B83-45B6-99FD-E4B07BE095E6}\ not found.
HKU\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: "hxxp://start.icq.com/" removed from browser.startup.homepage
Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.1.6&q=" removed from keyword.URL
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NvCplDaemon not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NvMediaCenter not found.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\alfyqdokptvnhmb not found.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Huobykex not found.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\Registry Reviver not found.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\RegistryBooster not found.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run\\swg deleted successfully.
File move failed. C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\HonorAutoRunSetting deleted successfully.
Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1801674531-261903793-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Starting removal of ActiveX control {17492023-C23A-453E-A040-C7C580BBF700}
C:\WINDOWS\Downloaded Program Files\LegitCheckControl.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{17492023-C23A-453E-A040-C7C580BBF700}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17492023-C23A-453E-A040-C7C580BBF700}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{17492023-C23A-453E-A040-C7C580BBF700}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{17492023-C23A-453E-A040-C7C580BBF700}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{acf88354-71b5-11e1-8be5-001485de732a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{acf88354-71b5-11e1-8be5-001485de732a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{acf88354-71b5-11e1-8be5-001485de732a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{acf88354-71b5-11e1-8be5-001485de732a}\ not found.
File G:\setup.exe -a not found.
Item C:\ProgramData\ is whitelisted and cannot be moved.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\lMMLDeleteUserData42107612FX.tmp deleted successfully.
C:\Dokumente und Einstellungen\aaaa\aptmp.exe moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-10.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-11.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-12.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-13.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-14.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-15.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-2.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-3.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-4.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-5.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-6.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-7.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-8.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin-9.xml moved successfully.
C:\Dokumente und Einstellungen\aaaa\Anwendungsdaten\Mozilla\Firefox\Profiles\sg68trfm.default\searchplugins\icqplugin.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Programme\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\WINDOWS\tasks\WinMaximizer-aaaa-Startup.job moved successfully.
C:\WINDOWS\tasks\MP Scheduled Scan.job moved successfully.
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\Dokumente und Einstellungen\aaaa\Desktop\cmd.bat deleted successfully.
C:\Dokumente und Einstellungen\aaaa\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: aaaa
->Temp folder emptied: 99638815 bytes
->Temporary Internet Files folder emptied: 116989461 bytes
->Java cache emptied: 1177878 bytes
->FireFox cache emptied: 61404530 bytes
->Google Chrome cache emptied: 819568 bytes
->Flash cache emptied: 470 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 400707 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 18513155 bytes
 
User: nadine
->Temp folder emptied: 589317 bytes
->Temporary Internet Files folder emptied: 400837 bytes
->FireFox cache emptied: 5892400 bytes
 
User: NetworkService
->Temp folder emptied: 418756 bytes
->Temporary Internet Files folder emptied: 33237 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2289981 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 783732 bytes
RecycleBin emptied: 793478920 bytes
 
Total Files Cleaned = 1.052,00 mb
 
 
OTL by OldTimer - Version 3.2.57.0 log created on 08182012_095510

Files\Folders moved on Reboot...
File\Folder C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk not found!

PendingFileRenameOperations files...
File C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk not found!

Registry entries deleted on Reboot...
         

Ein schönes Wochenende für euch und nochmal Vielen Dank!

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Guten Morgen t'john,

der Rechner läuft normal, alles funktioniert wieder wie es sollte und ich hoffe das ich alles erwischt hab. Nicht zuletzt dank Deiner/Eurer Hilfe! Vielen Dank nochmal dafür, Hier die beiden Log's:

Malwarebytes Anti-Malware :

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.08.20.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
aaaa :: AAAA-94A8731DCE [Administrator]

20.08.2012 08:38:58
mbam-log-2012-08-20 (08-38-58).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P
Deaktivierte Suchlaufeinstellungen: 
Durchsuchte Objekte: 281704
Laufzeit: 52 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

AdwCleaner :

# AdwCleaner v1.801 - Logfile created 08/20/2012 at 09:41:06
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : aaaa - AAAA-94A8731DCE
# Boot Mode : Normal
# Running from : C:\Dokumente und Einstellungen\aaaa\Eigene Dateien\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

File Found : C:\user.js

***** [Registry] *****

Key Found : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar
Key Found : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar.1
Key Found : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem
Key Found : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem.1
Key Found : HKLM\SOFTWARE\Classes\toolband.pm_launcher
Key Found : HKLM\SOFTWARE\Classes\toolband.pm_launcher.1
Key Found : HKLM\SOFTWARE\Classes\toolband.pm_printmanager
Key Found : HKLM\SOFTWARE\Classes\toolband.pm_printmanager.1
Key Found : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback
Key Found : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback.1
Key Found : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler
Key Found : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler.1
Key Found : HKLM\SOFTWARE\Classes\toolband.tbtoolband
Key Found : HKLM\SOFTWARE\Classes\toolband.tbtoolband.1
Key Found : HKLM\SOFTWARE\Classes\toolband.useroptions
Key Found : HKLM\SOFTWARE\Classes\toolband.useroptions.1
Key Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [2317 octets] - [20/08/2012 09:41:06]

########## EOF - C:\AdwCleaner[R1].txt - [2445 octets] ##########
         

Einen guten Start in die neue Woche wünscht
Dosenbier

Sehr gut!

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Guten Morgen,

adwcleaner -> C:\AdwCleaner[S1].txt

# AdwCleaner v1.801 - Logfile created 08/20/2012 at 09:53:35
# Updated 14/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : aaaa - AAAA-94A8731DCE
# Boot Mode : Normal
# Running from : C:\Dokumente und Einstellungen\aaaa\Eigene Dateien\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\user.js

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar
Key Deleted : HKLM\SOFTWARE\Classes\toolband.eb_explorerbar.1
Key Deleted : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem
Key Deleted : HKLM\SOFTWARE\Classes\toolband.ipm_printlistitem.1
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pm_launcher
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pm_launcher.1
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pm_printmanager
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pm_printmanager.1
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pr_bindstatuscallback.1
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler
Key Deleted : HKLM\SOFTWARE\Classes\toolband.pr_cancelbuttoneventhandler.1
Key Deleted : HKLM\SOFTWARE\Classes\toolband.tbtoolband
Key Deleted : HKLM\SOFTWARE\Classes\toolband.tbtoolband.1
Key Deleted : HKLM\SOFTWARE\Classes\toolband.useroptions
Key Deleted : HKLM\SOFTWARE\Classes\toolband.useroptions.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [2446 octets] - [20/08/2012 09:41:06]
AdwCleaner[R2].txt - [2506 octets] - [20/08/2012 09:53:25]
AdwCleaner[S1].txt - [2485 octets] - [20/08/2012 09:53:35]

########## EOF - C:\AdwCleaner[S1].txt - [2613 octets] ##########
         

Malware-Scan mit Emsisoft Anti-Malware:

Emsisoft Anti-Malware - Version 6.6
Letztes Update: 21.08.2012 07:02:50

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	21.08.2012 07:05:22

c:\programme\gamespy arcade\custom 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\addins 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\cstrike\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\action 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\cstrike 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\firearms 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\frontline 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\gearbox 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\tfc 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\aq2 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\battle 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\chaosdm 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\freeze 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\gloom 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\gxmod 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\holywars 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\jail 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\kots 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\lfiredm 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\lithium2 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\lmctf 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\pball 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\q2comp 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\qpong 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\ra2 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\sconfig 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\tourney 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\wf 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\wod 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\alliance 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\beryllium 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\instagib 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\jailbreak 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\matchmod 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\osp 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\q3comp 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\q3f 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\q3ut2 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\requiem 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\rocketarena3 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\wfa 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\arena 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ch 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ctf 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ctfb 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ctfplus 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\dd 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\dm 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\duel 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\fr 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\mt 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\open cal 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\rpg 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\tac 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut\excessive 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut\rocketarena 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut\swat 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\images 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\images\portraits 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\profiles 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\profiles\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_common 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_demospy 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_fplanet 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_gnews 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_gspyder 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_support 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\skins 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\sounds 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\sounds\(default) 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\sounds\classic 	gefunden: Trace.File.gamespy arcade!E1
c:\dokumente und einstellungen\aaaa\startmenü\programme\gamespy arcade 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\aphex.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\banner.html 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\dat.bmp 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_banner.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_banner.html 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_bannerbg.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_loading.gif 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_logo.jpg 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_news.html 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\fpupdate.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade - debug.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade help.url 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade website.url 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy.com gaming's homepage.url 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gsapak.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gslan.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gsws.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\install.log 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\pw32.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\readme.html 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\register gamespy arcade.url 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\rptcrash.exe 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news\service_tab+.tga 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_support\rsrc.dir 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_support\service_tab.psd 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\ws_default.html 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\arcres.dll 	gefunden: Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\4dca9208.dat 	gefunden: Trace.File.gamespy arcade!E1
c:\dokumente und einstellungen\aaaa\desktop\gamespy arcade.lnk 	gefunden: Trace.File.gamespy arcade!E1
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir 	gefunden: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname 	gefunden: Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring 	gefunden: Trace.Registry.gamespy arcade!E1
C:\Dokumente und Einstellungen\aaaa\Eigene Dateien\Downloads\SoftonicDownloader_fuer_windows-media-player.exe 	gefunden: Riskware.Win32.SoftonicDownloader!E1

Gescannt	559123
Gefunden	120

Scan Ende:	21.08.2012 08:23:06
Scan Zeit:	1:17:44

C:\Dokumente und Einstellungen\aaaa\Eigene Dateien\Downloads\SoftonicDownloader_fuer_windows-media-player.exe	Quarantäne Riskware.Win32.SoftonicDownloader!E1
Value: hkey_current_user\software\gamespy\gamespy arcade --> instdir	Quarantäne Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> displayname	Quarantäne Trace.Registry.gamespy arcade!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\gamespy arcade --> uninstallstring	Quarantäne Trace.Registry.gamespy arcade!E1
c:\programme\gamespy arcade\custom	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\cstrike	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\addins	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\cstrike\frontline	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\action	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\cstrike	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\firearms	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\frontline	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\gearbox	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\halflife\tfc	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\aq2	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\battle	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\chaosdm	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\duel	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\freeze	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\gloom	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\gxmod	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\holywars	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\jail	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\kots	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\lfiredm	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\lithium2	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\lmctf	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\pball	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\q2comp	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\qpong	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\ra2	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\requiem	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\sconfig	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\tourney	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\wf	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake2\wod	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\alliance	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\beryllium	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\excessive	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\instagib	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\jailbreak	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\matchmod	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\osp	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\q3comp	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\q3f	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\q3ut2	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\requiem	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\rocketarena3	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\quake3\wfa	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\arena	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ch	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ctf	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ctfb	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\ctfplus	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\dd	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\dm	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\duel	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\fr	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\mt	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\open cal	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\rpg	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\tribes\tac	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut\excessive	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut\rocketarena	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\custom\ut\swat	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\images	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\images\portraits	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\profiles	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\profiles\(default)	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_common	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_demospy	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_fplanet	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_gnews	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_gspyder	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_support	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\skins	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\sounds	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\sounds\(default)	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\sounds\classic	Quarantäne Trace.File.gamespy arcade!E1
c:\dokumente und einstellungen\aaaa\startmenü\programme\gamespy arcade	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\aphex.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\banner.html	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\dat.bmp	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_banner.gif	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_banner.html	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_bannerbg.jpg	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_loading.gif	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_logo.jpg	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\def_news.html	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\fpupdate.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade - debug.lnk	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade help.url	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade website.url	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy arcade.lnk	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gamespy.com gaming's homepage.url	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gsapak.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gslan.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\gsws.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\install.log	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\pw32.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\readme.html	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\register gamespy arcade.url	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\rptcrash.exe	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news\rsrc.dir	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news\service_tab.psd	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_news\service_tab+.tga	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_support\rsrc.dir	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\services\_support\service_tab.psd	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\ws_default.html	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\arcres.dll	Quarantäne Trace.File.gamespy arcade!E1
c:\programme\gamespy arcade\4dca9208.dat	Quarantäne Trace.File.gamespy arcade!E1
c:\dokumente und einstellungen\aaaa\desktop\gamespy arcade.lnk	Quarantäne Trace.File.gamespy arcade!E1

Quarantäne	120
         

Viele Grüße
Dosenbier

Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

et voila das Log vom ESET Online Scanner

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=157dbce594c96240a1930f8fd54cf8dc
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-21 05:05:50
# local_time=2012-08-21 07:05:50 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1026 16777214 0 2 108858252 108858252 0 0
# compatibility_mode=1792 16777191 100 0 8464263 8464263 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 511 511 0 0
# scanned=88636
# found=3
# cleaned=3
# scan_time=3509
C:\Dokumente und Einstellungen\aaaa\Desktop\softonic_ggl_1.5.24.3.exe	Win32/Toolbar.Funmoods application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Dokumente und Einstellungen\aaaa\Eigene Dateien\Downloads\registrybooster.exe	Win32/RegistryBooster application (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hybyccmqpkccswo\main.html	HTML/Ransom.B trojan (cleaned by deleting - quarantined)	00000000000000000000000000000000	C
         

Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier
• Speichere die jxpiinstall.exe
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 6 ) herunter laden.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
• Klicke erneut OK.

Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck

Hallo t'john

Java wurde aktualisiert, die alte Version entfernt, Cache/temporäre Dateien gelöscht und die Einstellungen vorgenommen.

Und hier noch das Ergebnis vom PlugIn Check:

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

    Firefox 14.0.1 ist aktuell

    Flash (11,4,402,265) ist aktuell.

    Java (1,7,0,6) ist aktuell.

    Adobe Reader 10,1,4,38 ist aktuell.
         

Vielen Dank
Dosenbier

Sehr gut!

damit bist Du sauber und entlassen!

adwCleaner entfernen

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Uninstall.
• Bestätige mit Ja.

Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

• Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
• Speichere es auf Deinem Desktop.
• Doppelklick auf OTL.exe um das Programm auszuführen.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Klicke auf den Button "Bereinigung"
• OTL fragt eventuell nach einem Neustart.
  Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Systemwiederherstellungen leeren

Damit der Rechner nicht mit einer infizierten Systemwiederherstellung erneut infiziert werden kann, muessen wir diese leeren. Dazu schalten wir sie einmal aus und dann wieder ein:
Systemwiederherstellung deaktivieren Tutorial fuer Windows XP, Windows Vista, Windows 7
Danach wieder aktivieren.


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

• Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
• temporäre Dateien löschen.

Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
PC wird immer langsamer - was tun?

Hallo t'john,

Vielen Dank für Deine Unterstützung. Wirklich prima wie ihr hier "Unwissenden" helft ihre Kiste wieder flott zu kriegen und das auch noch für lau!

Respekt und Merci.

Dosenbier

wir wuenschen eine virenfreie Zeit