Hallo,
zunächst mal ist mein Problem dass ich ein absoluter Laie bin und mich garnicht auskenne. Ich hab schon so einiges Probiert, aber egal was auch immer ich versuche es gibt immer etwas warum es dann doch nicht klappt.
Malwarebytes kann ich nicht anwenden da ich vor einigen Wochen ein ähnliches Problem hatte und nun die 30 Tage frist abgelaufen ist.
Kaspersky Windows Unlocker kann ich nicht benutzen, weil es keine exe. datei ist und ein Brennen auf Cd nicht klappt.
Im abgesicherten Modus eine Sytemwiederherstellung zu machen geht nicht, da ich keinen Wiederherstellungspunkt vor der Infektion habe (Vista).
Und so verbringe ich jetzt schon seit Tagen im Internet bei Google und sämtlichen Foren und versuche alles mögliche mit meinen Laien Kenntnissen.
So bin ich irgendwie von selbst darauf gekommen einen weiteren Benutzer im abgesicherten Modus zu erstellen, so kann ich jetzt zumindest ins Netz usw...
(keine Ahnung wie ich das gemacht habe) aber ich komme eben nicht an die Daten von dem ursprünglichen Nutzer ran, weil da immer dieser graue Ukash Trojaner alles blockiert.
Ich hab auch schon viele Antiviren Programme durchlaufen lassen.
(z.B. Dr.Web, und eines das spricht dessen Name mir entfallen ist,...). Die finden zwar teilweise was, löschen dies bzw schieben es in Quarantäne aber wenn ich, dann wieder zum "erkrankten" Benutzer rüberwechsle ist da wieder dieser widerliche graue blockierte Bildschirm. Ich vermute dass man den Virenscan mit dem infizierten Benutzer machen müsste. Bloß das geht halt aus genannten Gründen nicht. Und selbst im abgesicherten Modus geht dies nicht da sich dort keine Verbindung ins Netz herstellen läßt (Medion Stick will sich im abgesicherten Modus nicht verbinden lassen)
Also ihr seht, ich hab ne Menge probiert, und immer ein Problem mehr als Lösungen. Ich drehe bald durch. Vielleicht kann mir jemand von euch Schritt für Schritt und detailliert (und vor allem unfachmännisch) helfen.
Da wär ich euch echt sehr dankbar. Geht sowas ohne Datenverlust?
Wäre auch bereit ein Antiviren Programm wo man nur die Cd reinschieben muss und gut is, zu kaufen. Aber bitte nicht zu teuer, bin zur Zeit arbeitslos.

Vielen Dank schon mal fürs lesen, und sollte der Post hier nicht hingehören bitte nicht löschen. Ich wusste nicht wo ich es sonst Posten sollte.
Vielleicht kann man es ja einfach verschieben.

Jetzt bin ich neugierig und voller Vorfreude!

glg amuc

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
• Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
• Bitte kein Crossposting ( posten in mehreren Foren).
• Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
• Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
• Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

• Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Wähle Scanne Alle Benuzer
• Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
• Unter Extra Registrierung, wähle bitte Benutze SafeList
• Klicke nun auf Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in den Thread.

Hallo!
War das jetzt eine automatische Antwort?
Ich hab natürlich vor meinem Posting alles versucht und auch alles hier im Forum gelesen!
In meinem Posting steht aber ganz oben schon, dass ich Malwarebytes nicht anwenden kann weil....
Könnt ich es einfach so benutzen hätte ich garnicht erst gepostet!
Bitte mein Posting lesen. Danke!
lg

P.S Wäre bereit die Vollversion zu kaufen, allerdings kann ich diese nur Bar oder per Paysafecard zahlen. (oder im Laden halt) Diese Zahlungsmöglichkeit ist aber nirgends angegeben.

Geht der abgesicherte Modus?





Von einem sauberen PC OTL.exe runterladen auf USB Stick.
Infizierten Rechner ohne Internet starten. OTL.exe auf Desktop kopieren und Log erstellen.

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.

ansonsten:


Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:


Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

• Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
• Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
• Lege eine leere CD in Deinen Brenner.
• ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
• Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
• Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

• Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
• Mache einen Doppelklick auf das OTLPE Icon.
• Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
• Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
• OTLpe sollte nun starten.
• Drücke Run Scan, um den Scan zu starten.
• Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
• Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
• Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

.............................

Hallo hab das mal auf dem gleichen PC mit dem anderen Benutzer runtergeladen. Ich denke dass das ok ist?!
Ok hier die logfiles vom betroffenen Benutzer:OTL Logfile:

OTL logfile created on: 02.09.2012 13:35:11 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Susi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,57 Gb Available Physical Memory | 78,63% Memory free
4,23 Gb Paging File | 3,98 Gb Available in Paging File | 94,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 4,76 Gb Free Space | 2,04% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SUSI-PC | User Name: Susi | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Susi\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Steganos Safe 12\ShellExtension.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe File not found
SRV - (ALDITALKVerbindungsassistent_Service) -- C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (UMVPFSrv) -- C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Logitech Inc.)
SRV - (NIS) -- C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe (Symantec Corporation)
SRV - (NitroReaderDriverReadSpool) -- C:\Program Files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe (Nitro PDF Software)
SRV - (rpcapd) -- C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (AVerScheduleService) -- C:\Program Files\Common Files\AVerMedia\Service\AVerScheduleService.exe ()
SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (AVerRemote) -- C:\Program Files\Common Files\AVerMedia\Service\AVerRemote.exe (AVerMedia)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (AVM WLAN Connection Service) -- C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (gtstusbser) -- system32\DRIVERS\gtstusbser.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (ew_hwusbdev) -- C:\Windows\System32\drivers\ew_hwusbdev.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_enumerator) -- C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (IDSVix86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120507.001\IDSvix86.sys (Symantec Corporation)
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120507.022\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20120507.022\NAVENG.SYS (Symantec Corporation)
DRV - (BHDrvx86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120413.001\BHDrvx86.sys (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV - (LVUVC) -- C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVRS) -- C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMTDIv) -- C:\Windows\System32\drivers\NIS\1207020.003\symtdiv.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\Windows\System32\drivers\NIS\1207020.003\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) -- C:\Windows\System32\drivers\NIS\1207020.003\srtspx.sys (Symantec Corporation)
DRV - (SymEFA) -- C:\Windows\System32\drivers\NIS\1207020.003\symefa.sys (Symantec Corporation)
DRV - (SymDS) -- C:\Windows\System32\drivers\NIS\1207020.003\symds.sys (Symantec Corporation)
DRV - (SymIRON) -- C:\Windows\System32\drivers\NIS\1207020.003\ironx86.sys (Symantec Corporation)
DRV - (TridVid) -- C:\Windows\System32\drivers\TridVid6010.sys (10Moons Technologies Co.,Ltd)
DRV - (NPF) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (SLEE_17_DRIVER) -- C:\Windows\System32\drivers\SleeN17.sys (Softwareentwicklung Remus - ArchiCrypt - )
DRV - (AVerAF35) -- C:\Windows\System32\drivers\AVerAF35.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (UDXTTM6010) -- C:\Windows\System32\drivers\UDXTTM6010.sys ()
DRV - (TTHID) -- C:\Windows\System32\drivers\Cinergy_Hybrid_XE_HID.sys (DTV-DVB)
DRV - (irsir) -- C:\Windows\System32\drivers\irsir.sys (Microsoft Corporation)
DRV - (ManyCam) -- C:\Windows\System32\drivers\ManyCam.sys (ManyCam LLC.)
DRV - (ss_mdm) -- C:\Windows\System32\drivers\ss_mdm.sys (MCCI Corporation)
DRV - (ss_mdfl) -- C:\Windows\System32\drivers\ss_mdfl.sys (MCCI Corporation)
DRV - (ss_bus) -- C:\Windows\System32\drivers\ss_bus.sys (MCCI Corporation)
DRV - (nmwcd) -- C:\Windows\System32\drivers\nmwcd.sys (Nokia)
DRV - (nmwcdcm) -- C:\Windows\System32\drivers\nmwcdcm.sys (Nokia)
DRV - (nmwcdcj) -- C:\Windows\System32\drivers\nmwcdcj.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\nmwcdc.sys (Nokia)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (StarOpen) -- C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)
DRV - (k750bus) -- C:\Windows\System32\drivers\k750bus.sys (MCCI)
DRV - (k750mdfl) -- C:\Windows\System32\drivers\k750mdfl.sys (MCCI)
DRV - (k750mdm) -- C:\Windows\System32\drivers\k750mdm.sys (MCCI)
DRV - (k750mgmt) -- C:\Windows\System32\drivers\k750mgmt.sys (MCCI)
DRV - (k750obex) -- C:\Windows\System32\drivers\k750obex.sys (MCCI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt.
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ironto&s={searchTerms}&f=4
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Bar = hxxp://google.icq.com/search/search_frame.php
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Prev Search Page = ICQ.com Suche
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Der Such-Assistent von Internet Explorer 6 wird nicht länger unterstützt.
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?FORM=IEFM1&q={searchTerms}
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = hxxp://start.facemoods.com/?a=ironto&s={searchTerms}&f=4
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=T8&apn_dtid=YYYYYYYYDE&apn_uid=f82067ab-4ce1-4333-a785-95a6296261ee&apn_sauid=D68069E9-9208-454F-AD72-7AA80D069EC0
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rlz=1I7GCNV_de&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb165/?search={searchTerms}&loc=IB_DS&a=6OyE9rqAB7&i=26
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=14672"
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU2&o=14670&locale=de_DE&apn_uid=f82067ab-4ce1-4333-a785-95a6296261ee&apn_ptnrs=T8&apn_sauid=D68069E9-9208-454F-AD72-7AA80D069EC0&apn_dtid=YYYYYYYYDE&&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Susi\AppData\Roaming\Move Networks\plugins\npqmp071700000016.dll (Move Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2012.02.10 08:15:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4 [2012.09.02 13:22:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.05.23 02:40:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.05.23 02:40:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.06.06 20:38:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.13 13:55:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.15 18:08:40 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\moveplayer@movenetworks.com: C:\Users\Susi\AppData\Roaming\Move Networks [2011.05.16 16:10:51 | 000,000,000 | ---D | M]
 
[2012.08.13 13:56:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Susi\AppData\Roaming\mozilla\Extensions
[2012.08.13 13:55:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.22 02:06:08 | 000,002,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found.
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5825.1100\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\WLanGUI.exe (AVM GmbH Berlin)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Google Updater] C:\Program Files\Google\Google Updater\GoogleUpdater.exe (Google)
O4 - HKLM..\Run: [HFALoader] C:\Program Files\Hamster Soft\Free ZIP Archiver\HamsterArc.exe (Hamster Soft)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SAFE12 File Redirection Starter] C:\Program Files\Steganos Safe 12\fredirstarter.exe (Steganos Software GmbH)
O4 - HKLM..\Run: [SAFE12 HotKeys] C:\Program Files\Steganos Safe 12\SteganosHotKeyService.exe (Steganos Software GmbH)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [MyWirelessCard] C:\Program Files\Mobile Partner Manager\iCON 210\Mobile Partner Manager.exe File not found
O4 - HKCU..\Run: [phonostarTimer] C:\Program Files\phonostar-Player\phonostarTimer.exe ()
O4 - HKCU..\Run: [RegistryDoktorNET] C:\Program Files\Registry Doktor 4.1\RegistryDoktor.exe File not found
O4 - HKCU..\Run: [Remote Control Editor] "C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe" File not found
O4 - HKCU..\Run: [TSWorkspace] C:\Users\Susi\AppData\Local\Microsoft\Windows\2450\TSWorkspace.exe ()
O4 - Startup: C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk = C:\Program Files\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\microsoft shared\Reference 2001\EROProj.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Local intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Local intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{929E0CA3-D617-4B02-BEC7-6CCA557E7826}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\msero {B0D92A71-886B-453B-A649-1B91F93801E7} - C:\Program Files\Common Files\microsoft shared\Reference 2001\msero.dll ()
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img21.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img21.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{01fef648-916e-11e0-ae62-f750a72345bc}\Shell - "" = AutoRun
O33 - MountPoints2\{01fef648-916e-11e0-ae62-f750a72345bc}\Shell\AutoRun\command - "" = F:\QsSetup.exe
O33 - MountPoints2\{252100db-c548-11e1-969f-b8a0a3a2a44c}\Shell - "" = AutoRun
O33 - MountPoints2\{252100db-c548-11e1-969f-b8a0a3a2a44c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{252100fd-c548-11e1-969f-da5c66077c7a}\Shell - "" = AutoRun
O33 - MountPoints2\{252100fd-c548-11e1-969f-da5c66077c7a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\Shell - "" = AutoRun
O33 - MountPoints2\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{48e21a9b-5176-11e1-a57a-8953f03aed92}\Shell - "" = AutoRun
O33 - MountPoints2\{48e21a9b-5176-11e1-a57a-8953f03aed92}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{499667b2-83d8-11e1-958f-846f58978ae2}\Shell - "" = AutoRun
O33 - MountPoints2\{499667b2-83d8-11e1-958f-846f58978ae2}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{50a5b100-1e30-11e1-ab3c-b06150467d27}\Shell - "" = AutoRun
O33 - MountPoints2\{50a5b100-1e30-11e1-ab3c-b06150467d27}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\Shell - "" = AutoRun
O33 - MountPoints2\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{57146204-0014-11e1-9127-9ad8caac1f97}\Shell - "" = AutoRun
O33 - MountPoints2\{57146204-0014-11e1-9127-9ad8caac1f97}\Shell\AutoRun\command - "" = F:\QsSetup.exe
O33 - MountPoints2\{6eb5190c-513f-11de-b0d6-0019db52da6c}\Shell - "" = AutoRun
O33 - MountPoints2\{6eb5190c-513f-11de-b0d6-0019db52da6c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6eb51933-513f-11de-b0d6-0019db52da6c}\Shell - "" = AutoRun
O33 - MountPoints2\{6eb51933-513f-11de-b0d6-0019db52da6c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{71378025-52b1-11de-ac95-0019db52da6c}\Shell - "" = AutoRun
O33 - MountPoints2\{71378025-52b1-11de-ac95-0019db52da6c}\Shell\AutoRun\command - "" = F:\QsSetup.exe
O33 - MountPoints2\{74478bf1-cc38-11e1-914a-bc66000678ae}\Shell - "" = AutoRun
O33 - MountPoints2\{74478bf1-cc38-11e1-914a-bc66000678ae}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\Shell - "" = AutoRun
O33 - MountPoints2\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\Shell - "" = AutoRun
O33 - MountPoints2\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\Shell - "" = AutoRun
O33 - MountPoints2\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{84354467-c54d-11e1-96ea-ae78f46e1916}\Shell - "" = AutoRun
O33 - MountPoints2\{84354467-c54d-11e1-96ea-ae78f46e1916}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\Shell - "" = AutoRun
O33 - MountPoints2\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{99268586-1dc2-11e1-86ac-dd9a32903398}\Shell - "" = AutoRun
O33 - MountPoints2\{99268586-1dc2-11e1-86ac-dd9a32903398}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\Shell - "" = AutoRun
O33 - MountPoints2\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{a3dd5945-947b-11e1-8858-f10c43d73894}\Shell - "" = AutoRun
O33 - MountPoints2\{a3dd5945-947b-11e1-8858-f10c43d73894}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\Shell - "" = AutoRun
O33 - MountPoints2\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\Shell - "" = AutoRun
O33 - MountPoints2\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\Shell - "" = AutoRun
O33 - MountPoints2\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{ceb7c063-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun
O33 - MountPoints2\{ceb7c063-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ceb7c06d-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun
O33 - MountPoints2\{ceb7c06d-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ceb7c085-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun
O33 - MountPoints2\{ceb7c085-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1
O33 - MountPoints2\{ceb7c093-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun
O33 - MountPoints2\{ceb7c093-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ceb7c09b-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun
O33 - MountPoints2\{ceb7c09b-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun
O33 - MountPoints2\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\L\Shell - "" = AutoRun
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\QsSetup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.02 13:31:50 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\Susi\Desktop\OTL.exe
[2012.09.02 12:38:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.09.02 12:38:21 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.09.02 12:38:21 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.09.02 12:37:50 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.09.02 12:37:50 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.09.02 12:37:50 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.08.29 21:07:58 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2012.08.29 21:07:58 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012.08.29 16:24:40 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Roaming\hellomoto
[2012.08.27 15:24:25 | 000,000,000 | ---D | C] -- C:\Users\Susi\Desktop\Faceeeb
[2012.08.25 14:24:24 | 000,000,000 | ---D | C] -- C:\Users\Susi\Desktop\zurück
[2012.08.21 05:23:35 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Local\Logitech® Webcam-Software
[2012.08.21 05:12:38 | 000,000,000 | ---D | C] -- C:\ProgramData\LogiShrd
[2012.08.21 05:09:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Logitech
[2012.08.21 05:09:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LWS
[2012.08.21 05:09:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2012.08.21 05:09:12 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech
[2012.08.20 13:12:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2012.08.15 13:06:46 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.08.15 13:06:43 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.08.15 13:06:43 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.08.15 13:06:42 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.08.15 13:06:41 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.08.15 13:06:41 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.08.15 13:06:40 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.08.15 13:06:28 | 002,047,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.08.14 11:20:02 | 000,000,000 | ---D | C] -- C:\Users\Susi\Desktop\Screenshots
[2012.08.13 16:45:33 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Local\Macromedia
[2012.08.13 16:45:18 | 000,696,520 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.08.13 16:45:18 | 000,073,416 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.08.13 13:55:35 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Local\Mozilla
[2012.08.13 13:55:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.08.13 13:55:13 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2012.08.11 21:10:22 | 000,816,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDMOD.DLL
[2012.08.11 21:10:22 | 000,760,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSDMOD.DLL
[2012.08.11 21:10:22 | 000,384,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP4SDMOD.DLL
[2012.08.11 21:10:22 | 000,316,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MP43DMOD.DLL
[2012.08.11 21:10:22 | 000,241,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MPG4DMOD.DLL
[2012.08.11 21:10:21 | 000,278,559 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMV8DS32.AX
[2012.08.11 21:10:21 | 000,258,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDS32.AX
[2012.08.11 21:10:21 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSADDS32.AX
[2012.08.11 21:10:21 | 000,121,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mscal.ocx
[2012.08.11 21:10:21 | 000,074,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrclr40.dll
[2012.08.11 21:10:21 | 000,028,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrecr40.dll
[2012.08.11 21:10:21 | 000,000,000 | ---D | C] -- C:\Windows\System32\AIM
[2012.08.11 21:09:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NATIONAL GEOGRAPHIC
[2012.08.11 20:55:47 | 000,000,000 | ---D | C] -- C:\Program Files\ManyCam 2.4
[2012.08.11 20:55:47 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Roaming\ManyCam
[2012.08.11 12:46:46 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Roaming\Malwarebytes
[2012.08.11 12:46:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.11 12:33:02 | 000,000,000 | ---D | C] -- C:\Users\Susi\Documents\Simply Super Software
[2012.08.11 12:32:34 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012.08.10 15:12:29 | 000,000,000 | ---D | C] -- C:\Users\Susi\Desktop\100_FUJI
[2012.08.10 15:05:53 | 000,000,000 | ---D | C] -- C:\Users\Susi\Desktop\101_FUJI
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.02 13:33:19 | 000,627,978 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.02 13:33:19 | 000,125,898 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.02 13:33:19 | 000,103,682 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.02 13:33:19 | 000,004,254 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.02 13:29:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.02 13:26:50 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.09.02 13:22:19 | 000,003,792 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.02 13:22:19 | 000,003,792 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.02 13:02:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.02 12:37:08 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.09.02 12:36:55 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.09.02 12:36:55 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.09.02 12:36:54 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.09.02 12:36:53 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.09.02 12:36:52 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.09.02 10:21:04 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\Susi\Desktop\OTL.exe
[2012.09.01 14:02:00 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.08.30 11:52:19 | 000,001,356 | ---- | M] () -- C:\Users\Susi\AppData\Local\d3d9caps.dat
[2012.08.30 06:01:38 | 000,000,000 | ---- | M] () -- C:\Windows\System32\drivers\lvuvc.hs
[2012.08.29 21:09:52 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.08.27 15:22:00 | 000,109,463 | ---- | M] () -- C:\Users\Susi\Desktop\toppp.jpg
[2012.08.27 11:16:43 | 000,220,160 | ---- | M] () -- C:\Users\Susi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.25 19:07:10 | 008,806,445 | ---- | M] () -- C:\Users\Susi\Desktop\Bruno Mars-Grenade.mp3
[2012.08.23 07:19:34 | 000,000,873 | ---- | M] () -- C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
[2012.08.21 21:26:01 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.08.21 21:26:01 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.08.21 05:09:14 | 000,001,433 | ---- | M] () -- C:\Users\Public\Desktop\Logitech Webcam Software  .lnk
[2012.08.17 20:10:48 | 001,275,821 | ---- | M] () -- C:\Users\Susi\Desktop\IMG.jpg
[2012.08.17 18:32:09 | 003,408,594 | ---- | M] () -- C:\Users\Susi\Desktop\Bruno Mars - Grenade.mp3
[2012.08.17 18:32:04 | 000,006,984 | -HS- | M] () -- C:\Users\Susi\Desktop\Folder.jpg
[2012.08.17 18:32:04 | 000,006,984 | -HS- | M] () -- C:\Users\Susi\Desktop\AlbumArt_{4B137C4B-230F-4DCB-908D-AAC4687315A7}_Large.jpg
[2012.08.17 18:32:04 | 000,001,981 | -HS- | M] () -- C:\Users\Susi\Desktop\AlbumArtSmall.jpg
[2012.08.17 18:32:04 | 000,001,981 | -HS- | M] () -- C:\Users\Susi\Desktop\AlbumArt_{4B137C4B-230F-4DCB-908D-AAC4687315A7}_Small.jpg
[2012.08.17 07:43:23 | 001,034,747 | ---- | M] () -- C:\Users\Susi\Documents\0817074317DVB-TChannel 21Euronews.mpg
[2012.08.15 13:18:46 | 000,288,544 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.08.13 13:55:17 | 000,000,806 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.08.13 07:55:28 | 080,866,884 | ---- | M] () -- C:\Users\Susi\Documents\0813075136DVB-Ttagesschau24.mpg
[2012.08.11 12:26:37 | 004,503,728 | ---- | M] () -- C:\ProgramData\00etadpu.pad
[2012.08.11 10:53:02 | 1000,794,282 | ---- | M] () -- C:\Users\Susi\Documents\0811100315DVB-Ttagesschau24.mpg
[2012.08.07 00:35:49 | 1705,504,608 | ---- | M] () -- C:\Users\Susi\Documents\0806231533DVB-T(RTL) Television.mpg
[2012.08.04 14:11:43 | 007,968,072 | ---- | M] () -- C:\Users\Susi\Documents\0804141119DVB-TEinsPlus.mpg
 
========== Files Created - No Company Name ==========
 
[2012.08.27 15:20:49 | 000,109,463 | ---- | C] () -- C:\Users\Susi\Desktop\toppp.jpg
[2012.08.23 07:19:32 | 000,000,873 | ---- | C] () -- C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
[2012.08.21 05:09:14 | 000,001,433 | ---- | C] () -- C:\Users\Public\Desktop\Logitech Webcam Software  .lnk
[2012.08.17 20:10:47 | 001,275,821 | ---- | C] () -- C:\Users\Susi\Desktop\IMG.jpg
[2012.08.17 18:32:04 | 000,006,984 | -HS- | C] () -- C:\Users\Susi\Desktop\AlbumArt_{4B137C4B-230F-4DCB-908D-AAC4687315A7}_Large.jpg
[2012.08.17 18:32:04 | 000,001,981 | -HS- | C] () -- C:\Users\Susi\Desktop\AlbumArt_{4B137C4B-230F-4DCB-908D-AAC4687315A7}_Small.jpg
[2012.08.17 07:43:18 | 001,034,747 | ---- | C] () -- C:\Users\Susi\Documents\0817074317DVB-TChannel 21Euronews.mpg
[2012.08.16 13:19:34 | 008,806,445 | ---- | C] () -- C:\Users\Susi\Desktop\Bruno Mars-Grenade.mp3
[2012.08.16 13:15:09 | 003,408,594 | ---- | C] () -- C:\Users\Susi\Desktop\Bruno Mars - Grenade.mp3
[2012.08.13 16:45:19 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.13 13:55:17 | 000,000,806 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.08.13 13:55:16 | 000,000,818 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.08.13 07:51:36 | 080,866,884 | ---- | C] () -- C:\Users\Susi\Documents\0813075136DVB-Ttagesschau24.mpg
[2012.08.11 21:10:21 | 000,000,696 | ---- | C] () -- C:\Windows\System32\jetodbc.rsp
[2012.08.11 11:41:15 | 004,503,728 | ---- | C] () -- C:\ProgramData\00etadpu.pad
[2012.08.11 10:03:15 | 1000,794,282 | ---- | C] () -- C:\Users\Susi\Documents\0811100315DVB-Ttagesschau24.mpg
[2012.08.06 23:15:34 | 1705,504,608 | ---- | C] () -- C:\Users\Susi\Documents\0806231533DVB-T(RTL) Television.mpg
[2012.08.04 14:11:20 | 007,968,072 | ---- | C] () -- C:\Users\Susi\Documents\0804141119DVB-TEinsPlus.mpg
[2012.01.18 08:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\System32\LogiDPP.dll
[2012.01.18 08:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\System32\DevManagerCore.dll
[2012.01.18 08:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\System32\LogiDPPApp.exe
[2011.11.17 03:40:38 | 000,028,418 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2011.08.20 23:01:44 | 000,049,152 | R--- | C] () -- C:\Windows\System32\AVerIO.dll
[2011.08.20 23:01:44 | 000,003,456 | R--- | C] () -- C:\Windows\System32\AVerIO.sys
[2011.08.20 23:01:34 | 000,598,016 | R--- | C] () -- C:\Windows\System32\sptlib21.dll
[2011.08.20 23:01:34 | 000,307,200 | R--- | C] () -- C:\Windows\System32\sptlib01.dll
[2011.08.20 23:01:34 | 000,294,912 | R--- | C] () -- C:\Windows\System32\sptlib11.dll
[2011.08.20 23:01:34 | 000,290,816 | R--- | C] () -- C:\Windows\System32\sptlib22.dll
[2011.08.20 23:01:34 | 000,249,856 | R--- | C] () -- C:\Windows\System32\sptlib03.dll
[2011.08.20 23:01:34 | 000,225,280 | R--- | C] () -- C:\Windows\System32\sptlib02.dll
[2011.08.20 23:01:34 | 000,135,168 | R--- | C] () -- C:\Windows\System32\sptlib12.dll
[2011.08.12 12:20:14 | 000,015,896 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
[2011.05.11 22:40:27 | 000,000,121 | ---- | C] () -- C:\Windows\disney.ini
[2011.02.22 22:43:06 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011.02.22 16:49:48 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.02.22 16:49:47 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.01.10 21:43:28 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2009.06.14 18:06:48 | 000,001,356 | ---- | C] () -- C:\Users\Susi\AppData\Local\d3d9caps.dat
[2009.06.07 02:03:33 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2009.04.12 03:11:50 | 000,024,206 | ---- | C] () -- C:\Users\Susi\AppData\Roaming\UserTile.png
[2007.05.09 21:50:11 | 000,220,160 | ---- | C] () -- C:\Users\Susi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Documents\1204235145DVB-TEinsExtra.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Documents\1204110356DVB-TN24.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\Sil suffisait Daimer.mp3:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\I WAS BORN TO LOVE YOU.mp4:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\Bruno Mars-Grenade.mp3:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\14 I Was Born To Love You (2000 Digitaly Remastered).mp3:TOC.WMV
@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >
         

--- --- ---


OTL Logfile:

OTL Extras logfile created on: 02.09.2012 13:35:11 - Run 1
OTL by OldTimer - Version 3.2.59.1     Folder = C:\Users\Susi\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,57 Gb Available Physical Memory | 78,63% Memory free
4,23 Gb Paging File | 3,98 Gb Available in Paging File | 94,12% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 4,76 Gb Free Space | 2,04% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: SUSI-PC | User Name: Susi | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5F082DF3-9F67-4D2A-A05C-6FFAF463EAA8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{BB121911-6A33-4B71-805E-F34DACF40B57}" = lport=2869 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0205B626-B101-45B7-BF9D-614B8F9A87FF}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{23D86337-4A84-45BC-9510-3004B2625613}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{26E011A8-EA45-4CB4-85E2-CA1674DDCD7F}" = protocol=6 | dir=in | app=c:\users\susi\appdata\local\temp\{1f651f08-005c-4a5b-a74a-26d392973ef6}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\cinergydvrhelper.exe | 
"{32045CA1-FFAC-4509-9D67-0D086C1FF73F}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{385FE2F2-A380-4D8F-A241-84BD31794C44}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{3BB99720-C882-4A71-9AEA-CDD792539290}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{3DCAFBD2-C660-4407-A651-711E8A8997D8}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{44A5B598-C29B-45C2-98AB-E303E128AA3C}" = protocol=6 | dir=in | app=c:\users\susi\appdata\local\temp\{c5ca6e39-829b-4dec-86c9-1578ac7d33c1}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\cinergydvrhelper.exe | 
"{47E9EB2B-1BEE-4803-B5FF-00E0942C3F54}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{66306EA9-48EE-4C4C-823C-D408EE795A8C}" = protocol=6 | dir=in | app=c:\users\susi\appdata\local\temp\{c22c3f57-5182-4e9d-acb5-15a76c5ae65a}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\insttool.exe | 
"{84D3AAA2-1ABA-49F8-AD55-8BB6CB4F50C4}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"{8BFF7B1B-3FEB-4098-A151-A91414E11BE0}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{8E4D65A2-06EE-4FE0-BB16-9A27E99A76D5}" = protocol=17 | dir=in | app=c:\users\susi\appdata\local\temp\{c22c3f57-5182-4e9d-acb5-15a76c5ae65a}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\insttool.exe | 
"{9BDD4358-53F1-46D7-B5D3-E14DDEF6750B}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{9F7AE3E7-2F21-40F8-BE20-000D0221633C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{B4B4978C-E404-4BC1-BE20-41585766756F}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{B9A91551-5B6E-4E49-BC30-1FBA030A489B}" = protocol=17 | dir=in | app=c:\users\susi\appdata\local\temp\{1f651f08-005c-4a5b-a74a-26d392973ef6}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\cinergydvrhelper.exe | 
"{C232A471-4F3E-4450-A4D9-60235B663181}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{C2C24A6A-3BD2-4CE9-B76C-A1FEF5B0A69A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{C7EF8353-DB60-4A4B-B876-8ABD64E93C22}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"{C83105E7-797D-48BA-BDF4-AACDF370FFEB}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"{CE68B517-21D3-40FA-AB2B-4647815DCA52}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{CF9694F2-5A09-4728-88D0-3EAB280381A9}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"{D367C2D0-E3C1-4A52-8ABE-C57AB806D63C}" = protocol=17 | dir=in | app=c:\users\susi\appdata\local\temp\{c5ca6e39-829b-4dec-86c9-1578ac7d33c1}\{63b9bab5-f36a-4a3b-9e5c-68a7f212bfb9}\cinergydvrhelper.exe | 
"{DF640D0A-8374-45A7-A4BA-00705972DE4B}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe | 
"{E5453C40-3C6D-46CA-BD78-F25E04D39620}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe | 
"{E5592AA8-AB73-42AC-BB15-CC3EA533688D}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe | 
"{F1039ACA-02CD-4125-94E0-7DD2AB725696}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe | 
"TCP Query User{BF7FF6AA-42D8-4315-BBC6-033805AC683D}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{3ED653E2-137F-4FD5-9EC6-1644DFA135B5}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01008101-5D65-445A-B3B4-3DCE72BA0C6C}" = Microsoft Encarta Enzyklopädie PLUS 2001
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP180" = Canon MP180
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{174A3B31-4C43-43DD-866F-73C9DB887B48}" = LWS Twitter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20C3DEAF-801D-4C3E-9826-E62EE16DB7AB}" = phase6_18
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.442
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CE924D4-E4AB-4730-8367-0F2AEE9D7FE0}" = Samsung PC Studio 3
"{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}" = Google Earth
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A8354A5-794D-4CA8-9125-21C9657454C3}" = capella studio + scan
"{4B7274EB-9D60-4655-8507-C910E63A9F02}" = Nitro PDF Reader
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{553E56C3-7AA1-45FE-A2FC-2C43DC27F765}" = iTunes
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{AC86ECA1-FA14-11D1-B4F6-00609781F44C}" = Der Brockhaus multimedial
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B0D70EC6-E1CF-4EC3-BE09-FA75470D3902}" = Norton Security Scan
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C69405BB-27AF-4940-B3DA-04910B4DFD23}_is1" = aTube Catcher 1.0
"{C9B59DAD-86AC-456C-80A7-B665E77AA325}" = SigmaTel MSCN Audio Player
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam-Software
"{D9EB1AF1-5A27-49E7-B83B-D3AB9FF407DD}" = Steganos Safe 12
"{E28B1E6F-E0AA-4228-AB89-DB4A0C89D426}" = AVerTV
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.2171
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ALDITALKVerbindungsassistent" = ALDI TALK Verbindungsassistent
"aTube Catcher" = aTube Catcher
"AVerMedia A835 USB TV Tuner" = AVerMedia A835 USB TV Tuner 8.0.0.43
"AVMWLANCLI" = AVM FRITZ!WLAN
"Canon MP180 Benutzerregistrierung" = Canon MP180 Benutzerregistrierung
"CCleaner" = CCleaner
"Das Telefonbuch. München 2012" = Das Telefonbuch. München 2012
"DivX Setup.divx.com" = DivX-Setup
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"FaceSwapper_is1" = FaceSwapper v1.0
"FILEminimizer Pictures_is1" = FILEminimizer Pictures
"FinePix Genie_is1" = FUJIFILM MyFinePix Studio 1.0
"FormatFactory" = FormatFactory 2.80
"Google Updater" = Google Updater
"Hamster Lite Archiver_is1" = Hamster Lite Archiver 2.0.0.16
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HyperCam 3" = HyperCam 3
"InstallShield_{E28B1E6F-E0AA-4228-AB89-DB4A0C89D426}" = AVerTV
"IPIX ActiveX Viewer" = IPIX ActiveX Viewer
"IPIX Netscape Plugin Viewer" = IPIX Netscape Plugin Viewer
"IPIX Viewer" = IPIX Viewer
"ManyCam" = ManyCam 2.4 (remove only)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator 3.0" = Canon MP Navigator 3.0
"NIS" = Norton Internet Security
"NSSSetup.{B0D70EC6-E1CF-4EC3-BE09-FA75470D3902}" = Norton Security Scan (Symantec Corporation)
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.02.0
"Picasa 3" = Picasa 3
"Recuva" = Recuva
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Shockwave" = Shockwave
"SimpleScreenshot" = SimpleScreenshot 1.40
"Sony Ericsson" = Sony Ericsson Software
"TrueCrypt" = TrueCrypt
"VLC media player" = VLC media player 1.1.8
"Windows Mobile Device Handbook" = Windows Mobile®-Gerätehandbuch
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"WinRAR archiver" = WinRAR
"XMedia Recode" = XMedia Recode 2.0.5.6
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Move Media Player" = Move Media Player
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 29.08.2012 15:52:59 | Computer Name = Susi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
 Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7,  Prozess-ID 0xd18, Anwendungsstartzeit
 01cd861f5ca45540.
 
Error - 30.08.2012 04:29:11 | Computer Name = Susi-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 30.08.2012 04:29:11 | Computer Name = Susi-PC | Source = Windows Search Service | ID = 3013
Description = 
 
Error - 30.08.2012 05:51:31 | Computer Name = Susi-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 30.08.2012 05:55:09 | Computer Name = Susi-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 30.08.2012 06:34:29 | Computer Name = Susi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
 Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7,  Prozess-ID 0xa40, Anwendungsstartzeit
 01cd869a8b334316.
 
Error - 30.08.2012 06:36:09 | Computer Name = Susi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
 Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7,  Prozess-ID 0x1be4, Anwendungsstartzeit
 01cd869b23585e7e.
 
Error - 30.08.2012 06:37:15 | Computer Name = Susi-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
 Ausnahmecode 0xc0000374, Fehleroffset 0x000b06b7,  Prozess-ID 0x1ab4, Anwendungsstartzeit
 01cd869b488e3b0f.
 
Error - 31.08.2012 04:58:25 | Computer Name = Susi-PC | Source = EventSystem | ID = 4609
Description = 
 
Error - 02.09.2012 07:29:36 | Computer Name = Susi-PC | Source = EventSystem | ID = 4609
Description = 
 
[ Media Center Events ]
Error - 21.06.2009 17:35:58 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 16.01.2011 10:02:08 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 15.02.2011 12:43:04 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 20.02.2011 07:28:16 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 24.02.2011 08:24:09 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 06.04.2011 09:47:47 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 08.04.2011 16:01:02 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 19.04.2011 16:54:23 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 23.04.2011 20:11:46 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 08.06.2011 21:33:46 | Computer Name = Susi-PC | Source = ehRecvr | ID = 4
Description = 
 
[ System Events ]
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 02.09.2012 07:30:13 | Computer Name = Susi-PC | Source = Service Control Manager | ID = 7001
Description = 
 
 
< End of report >
         

--- --- ---




lg amuc

Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 4 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern mede dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
• Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.

:OTL
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found 
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found 
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found 
DRV - (gtstusbser) -- system32\DRIVERS\gtstusbser.sys File not found 
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ironto&s={searchTerms}&f=4 
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKCU\..\URLSearchHook: - No CLSID value found 
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?FORM=IEFM1&q={searchTerms} 
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=ironto&s={searchTerms}&f=4 
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=T8&apn_dtid=YYYYYYYYDE&apn_uid=f82067ab-4ce1-4333-a785-95a6296261ee&apn_sauid=D68069E9-9208-454F-AD72-7AA80D069EC0 
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rlz=1I7GCNV_de&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb165/?search={searchTerms}&loc=IB_DS&a=6OyE9rqAB7&i=26 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "Ask.com" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.selectedEngine: "Ask.com" 
FF - prefs.js..browser.startup.homepage: "http://de.ask.com/?l=dis&o=14672" 
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU2&o=14670&locale=de_DE&apn_uid=f82067ab-4ce1-4333-a785-95a6296261ee&apn_ptnrs=T8&apn_sauid=D68069E9-9208-454F-AD72-7AA80D069EC0&apn_dtid=YYYYYYYYDE&&q=" 
FF - user.js - File not found 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4 [2012.09.02 13:22:23 | 000,000,000 | ---D | M] 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.06.06 20:38:58 | 000,000,000 | ---D | M] 
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - No CLSID value found. 
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. 
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll (Symantec Corporation) 
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No CLSID value found. 
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) 
O4 - HKLM..\Run: [] File not found 
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) 
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () 
O4 - HKCU..\Run: [RegistryDoktorNET] C:\Program Files\Registry Doktor 4.1\RegistryDoktor.exe File not found 
O4 - HKCU..\Run: [TSWorkspace] C:\Users\Susi\AppData\Local\Microsoft\Windows\2450\TSWorkspace.exe () 
O4 - Startup: C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk = C:\Program Files\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech) 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Reg Error: Value error.) 
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) 
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.7.2) 
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O33 - MountPoints2\{01fef648-916e-11e0-ae62-f750a72345bc}\Shell - "" = AutoRun 
O33 - MountPoints2\{01fef648-916e-11e0-ae62-f750a72345bc}\Shell\AutoRun\command - "" = F:\QsSetup.exe 
O33 - MountPoints2\{252100db-c548-11e1-969f-b8a0a3a2a44c}\Shell - "" = AutoRun 
O33 - MountPoints2\{252100db-c548-11e1-969f-b8a0a3a2a44c}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{252100fd-c548-11e1-969f-da5c66077c7a}\Shell - "" = AutoRun 
O33 - MountPoints2\{252100fd-c548-11e1-969f-da5c66077c7a}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\Shell - "" = AutoRun 
O33 - MountPoints2\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 
O33 - MountPoints2\{48e21a9b-5176-11e1-a57a-8953f03aed92}\Shell - "" = AutoRun 
O33 - MountPoints2\{48e21a9b-5176-11e1-a57a-8953f03aed92}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{499667b2-83d8-11e1-958f-846f58978ae2}\Shell - "" = AutoRun 
O33 - MountPoints2\{499667b2-83d8-11e1-958f-846f58978ae2}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{50a5b100-1e30-11e1-ab3c-b06150467d27}\Shell - "" = AutoRun 
O33 - MountPoints2\{50a5b100-1e30-11e1-ab3c-b06150467d27}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\Shell - "" = AutoRun 
O33 - MountPoints2\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{57146204-0014-11e1-9127-9ad8caac1f97}\Shell - "" = AutoRun 
O33 - MountPoints2\{57146204-0014-11e1-9127-9ad8caac1f97}\Shell\AutoRun\command - "" = F:\QsSetup.exe 
O33 - MountPoints2\{6eb5190c-513f-11de-b0d6-0019db52da6c}\Shell - "" = AutoRun 
O33 - MountPoints2\{6eb5190c-513f-11de-b0d6-0019db52da6c}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{6eb51933-513f-11de-b0d6-0019db52da6c}\Shell - "" = AutoRun 
O33 - MountPoints2\{6eb51933-513f-11de-b0d6-0019db52da6c}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{71378025-52b1-11de-ac95-0019db52da6c}\Shell - "" = AutoRun 
O33 - MountPoints2\{71378025-52b1-11de-ac95-0019db52da6c}\Shell\AutoRun\command - "" = F:\QsSetup.exe 
O33 - MountPoints2\{74478bf1-cc38-11e1-914a-bc66000678ae}\Shell - "" = AutoRun 
O33 - MountPoints2\{74478bf1-cc38-11e1-914a-bc66000678ae}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 
O33 - MountPoints2\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\Shell - "" = AutoRun 
O33 - MountPoints2\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 
O33 - MountPoints2\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\Shell - "" = AutoRun 
O33 - MountPoints2\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 
O33 - MountPoints2\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\Shell - "" = AutoRun 
O33 - MountPoints2\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{84354467-c54d-11e1-96ea-ae78f46e1916}\Shell - "" = AutoRun 
O33 - MountPoints2\{84354467-c54d-11e1-96ea-ae78f46e1916}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\Shell - "" = AutoRun 
O33 - MountPoints2\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{99268586-1dc2-11e1-86ac-dd9a32903398}\Shell - "" = AutoRun 
O33 - MountPoints2\{99268586-1dc2-11e1-86ac-dd9a32903398}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\Shell - "" = AutoRun 
O33 - MountPoints2\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{a3dd5945-947b-11e1-8858-f10c43d73894}\Shell - "" = AutoRun 
O33 - MountPoints2\{a3dd5945-947b-11e1-8858-f10c43d73894}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\Shell - "" = AutoRun 
O33 - MountPoints2\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\Shell - "" = AutoRun 
O33 - MountPoints2\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\Shell - "" = AutoRun 
O33 - MountPoints2\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 
O33 - MountPoints2\{ceb7c063-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun 
O33 - MountPoints2\{ceb7c063-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{ceb7c06d-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun 
O33 - MountPoints2\{ceb7c06d-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{ceb7c085-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun 
O33 - MountPoints2\{ceb7c085-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\.\Setup.exe AUTORUN=1 
O33 - MountPoints2\{ceb7c093-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun 
O33 - MountPoints2\{ceb7c093-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\{ceb7c09b-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun 
O33 - MountPoints2\{ceb7c09b-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = G:\AutoRun.exe 
O33 - MountPoints2\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\Shell - "" = AutoRun 
O33 - MountPoints2\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\F\Shell - "" = AutoRun 
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe 
O33 - MountPoints2\L\Shell - "" = AutoRun 
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\QsSetup.exe 

[2012.08.11 12:26:37 | 004,503,728 | ---- | M] () -- C:\ProgramData\00etadpu.pad 

@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Documents\1204235145DVB-TEinsExtra.mpg:TOC.WMV 
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Documents\1204110356DVB-TN24.mpg:TOC.WMV 
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\Sil suffisait Daimer.mp3:TOC.WMV 
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\I WAS BORN TO LOVE YOU.mp4:TOC.WMV 
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\Bruno Mars-Grenade.mp3:TOC.WMV 
@Alternate Data Stream - 64 bytes -> C:\Users\Susi\Desktop\14 I Was Born To Love You (2000 Digitaly Remastered).mp3:TOC.WMV 
@Alternate Data Stream - 113 bytes -> C:\ProgramData\Temp:DFC5A2B2 
 
[2012.08.29 21:09:52 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt 
[2012.08.29 16:24:40 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Roaming\hellomoto 

:Files
C:\Users\Susi\AppData\Local\Microsoft\Windows\2450\

C:\Users\Susi\AppData\Local\{*}
C:\ProgramData\*.exe
C:\ProgramData\TEMP
C:\Users\Susi\AppData\Local\Temp\*.exe
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
%SystemRoot%\System32\*.tmp
%SystemRoot%\SysWOW64\*.tmp
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

3. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

4. Schritt

• Schließe alle offenen Programme und Browser.
• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Delete.
• Bestätige jeweils mit Ok.
• Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

nochmal einen Schritt zurück:
Tatsächlich beim ersten durchlaufen von otl ging dies tatsächlich nicht flüssig: es stand nach ca dem ersten viertel was von harddisk.....da. erst als ich es "weggeixt" hatte lief der scan weiter. ich kann nun nochmal von vorne anfangen oder den nächsten Schritt wie von dir verlangt abarbeiten. ich weise vorsorglich nochmals darauf hin dass ich Malwarebytes nicht (ohne weiteres) anwenden kann. deshalb hattest du mir auch geraten mit odl anzufangen. bitte dazu meinen ersten post nochmals lesen (auch den zweiten von mir)

lg amuc

Gabs ein Log?

OTL-Fix nochmal durchfuehren.

MBAM deinstallieren und die kostenlose Version installieren.

Hallo, echt super!!!

All processes killed
========== OTL ==========
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
File system32\DRIVERS\nwlnkfwd.sys File not found not found.
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
File system32\DRIVERS\nwlnkflt.sys File not found not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
File system32\DRIVERS\ipinip.sys File not found not found.
Service gtstusbser stopped successfully!
Service gtstusbser deleted successfully!
File system32\DRIVERS\gtstusbser.sys File not found not found.
Service blbdrive stopped successfully!
Service blbdrive deleted successfully!
File C:\Windows\system32\drivers\blbdrive.sys File not found not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0D7562AE-8EF6-416d-A838-AB665251703A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Ask.com" removed from browser.search.selectedEngine
Prefs.js: "hxxp://de.ask.com/?l=dis&o=14672" removed from browser.startup.homepage
Prefs.js: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU2&o=14670&locale=de_DE&apn_uid=f82067ab-4ce1-4333-a785-95a6296261ee&apn_ptnrs=T8&apn_sauid=D68069E9-9208-454F-AD72-7AA80D069EC0&apn_dtid=YYYYYYYYDE&&q=" removed from keyword.URL
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}\ not found.
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4\content folder moved successfully.
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4\components folder moved successfully.
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4\chrome\skin folder moved successfully.
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4\chrome folder moved successfully.
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_9_4 folder moved successfully.
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}\ not found.
C:\Program Files\Web Assistant\Firefox\defaults\preferences folder moved successfully.
C:\Program Files\Web Assistant\Firefox\defaults folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\skin folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale\en-US folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\locale folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content\resources folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content\libraries folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome\content folder moved successfully.
C:\Program Files\Web Assistant\Firefox\chrome folder moved successfully.
C:\Program Files\Web Assistant\Firefox folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ deleted successfully.
C:\Program Files\Norton Internet Security\Engine\18.7.2.3\coieplg.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater not found.
File C:\Program Files\Ask.com\Updater\Updater.exe not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate deleted successfully.
C:\Program Files\DivX\DivX Update\DivXUpdate.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\RegistryDoktorNET deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\TSWorkspace deleted successfully.
C:\Users\Susi\AppData\Local\Microsoft\Windows\2450\TSWorkspace.exe moved successfully.
C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk moved successfully.
C:\Program Files\Logitech\Ereg\eReg.exe moved successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\Windows\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\Windows\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01fef648-916e-11e0-ae62-f750a72345bc}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01fef648-916e-11e0-ae62-f750a72345bc}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{01fef648-916e-11e0-ae62-f750a72345bc}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01fef648-916e-11e0-ae62-f750a72345bc}\ not found.
File F:\QsSetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{252100db-c548-11e1-969f-b8a0a3a2a44c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{252100db-c548-11e1-969f-b8a0a3a2a44c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{252100db-c548-11e1-969f-b8a0a3a2a44c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{252100db-c548-11e1-969f-b8a0a3a2a44c}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{252100fd-c548-11e1-969f-da5c66077c7a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{252100fd-c548-11e1-969f-da5c66077c7a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{252100fd-c548-11e1-969f-da5c66077c7a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{252100fd-c548-11e1-969f-da5c66077c7a}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4780a750-c9aa-11e1-9d5e-b00ae66e860d}\ not found.
File move failed. F:\.\Setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e21a9b-5176-11e1-a57a-8953f03aed92}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e21a9b-5176-11e1-a57a-8953f03aed92}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e21a9b-5176-11e1-a57a-8953f03aed92}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e21a9b-5176-11e1-a57a-8953f03aed92}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{499667b2-83d8-11e1-958f-846f58978ae2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{499667b2-83d8-11e1-958f-846f58978ae2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{499667b2-83d8-11e1-958f-846f58978ae2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{499667b2-83d8-11e1-958f-846f58978ae2}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50a5b100-1e30-11e1-ab3c-b06150467d27}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50a5b100-1e30-11e1-ab3c-b06150467d27}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50a5b100-1e30-11e1-ab3c-b06150467d27}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50a5b100-1e30-11e1-ab3c-b06150467d27}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50a5b106-1e30-11e1-ab3c-8e9d0476c829}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{57146204-0014-11e1-9127-9ad8caac1f97}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57146204-0014-11e1-9127-9ad8caac1f97}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{57146204-0014-11e1-9127-9ad8caac1f97}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{57146204-0014-11e1-9127-9ad8caac1f97}\ not found.
File F:\QsSetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6eb5190c-513f-11de-b0d6-0019db52da6c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6eb5190c-513f-11de-b0d6-0019db52da6c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6eb5190c-513f-11de-b0d6-0019db52da6c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6eb5190c-513f-11de-b0d6-0019db52da6c}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6eb51933-513f-11de-b0d6-0019db52da6c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6eb51933-513f-11de-b0d6-0019db52da6c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6eb51933-513f-11de-b0d6-0019db52da6c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6eb51933-513f-11de-b0d6-0019db52da6c}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71378025-52b1-11de-ac95-0019db52da6c}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71378025-52b1-11de-ac95-0019db52da6c}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{71378025-52b1-11de-ac95-0019db52da6c}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71378025-52b1-11de-ac95-0019db52da6c}\ not found.
File F:\QsSetup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74478bf1-cc38-11e1-914a-bc66000678ae}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74478bf1-cc38-11e1-914a-bc66000678ae}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74478bf1-cc38-11e1-914a-bc66000678ae}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74478bf1-cc38-11e1-914a-bc66000678ae}\ not found.
File move failed. F:\.\Setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74478c2a-cc38-11e1-914a-a6fcf1d9db18}\ not found.
File move failed. F:\.\Setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{75a54cab-e6ca-11e1-a2aa-897455f2a7c7}\ not found.
File move failed. F:\.\Setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8435445e-c54d-11e1-96ea-e6a78349c2ca}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{84354467-c54d-11e1-96ea-ae78f46e1916}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84354467-c54d-11e1-96ea-ae78f46e1916}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{84354467-c54d-11e1-96ea-ae78f46e1916}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84354467-c54d-11e1-96ea-ae78f46e1916}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9465662d-9c52-11e1-9f1f-83396d1a43e3}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{99268586-1dc2-11e1-86ac-dd9a32903398}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99268586-1dc2-11e1-86ac-dd9a32903398}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{99268586-1dc2-11e1-86ac-dd9a32903398}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99268586-1dc2-11e1-86ac-dd9a32903398}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9926858f-1dc2-11e1-86ac-f59e5c29d037}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3dd5945-947b-11e1-8858-f10c43d73894}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3dd5945-947b-11e1-8858-f10c43d73894}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3dd5945-947b-11e1-8858-f10c43d73894}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3dd5945-947b-11e1-8858-f10c43d73894}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b1043fe2-c4ea-11e1-ab38-a1f823f71f9a}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b1043fec-c4ea-11e1-ab38-cb029301a8c9}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c7f64b04-ce77-11e1-a7d0-b097a2556d56}\ not found.
File move failed. F:\.\Setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c063-c54f-11e1-be60-83249d8de197}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c063-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c063-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c063-c54f-11e1-be60-83249d8de197}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c06d-c54f-11e1-be60-83249d8de197}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c06d-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c06d-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c06d-c54f-11e1-be60-83249d8de197}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c085-c54f-11e1-be60-83249d8de197}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c085-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c085-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c085-c54f-11e1-be60-83249d8de197}\ not found.
File move failed. F:\.\Setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c093-c54f-11e1-be60-83249d8de197}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c093-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c093-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c093-c54f-11e1-be60-83249d8de197}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c09b-c54f-11e1-be60-83249d8de197}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c09b-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c09b-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c09b-c54f-11e1-be60-83249d8de197}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ceb7c0ab-c54f-11e1-be60-83249d8de197}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\L\ not found.
File L:\QsSetup.exe not found.
C:\ProgramData\00etadpu.pad moved successfully.
ADS C:\Users\Susi\Documents\1204235145DVB-TEinsExtra.mpg:TOC.WMV deleted successfully.
ADS C:\Users\Susi\Documents\1204110356DVB-TN24.mpg:TOC.WMV deleted successfully.
ADS C:\Users\Susi\Desktop\Sil suffisait Daimer.mp3:TOC.WMV deleted successfully.
ADS C:\Users\Susi\Desktop\I WAS BORN TO LOVE YOU.mp4:TOC.WMV deleted successfully.
ADS C:\Users\Susi\Desktop\Bruno Mars-Grenade.mp3:TOC.WMV deleted successfully.
ADS C:\Users\Susi\Desktop\14 I Was Born To Love You (2000 Digitaly Remastered).mp3:TOC.WMV deleted successfully.
ADS C:\ProgramData\TempFC5A2B2 deleted successfully.
C:\Windows\System32\config.nt moved successfully.
C:\Users\Susi\AppData\Roaming\hellomoto folder moved successfully.
========== FILES ==========
C:\Users\Susi\AppData\Local\Microsoft\Windows\2450 folder moved successfully.
File\Folder C:\Users\Susi\AppData\Local\{*} not found.
File\Folder C:\ProgramData\*.exe not found.
C:\ProgramData\TEMP folder moved successfully.
C:\Users\Susi\AppData\Local\Temp\fp_pl_pfs_installer.exe moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\tmp folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
File/Folder C:\Windows\System32\*.tmp not found.
File/Folder C:\Windows\SysWOW64\*.tmp not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Susi\Desktop\cmd.bat deleted successfully.
C:\Users\Susi\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Aziz
->Temp folder emptied: 119698580 bytes
->Temporary Internet Files folder emptied: 498416523 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 22850548 bytes
->Flash cache emptied: 3222 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Susi
->Temp folder emptied: 322323765 bytes
->Temporary Internet Files folder emptied: 236155562 bytes
->FireFox cache emptied: 299204119 bytes
->Flash cache emptied: 11020 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4206905 bytes
RecycleBin emptied: 161764734 bytes

Total Files Cleaned = 1.588,00 mb


OTL by OldTimer - Version 3.2.59.1 log created on 09042012_111433

Files\Folders moved on Reboot...
File move failed. F:\.\Setup.exe scheduled to be moved on reboot.
File\Folder C:\Users\Susi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{0DEEEDE4-C124-42DC-9596-6F0D364DE6CE}.tmp not found!
File\Folder C:\Users\Susi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E72F851E-6491-45ED-B0A8-E158C75559A3}.tmp not found!

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


Malwarebytes Anti-Malware 1.62.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2012.09.04.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Susi :: SUSI-PC [Administrator]

04.09.2012 11:38:16
mbam-log-2012-09-04 (11-38-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 343628
Laufzeit: 1 Stunde(n), 15 Minute(n), 26 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Program Files\DATA BECKER\capella studio + scan\capella-scan 5.0\capscan.exe (Malware.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


# AdwCleaner v2.000 - Datei am 09/04/2012 um 13:21:00 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Susi - SUSI-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Susi\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gefunden : C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml
Datei Gefunden : C:\user.js
Datei Gefunden : C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk
Ordner Gefunden : C:\Program Files\Web Assistant
Ordner Gefunden : C:\ProgramData\Ask
Ordner Gefunden : C:\Users\Susi\AppData\LocalLow\BabylonToolbar
Ordner Gefunden : C:\Users\Susi\AppData\LocalLow\boost_interprocess
Ordner Gefunden : C:\Users\Susi\AppData\Roaming\Desktopicon

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKCU\Software\IM
Schlüssel Gefunden : HKCU\Software\ImInstaller
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gefunden : HKLM\Software\Web Assistant

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default
Datei : C:\Users\Susi\AppData\Roaming\Mozilla\Firefox\Profiles\6whrv39i.default\prefs.js

Gefunden : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profilname : default
Datei : C:\Users\Aziz\AppData\Roaming\Mozilla\Firefox\Profiles\9hshjfio.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [4135 octets] - [04/09/2012 13:21:00]

########## EOF - C:\AdwCleaner[R1].txt - [4195 octets] ##########



# AdwCleaner v2.000 - Datei am 09/04/2012 um 13:22:15 erstellt
# Aktualisiert am 30/08/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : Susi - SUSI-PC
# Normaler Modus : Normal
# Ausgeführt unter : C:\Users\Susi\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml
Datei Gelöscht : C:\user.js
Datei Gelöscht : C:\Users\Susi\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk
Ordner Gelöscht : C:\Program Files\Web Assistant
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Users\Susi\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\Susi\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Susi\AppData\Roaming\Desktopicon

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Extension.ExtensionHelperObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D5A4199-956E-49BC-B89F-6A35C57C0D13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gelöscht : HKLM\Software\Web Assistant

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

Wiederhergestellt : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Wiederhergestellt : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v14.0.1 (de)

Profilname : default
Datei : C:\Users\Susi\AppData\Roaming\Mozilla\Firefox\Profiles\6whrv39i.default\prefs.js

Gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profilname : default
Datei : C:\Users\Aziz\AppData\Roaming\Mozilla\Firefox\Profiles\9hshjfio.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [4264 octets] - [04/09/2012 13:21:00]
AdwCleaner[S1].txt - [4640 octets] - [04/09/2012 13:22:15]

########## EOF - C:\AdwCleaner[S1].txt - [4700 octets] ##########


lg amuc

Sehr gut!

Wie laeuft der Rechner?

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

Mein Gott, ich bin aber auch ein Hirni!
Hier ist ne zweite Seite und ich denk mir wieso du nicht mehr antwortest...
Sorry!
Läuft super gut!
Vielen vielen Dank!!!

Jetzt mach ich erst mal den Malware Scan von Eminsoft...

Alles klar

Emsisoft Anti-Malware - Version 6.6
Letztes Update: N/A

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An

Scan Beginn: 07.09.2012 17:27:05

C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\45d91526-414f9157 -> l_r1a\l_r1c.class gefunden: Exploit.Java.CVE-2012!E2
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\45d91526-414f9157 -> l_r1a\l_r1b.class gefunden: Exploit.Java.CVE!E2
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\45d91526-414f9157 -> l_r1a\l_r1a.class gefunden: Exploit.Java.CVE-2012!E2
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\45d91526-414f9157 -> l_r1a\l_r1d.class gefunden: Exploit.Java.CVE-2012!E2
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\Local\Microsoft\Windows\2450\28d168a2 gefunden: Trojan.Win32.Ransom!E2
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\Local\Microsoft\Windows\2450\TSWorkspace.exe gefunden: Trojan.Dropper.Win32.Dapato.bqji.AMN!E1
C:\Users\Susi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MCFFH4JX\b47086bff91997d6684afb78266db368[1].js gefunden: AdWare.JS.Pornpop!E2

Gescannt 159566
Gefunden 7

Scan Ende: 07.09.2012 21:02:01
Scan Zeit: 3:34:56

C:\Users\Susi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MCFFH4JX\b47086bff91997d6684afb78266db368[1].js Quarantäne AdWare.JS.Pornpop!E2
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\Local\Microsoft\Windows\2450\TSWorkspace.exe Quarantäne Trojan.Dropper.Win32.Dapato.bqji.AMN!E1
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\Local\Microsoft\Windows\2450\28d168a2 Quarantäne Trojan.Win32.Ransom!E2
C:\_OTL\MovedFiles\09042012_111433\C_Users\Susi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\45d91526-414f9157 -> l_r1a\l_r1b.class Quarantäne Exploit.Java.CVE!E2

Quarantäne 4

Sehr gut!



Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

• Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
• Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
• Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.

Los geht's

• Lade und starte Eset Smartinstaller
• Haken setzen bei YES, I accept the Terms of Use.
• Klick auf Start.
• Haken setzen bei Remove found threads und Scan archives.
• Klick auf Start.
• Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Finish drücken.
• Browser schließen.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset