Hallo Trojanerboard-Team,

nachdem ich das Thema für Hilfuchende durchgearbeitet habe möchte ich kurz mein Problem schildern.

Ich betreibe eine private Joomla-Seite die offensichtlich gehackt wurde. Der Provider wurde von mir informiert und ich habe auf dem Server das Verzeichniss und die Sub-Domain gelöscht.
Es gibt eine Sicherung der Joomla-Installation. Diese Sicherung habe ich in ein neues Verzeichniss mit neuer URL und neuen Passwörtern installiert.
Hier habe ich nun die Meldung "Warten auf Google.de" unten links im Firefox-Browser beobachtet. Wenn ich mit der Maus auf diese Meldung gehe springt sie nach unten rechts.

Soweit die Problembeschreibung

Die Datei extras.txt und gmer.txt sind im Anhang als zip-File
Hier die Datei OTL.txt
________________________________________________________________

OTL Logfile:

OTL logfile created on: 01.11.2012 16:26:21 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\TO\Desktop
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,38 Gb Available Physical Memory | 68,87% Memory free
4,00 Gb Paging File | 2,89 Gb Available in Paging File | 72,16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 127,99 Gb Total Space | 99,46 Gb Free Space | 77,71% Space Free | Partition Type: NTFS
Drive D: | 240,11 Gb Total Space | 95,66 Gb Free Space | 39,84% Space Free | Partition Type: NTFS
Drive E: | 97,65 Gb Total Space | 88,90 Gb Free Space | 91,04% Space Free | Partition Type: NTFS
 
Computer Name: TO-PC | User Name: TO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.11.01 16:24:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\TO\Desktop\OTL.exe
PRC - [2012.10.30 11:42:03 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.10.30 11:41:55 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.10.30 11:41:55 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.09.29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.09.19 18:20:40 | 000,079,136 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.09.06 12:12:20 | 000,162,408 | ---- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.07.04 07:21:18 | 000,453,632 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2012.07.04 07:20:42 | 000,217,088 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2012.07.04 00:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
PRC - [2010.01.21 00:52:14 | 000,167,528 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
PRC - [2010.01.21 00:52:12 | 000,370,792 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
PRC - [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.04 00:34:48 | 000,095,232 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
MOD - [2012.07.04 00:16:08 | 000,369,152 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.07.14 09:47:20 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.07.14 09:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.07.14 09:47:12 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.07.14 05:55:43 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\de8525cc2e6327337e1c6917352bfe16\WindowsFormsIntegration.ni.dll
MOD - [2009.07.14 05:43:48 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\1762137638019a091020b3baf52f6de3\System.Core.ni.dll
MOD - [2009.07.14 05:43:44 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\39f5a71b5185d267b0f55cd4cea26d6b\PresentationFramework.Aero.ni.dll
MOD - [2009.07.14 05:43:36 | 011,804,160 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\3871fc2b96345aa6f3be81d9e3c97160\System.Web.ni.dll
MOD - [2009.07.14 05:43:30 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\4bdeb88758dccd625f4703ed77aaf348\System.Runtime.Remoting.ni.dll
MOD - [2009.07.14 05:43:20 | 014,318,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\68e5eeb3c6ef18ba2dc1ad70eb74aeee\PresentationFramework.ni.dll
MOD - [2009.07.14 05:43:04 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\fedf1ba58dced4f0b3f8c457648ceed9\System.Windows.Forms.ni.dll
MOD - [2009.07.14 05:42:57 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ead6be8b410d56b5576b10e56af2c180\System.Drawing.ni.dll
MOD - [2009.07.14 05:42:56 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\7ce9d463a5d343fe74d6f181f9226cab\UIAutomationProvider.ni.dll
MOD - [2009.07.14 05:42:55 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7b459c5815af8123e4bf30d4e05bba65\PresentationCore.ni.dll
MOD - [2009.07.14 05:42:45 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c2f9dd7db911053edcaaadf5fefc500a\WindowsBase.ni.dll
MOD - [2009.07.14 05:42:40 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5dd9f783008543df3e642ff1e99de4e8\System.Xml.ni.dll
MOD - [2009.07.14 05:42:37 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4b1350e31ff09cc583b34854816d8036\System.Configuration.ni.dll
MOD - [2009.07.14 05:42:36 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5ba3bf5367fc012300c6566f20cb7f54\System.ni.dll
MOD - [2009.07.14 05:42:30 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\8c1770d45c63cf5c462eeb945ef9aa5d\mscorlib.ni.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.10.30 11:42:03 | 000,084,256 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.10.30 11:41:55 | 000,108,320 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.10.29 17:45:00 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.09 16:56:21 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.09.16 14:13:01 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.07.04 07:20:42 | 000,217,088 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.07.04 00:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2010.01.21 00:52:14 | 000,167,528 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2010.01.21 00:52:12 | 000,370,792 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- F:\CDriver.sys -- (MSICDSetup)
DRV - [2012.10.30 11:42:04 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012.09.24 08:58:11 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012.09.13 09:58:17 | 000,083,792 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.08.27 14:50:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2012.07.04 07:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2012.07.04 07:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012.07.04 06:10:30 | 000,290,304 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012.02.23 13:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2010.04.09 02:32:36 | 000,215,656 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2010.03.22 18:29:08 | 000,018,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2010.03.04 18:26:56 | 000,296,936 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2010.02.18 08:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009.07.14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.13 23:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0D 7E 77 70 21 B4 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Ashampoo DE Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB10&ctid=CT2481020&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://enouk.com/"
FF - prefs.js..extensions.enabledAddons: friendly@bug.a.am:1.9.3
FF - prefs.js..extensions.enabledAddons: youtubeunblocker@unblocker.yt:0.2.0
FF - prefs.js..extensions.enabledAddons: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.10
FF - prefs.js..extensions.enabledAddons: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.10
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {ab91efd4-6975-4081-8552-1b3922ed79e2}:1.0.5.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: friendly@bug.a.am:1.6.3
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q="
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\DOKUME~1\\TO\\LOKALE~1\\Temp\\proxtube.pac"
FF - prefs.js..network.proxy.type: 2
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.16 13:06:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.10.29 17:44:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012.10.29 17:44:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2012.09.16 13:06:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\Extensions
[2012.10.24 19:07:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\Firefox\Profiles\g25zep63.default\extensions
[2012.09.16 13:11:29 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\TO\AppData\Roaming\mozilla\Firefox\Profiles\g25zep63.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.08.04 17:53:58 | 001,621,801 | ---- | M] () (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\extensions\firebug@software.joehewitt.com.xpi
[2012.10.24 19:07:46 | 000,214,127 | ---- | M] () (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\extensions\freehdsport@freehdsport.tv.xpi
[2012.02.15 16:42:36 | 000,087,644 | ---- | M] () (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\extensions\friendly@bug.a.am.xpi
[2012.07.24 17:43:24 | 000,033,544 | ---- | M] () (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\extensions\info@convert2mp3.net.xpi
[2012.09.01 06:33:48 | 000,010,449 | ---- | M] () (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\extensions\youtubeunblocker@unblocker.yt.xpi
[2012.09.16 13:22:28 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.10.31 10:31:54 | 000,434,392 | ---- | M] () (No name found) -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi
[2012.05.17 16:42:02 | 000,000,957 | ---- | M] () -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\searchplugins\conduit.xml
[2011.07.11 18:04:02 | 000,000,633 | ---- | M] () -- C:\Users\TO\AppData\Roaming\mozilla\firefox\profiles\g25zep63.default\searchplugins\startsear.xml
[2012.09.16 13:06:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.06 02:26:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.09.06 03:07:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.06 03:07:37 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.09.06 03:07:37 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.09.06 03:07:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.09.06 03:07:37 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.09.06 03:07:37 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O4 - HKLM..\Run: [AMD AVT] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\TO\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ADA79154-72D6-4099-9F44-828AA7A284B0}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.01 16:24:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\TO\Desktop\OTL.exe
[2012.11.01 16:00:34 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\Malwarebytes
[2012.11.01 16:00:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.11.01 16:00:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.01 16:00:26 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.11.01 16:00:26 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.11.01 16:00:00 | 010,669,952 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\TO\Desktop\mbam-setup-1.65.1.1000.exe
[2012.11.01 15:17:56 | 000,000,000 | ---D | C] -- C:\Users\TO\Desktop\slot hp
[2012.10.29 17:44:58 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2012.10.24 19:07:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012.10.24 19:07:45 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ATDheNetTVApp.com
[2012.10.24 19:07:44 | 000,000,000 | ---D | C] -- C:\Program Files\ATDheNetTVApp.com
[2012.10.24 15:09:21 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012.10.24 14:49:28 | 000,000,000 | ---D | C] -- C:\Games
[2012.10.19 14:52:59 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\Canneverbe Limited
[2012.10.19 14:52:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2012.10.19 14:52:54 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP
[2012.10.19 14:41:29 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.10.19 14:41:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012.10.19 14:41:22 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft
[2012.10.19 14:41:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft
[2012.10.19 14:40:44 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\DVDVideoSoft
[2012.10.19 13:56:07 | 000,000,000 | ---D | C] -- C:\slot
[2012.10.18 15:58:10 | 000,000,000 | ---D | C] -- C:\1
[2012.10.18 15:56:04 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Local\MediaMonkey
[2012.10.18 15:54:56 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\MediaMonkey
[2012.10.18 15:54:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MediaMonkey
[2012.10.18 15:54:53 | 000,000,000 | ---D | C] -- C:\ProgramData\MediaMonkey
[2012.10.18 15:54:50 | 000,000,000 | ---D | C] -- C:\Program Files\MediaMonkey
[2012.10.16 23:54:51 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Local\Microsoft Games
[2012.10.16 22:17:16 | 000,000,000 | ---D | C] -- C:\ProgramData\AceBIT
[2012.10.16 22:17:13 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\AceBIT
[2012.10.16 22:17:10 | 000,729,424 | ---- | C] (WeOnlyDo Software) -- C:\Windows\System32\wodSFTP.dll
[2012.10.16 22:17:10 | 000,672,024 | ---- | C] (WeOnlyDo! COM) -- C:\Windows\System32\wodKeys.dll
[2012.10.16 22:17:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AceBIT
[2012.10.16 22:17:09 | 000,000,000 | ---D | C] -- C:\Program Files\AceBIT
[2012.10.12 13:04:29 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Local\PDF24
[2012.10.12 13:03:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2012.10.12 13:03:55 | 000,000,000 | ---D | C] -- C:\Program Files\PDF24
[2012.10.12 09:53:23 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\pdfforge
[2012.10.12 09:53:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
[2012.10.12 09:53:21 | 000,081,920 | ---- | C] (pdfforge GbR) -- C:\Windows\System32\pdfcmon.dll
[2012.10.12 09:53:20 | 000,000,000 | ---D | C] -- C:\Program Files\PDFCreator
[2012.10.03 21:44:10 | 000,000,000 | ---D | C] -- C:\Users\TO\AppData\Roaming\Avira
[2012.10.03 21:38:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.10.03 21:38:40 | 000,133,824 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2012.10.03 21:38:40 | 000,083,792 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2012.10.03 21:38:40 | 000,036,552 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2012.10.03 21:38:40 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2012.10.03 21:38:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.10.03 21:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2012.10.03 21:35:15 | 000,000,000 | -HSD | C] -- C:\Config.Msi
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.01 16:24:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\TO\Desktop\OTL.exe
[2012.11.01 16:23:29 | 000,000,000 | ---- | M] () -- C:\Users\TO\defogger_reenable
[2012.11.01 16:22:50 | 000,050,477 | ---- | M] () -- C:\Users\TO\Desktop\Defogger.exe
[2012.11.01 16:00:27 | 000,001,065 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.01 16:00:04 | 010,669,952 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\TO\Desktop\mbam-setup-1.65.1.1000.exe
[2012.11.01 15:56:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.01 15:36:00 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.11.01 11:36:13 | 000,237,640 | ---- | M] () -- C:\Users\TO\Desktop\kickstart.php
[2012.11.01 11:36:13 | 000,005,250 | ---- | M] () -- C:\Users\TO\Desktop\de-DE.kickstart.ini
[2012.11.01 11:31:43 | 000,144,893 | ---- | M] () -- C:\Users\TO\Desktop\kickstart-core-3.5.2.zip
[2012.11.01 11:10:18 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.01 11:10:17 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.01 11:09:41 | 000,643,628 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.01 11:09:41 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.01 11:09:41 | 000,126,188 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.01 11:09:41 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.01 11:05:22 | 000,001,086 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.11.01 11:05:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.01 11:05:08 | 1610,113,024 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.30 15:39:18 | 000,214,283 | ---- | M] () -- C:\Users\TO\Desktop\1.jpg
[2012.10.30 15:37:07 | 000,151,803 | ---- | M] () -- C:\Users\TO\Desktop\1-023.jpg
[2012.10.30 11:42:04 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2012.10.03 21:37:34 | 008,352,515 | ---- | M] () -- C:\Users\TO\Desktop\Ostsee.zip
[2012.10.03 10:04:51 | 000,003,584 | ---- | M] () -- C:\Users\TO\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.10.03 08:27:34 | 001,630,336 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2012.11.01 16:23:29 | 000,000,000 | ---- | C] () -- C:\Users\TO\defogger_reenable
[2012.11.01 16:22:50 | 000,050,477 | ---- | C] () -- C:\Users\TO\Desktop\Defogger.exe
[2012.11.01 16:00:27 | 000,001,065 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.11.01 11:31:42 | 000,144,893 | ---- | C] () -- C:\Users\TO\Desktop\kickstart-core-3.5.2.zip
[2012.10.30 15:41:07 | 004,825,831 | ---- | C] () -- C:\Users\TO\Desktop\1 036.JPG
[2012.10.30 15:39:17 | 000,214,283 | ---- | C] () -- C:\Users\TO\Desktop\1.jpg
[2012.10.30 15:37:07 | 000,151,803 | ---- | C] () -- C:\Users\TO\Desktop\1-023.jpg
[2012.10.30 15:32:21 | 003,676,370 | ---- | C] () -- C:\Users\TO\Desktop\1 023.JPG
[2012.10.19 14:52:55 | 000,001,843 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012.10.03 10:04:51 | 000,003,584 | ---- | C] () -- C:\Users\TO\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.30 08:59:44 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.09.16 13:23:16 | 000,196,676 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2012.09.16 13:01:57 | 000,010,084 | R--- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2012.09.16 10:39:08 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.07.04 06:27:30 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2012.07.04 06:27:30 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2012.07.04 01:32:18 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.04.18 18:39:06 | 000,028,672 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll
[2012.03.06 18:59:32 | 000,618,823 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2009.07.14 02:16:14 | 012,866,560 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.10.16 22:17:13 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\AceBIT
[2012.09.27 19:38:08 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\Ashampoo
[2012.10.19 14:52:59 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\Canneverbe Limited
[2012.10.19 14:41:36 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\DVDVideoSoft
[2012.10.19 14:41:29 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.10.19 16:11:11 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\MediaMonkey
[2012.10.12 09:56:50 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\pdfforge
[2012.09.16 13:09:00 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\SpeedProject
[2012.09.16 13:11:51 | 000,000,000 | ---D | M] -- C:\Users\TO\AppData\Roaming\Thunderbird
 
========== Purity Check ==========

< End of report >
         

--- --- ---
____________________________________________________


Mit freundlichem Gruß
Theo

hi
1. öffne malwarebytes, berichte poste logs mit funden.

2. öffne avira, verwaltung quarantäne, poste fundmeldungen mit pfadangaben als text
3. tritt die meldung, warte auf google, nur bei deiner seite oder immer auf?
wenn nur auf deiner seite, send mir den link als private nachicht

Danke für die schnelle Antwort.

zu 1:Log-File Malwarebytes
siehe am Ende dieses Beitrags

zu 2: Avira Quarantäne
1 Fund
C:\TO\Appdata\Local\Temp\YontooSetup-S.exe

zu 3:
-Meine Seite ist nicht mehr Online
-Warte auf Google trat nur auf meiner Seite auf
-Allerdings beobachte ich jetzt das die Statusmeldung in Firefox immer nach rechts wechselt wenn ich mit der Maus drauf gehe. Bin mir nicht mehr sicher obs eine Standarteinstellung von Firefox ist?

Zu 1: Malwarebytes
__________________________
Malwarebytes Anti-Malware (Test) 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.01.07

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
TO :: TO-PC [Administrator]

Schutz: Deaktiviert

01.11.2012 22:57:30
mbam-log-2012-11-01 (22-57-30).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 185187
Laufzeit: 3 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
__________________________

Noch eine Info zu meiner Seite

Auf dem Server wurde in vielen Verzeichnissen eine .htacess eingefügt (nicht von mir)

Mit freundlichem Gruß
Theo

sind das alle Malwarebytes logs? falls nein, poste die mit funden