Hallo,

ich habe einen GVU-Trojaner auf meinen Rechner.
Als Betriebssystem verwende ich Windows Vista und bin mit Adminrechten am Rechner angemeldet, daher funktioniert der Tipp "mit dem abgesichertem Modus" nicht.

Ich habe meinen Rechner mit OTL gescannt.OTL Logfile:

OTL logfile created on: 1/31/2013 5:38:12 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117.54 Gb Total Space | 25.66 Gb Free Space | 21.83% Space Free | Partition Type: NTFS
Drive D: | 113.88 Gb Total Space | 0.21 Gb Free Space | 0.19% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/01/22 13:56:06 | 000,945,328 | ---- | M] () [Auto] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe -- (vToolbarUpdater14.0.1)
SRV - [2013/01/14 00:03:52 | 000,587,912 | ---- | M] (Crawler.com) [Auto] -- C:\Program Files\Spyware Terminator\st_rsser.exe -- (ST2012_Svc)
SRV - [2012/12/25 03:53:30 | 002,547,816 | ---- | M] () [Auto] -- C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2012/11/09 05:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/10/31 20:12:13 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/08/12 20:24:48 | 005,167,736 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2012/05/08 15:06:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/05/08 15:06:46 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/02/13 21:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/05/12 10:26:46 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand] -- C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2011/05/12 10:26:43 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/03/31 09:08:14 | 000,080,896 | ---- | M] () [Auto] -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2010/03/29 10:13:26 | 000,602,624 | ---- | M] (Hauppauge Computer Works) [Auto] -- C:\Program Files\WinTV\TVServer\HauppaugeTVServer.exe -- (HauppaugeTVServer)
SRV - [2008/08/25 02:58:20 | 000,077,824 | ---- | M] (Toshiba) [On_Demand] -- C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe -- (SmartFaceVWatchSrv)
SRV - [2008/07/18 13:39:30 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto] -- C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2008/06/20 09:53:56 | 000,129,144 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Program Files\IVI Foundation\VISA\WinNT\NIvisa\niLxiDiscovery.exe -- (niLXIDiscovery)
SRV - [2008/06/20 08:46:24 | 000,607,848 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe -- (NITaggerService)
SRV - [2008/06/18 09:57:40 | 000,192,112 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe -- (nimDNSResponder)
SRV - [2008/06/17 10:38:28 | 000,213,552 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Program Files\National Instruments\Shared\Security\nidmsrv.exe -- (NIDomainService)
SRV - [2008/06/17 10:38:16 | 000,050,736 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Windows\System32\lktsrv.exe -- (lkTimeSync)
SRV - [2008/06/17 10:38:08 | 000,040,488 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Windows\System32\lkads.exe -- (lkClassAds)
SRV - [2008/06/17 09:21:50 | 000,695,136 | ---- | M] (National Instruments, Inc.) [Auto] -- C:\Windows\System32\lkcitdl.exe -- (LkCitadelServer)
SRV - [2008/06/12 11:12:40 | 001,007,616 | ---- | M] (Macrovision Corporation) [Disabled] -- C:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe -- (NILM License Manager)
SRV - [2008/04/24 03:21:56 | 000,099,720 | ---- | M] (Toshiba Europe GmbH) [Auto] -- C:\Program Files\Toshiba TEMPRO\TempoSVC.exe -- (TempoMonitoringService)
SRV - [2008/04/17 02:08:46 | 001,528,608 | ---- | M] (Cisco Systems, Inc.) [Auto] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2008/04/16 17:19:48 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service)
SRV - [2008/04/11 04:57:14 | 000,124,264 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2008/04/02 09:29:48 | 000,012,696 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Program Files\National Instruments\MAX\nimxs.exe -- (mxssvr)
SRV - [2008/01/20 21:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/18 08:17:42 | 000,204,800 | ---- | M] () [Auto] -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe -- (LinksysUpdater)
SRV - [2008/01/17 09:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) [Auto] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV - [2007/12/03 10:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) [Auto] -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service)
SRV - [2007/11/21 10:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2007/11/06 08:07:32 | 000,008,656 | ---- | M] (National Instruments Corporation) [Auto] -- C:\Windows\System32\nisvcloc.exe -- (niSvcLoc)
SRV - [2007/05/09 08:34:34 | 000,098,304 | ---- | M] (OPC Foundation) [On_Demand] -- C:\Windows\System32\Opcenum.exe -- (OpcEnum)
SRV - [2007/02/12 03:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto] -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe -- (o2flash)
SRV - [2006/08/23 09:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto] -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper)
SRV - [2005/11/17 07:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand] -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2005/09/23 00:01:16 | 002,799,808 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] -- -- (vpnva)
DRV - File not found [Kernel | On_Demand] -- -- (Tosrfcom)
DRV - File not found [Kernel | On_Demand] -- -- (pccsmcfd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
DRV - [2013/01/22 13:56:06 | 000,031,576 | ---- | M] (AVG Technologies) [Kernel | System] -- C:\Windows\System32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2012/08/24 08:43:18 | 000,301,920 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/07/25 20:21:30 | 000,237,408 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/05/08 15:06:49 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/05/08 15:06:49 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012/04/18 21:50:26 | 000,024,896 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- C:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/01/30 21:46:50 | 000,031,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/12/23 06:32:14 | 000,041,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/12/23 06:32:08 | 000,017,232 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2011/12/23 06:32:06 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avgidsfilterx.sys -- (AVGIDSFilter)
DRV - [2011/12/23 06:32:00 | 000,139,856 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2011/09/16 10:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/06/21 05:24:06 | 000,032,768 | ---- | M] () [Kernel | System] -- C:\Windows\System32\drivers\sp_rsdrv2.sys -- (sp_rsdrv2)
DRV - [2010/11/23 13:29:18 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010/07/04 14:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010/06/23 03:23:44 | 000,023,040 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2010/01/27 12:56:48 | 000,054,016 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hcw17bda.sys -- (hcw17bda)
DRV - [2009/10/08 10:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/06/09 17:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009/03/29 20:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2009/02/09 02:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2009/02/09 02:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2009/02/09 02:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2009/02/09 02:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/07/18 11:52:16 | 000,279,376 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\tos_sps32.sys -- (tos_sps32)
DRV - [2008/07/15 12:59:06 | 000,017,960 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)
DRV - [2008/06/20 10:54:16 | 000,011,360 | ---- | M] (National Instruments Corporation) [Kernel | Auto] -- C:\Windows\System32\drivers\NiViPxiKl.sys -- (NiViPxiK)
DRV - [2008/06/20 10:54:16 | 000,011,360 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NiViPciKl.sys -- (NiViPciK)
DRV - [2008/06/20 09:04:48 | 000,011,384 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NiViFWKl.sys -- (NiViFWK)
DRV - [2008/06/19 23:37:06 | 000,112,128 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008/06/13 08:51:06 | 000,011,360 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nidimkl.sys -- (nidimk)
DRV - [2008/06/13 08:48:32 | 000,011,344 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\niorbkl.sys -- (niorbk)
DRV - [2008/06/13 02:27:46 | 000,586,328 | ---- | M] (National Instruments Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\nipalk.sys -- (NIPALK)
DRV - [2008/06/13 02:27:46 | 000,011,896 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nipalusbedl.sys -- (nipalusbedl)
DRV - [2008/06/13 02:27:44 | 000,011,904 | ---- | M] (National Instruments Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nipalfwedl.sys -- (nipalfwedl)
DRV - [2008/04/27 17:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008/04/23 10:15:26 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008/04/17 02:07:52 | 000,306,299 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2008/04/14 21:13:14 | 000,051,160 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)
DRV - [2008/04/07 03:00:00 | 000,004,096 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\cvintdrv.sys -- (cvintdrv)
DRV - [2008/03/29 10:36:28 | 000,125,328 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2008/03/19 04:38:24 | 000,074,112 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008/03/04 12:32:00 | 000,188,416 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)
DRV - [2007/11/09 07:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ)
DRV - [2007/10/18 07:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007/10/16 18:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/07/10 13:08:14 | 000,015,448 | ---- | M] (National Instruments Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\nipbcfk.sys -- (nipbcfk)
DRV - [2007/04/24 10:52:10 | 000,016,688 | ---- | M] (IBM) [Kernel | System] -- C:\Windows\System32\drivers\LUMDriver.sys -- (LUMDriver)
DRV - [2007/04/09 10:13:00 | 000,008,192 | ---- | M] (TOSHIBA) [Kernel | On_Demand] -- C:\Windows\System32\drivers\QIOMem.sys -- (QIOMem)
DRV - [2007/01/18 10:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006/10/23 09:32:20 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec)
DRV - [2006/10/18 04:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\Markus_ON_C\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=110231&tt=0213_1&babsrc=HP_ss&mntrId=56c3ba570000000000000022fae24d50
IE - HKU\Markus_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA;
IE - HKU\Markus_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Markus_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Markus_ON_C\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - File not found
IE - HKU\Markus_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=971163"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid={827DC1AE-4F31-4E22-88D1-99F9E142D0DD}&mid=f12871906b9b47d19cc863ac451d1aa4-b608703012e6471492d31b6e7275dd76f4a62b50&lang=de&ds=AVG&pr=fr&d=2013-01-22 19:56:21&pid=avg&sg=&v=14.0.0.14&sap=ku&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.0.1\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\Browser\Plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\Browser\Plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: 
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/09/10 11:13:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\14.0.0.14 [2013/01/22 13:56:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/31 20:12:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/31 20:11:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/10/14 08:31:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2013/01/09 13:55:38 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/10/31 20:12:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/10/31 20:11:55 | 000,000,000 | ---D | M]
 
[2009/10/27 17:56:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Markus\AppData\Roaming\Mozilla\Extensions
[2013/01/20 08:19:59 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\extensions
[2012/10/10 17:30:54 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010/04/28 12:45:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2013/01/09 11:19:01 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2013/01/20 08:20:08 | 000,000,911 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\searchplugins\11-suche.xml
[2012/12/31 14:09:50 | 000,000,931 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\searchplugins\conduit.xml
[2010/11/23 13:35:41 | 000,002,921 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\searchplugins\daemon-search.xml
[2013/01/20 08:20:08 | 000,002,273 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\searchplugins\englische-ergebnisse.xml
[2013/01/20 08:20:08 | 000,010,563 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\searchplugins\gmx-suche.xml
[2013/01/20 08:20:08 | 000,002,432 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\searchplugins\lastminute.xml
[2013/01/20 08:20:08 | 000,005,545 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\m60o80n9.default\searchplugins\webde-suche.xml
[2012/10/31 20:11:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/10/31 20:11:28 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/10/31 20:11:43 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Program Files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2012/10/31 20:11:24 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak
[2012/10/31 20:11:25 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak
[2012/10/31 20:11:25 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:\Program Files\Mozilla Firefox\extensions\quickstores@quickstores.de
[2012/10/31 20:11:27 | 000,000,000 | ---D | M] (Search Settings Plugin) -- C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
File not found (No name found) -- 
[2013/01/09 13:55:38 | 000,000,000 | ---D | M] (BrowserProtect) -- C:\PROGRAMDATA\BROWSERPROTECT\2.6.1040.25\{C16C1CCB-7046-4E5C-A2F3-533AD2FEC8E8}\FIREFOXEXTENSION
() (No name found) -- C:\USERS\MARKUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M60O80N9.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}.XPI
() (No name found) -- C:\USERS\MARKUS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M60O80N9.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2012/10/31 20:12:13 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/10/14 10:21:24 | 000,155,648 | ---- | M] (Dassault Systèmes SolidWorks Corp.) -- C:\Program Files\mozilla firefox\plugins\npEModelPlugin.dll
[2012/02/15 08:48:02 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files\mozilla firefox\plugins\npmieze.dll
[2012/02/19 08:50:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013/01/22 13:56:26 | 000,003,598 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2013/01/09 13:55:21 | 000,002,349 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/09/09 15:52:47 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/19 08:50:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/02/19 08:50:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/02/19 08:50:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/02/19 08:50:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.0.0.14\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (no name) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - File not found
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.0.0.14\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - No CLSID value found.
O3 - HKU\Markus_ON_C\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [cfFncEnabler.exe] File not found
O4 - HKLM..\Run: [Google EULA Launcher] C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe ( )
O4 - HKLM..\Run: [HDMICtrlMan] C:\Program Files\Toshiba\HDMICtrlMan\HDMICtrlMan.exe (TOSHIBA Corporation.)
O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [NI Background Service] C:\Program Files\National Instruments\Shared\Update Service\BackgroundService.exe (National Instruments)
O4 - HKLM..\Run: [OPSE reminder] C:\Program Files\ScanSoft\OmniPageSE2.0\EregGer\Ereg.exe ()
O4 - HKLM..\Run: [OpwareSE2] C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SearchSettings] File not found
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\SmoothView\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SMSTray] File not found
O4 - HKLM..\Run: [SpywareTerminatorShield] C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKLM..\Run: [SpywareTerminatorUpdater] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKLM..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe (TOSHIBA)
O4 - HKLM..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe (Toshiba)
O4 - HKLM..\Run: [Toshiba TEMPO] C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe (Toshiba Europe GmbH)
O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Markus_ON_C..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKU\Markus_ON_C..\Run: [maoq.exe] File not found
O4 - HKU\Markus_ON_C..\Run: [TOSCDSPD] File not found
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1404b2c416da.dat ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O7 - HKU\Markus_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Markus_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\Markus_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll (National Instruments Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.7.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.0.1\ViProtocol.dll ()
O20 - AppInit_DLLs: (c:\progra~2\browse~1\261040~1.25\{c16c1~1\browse~1.dll) - C:\ProgramData\BrowserProtect\2.6.1040.25\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Markus_ON_C Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\Markus_ON_C Winlogon: Shell - (C:\Users\Markus\AppData\Roaming\skype.dat) - C:\Users\Markus\AppData\Roaming\skype.dat ()
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Dock.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{120be9ca-46ed-11df-b0c7-00238bce07f7}\Shell\AutoRun\command - "" = /RAR/RAR-archiv.bat
O33 - MountPoints2\{541ed39c-fd57-11df-becf-00238bce07f7}\Shell - "" = AutoRun
O33 - MountPoints2\{541ed39c-fd57-11df-becf-00238bce07f7}\Shell\AutoRun\command - "" = H:\setup.exe AUTORUN=1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/29 22:35:05 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2013/01/29 22:35:01 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/01/28 21:47:16 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2013/01/27 20:25:07 | 000,000,000 | -HSD | C] -- C:\found.000
[2013/01/22 13:56:35 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Local\AVG Secure Search
[2013/01/22 13:56:28 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Security Toolbar
[2013/01/22 13:56:26 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG Secure Search
[2013/01/22 13:56:18 | 000,031,576 | ---- | C] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2013/01/22 13:56:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVG Secure Search
[2013/01/22 13:56:14 | 000,000,000 | ---D | C] -- C:\Program Files\AVG Secure Search
[2013/01/22 13:51:29 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG January 2013 Campaign
[2013/01/14 15:10:41 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Roaming\Spyware Terminator
[2013/01/14 15:10:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator
[2013/01/14 15:09:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012
[2013/01/14 15:08:18 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator
[2013/01/09 13:55:39 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
[2013/01/09 13:55:36 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserProtect
[2013/01/09 13:55:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
[2013/01/09 13:55:03 | 000,000,000 | ---D | C] -- C:\Users\Markus\AppData\Roaming\Babylon
[2013/01/09 13:55:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013/01/09 09:29:19 | 002,048,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013/01/09 09:28:49 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2013/01/08 21:12:47 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/01/08 21:12:46 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/01/08 21:12:46 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2013/01/08 21:12:46 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/01/08 21:12:46 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/01/08 21:12:46 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/01/08 21:12:45 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/01/08 21:12:45 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2013/01/08 21:12:44 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/01/08 21:12:43 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/01/08 21:08:11 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2013/01/08 21:08:03 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2013/01/08 21:08:03 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2013/01/08 21:08:03 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winusb.dll
[2013/01/08 21:08:02 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2013/01/08 21:08:02 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2013/01/08 21:01:51 | 000,293,376 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2013/01/08 21:01:51 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2013/01/08 11:55:32 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnet.dll
[2013/01/08 11:55:32 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpnsvr.exe
[2013/01/08 11:55:26 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2013/01/08 11:42:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013/01/08 11:42:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
 
========== Files - Modified Within 30 Days ==========
 
[2013/01/30 14:53:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/01/30 14:52:47 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/30 14:52:47 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/30 14:52:35 | 000,000,004 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\skype.ini
[2013/01/30 14:45:25 | 3050,168,320 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/26 15:46:42 | 107,819,834 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2013/01/22 15:32:38 | 000,700,406 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/01/22 15:32:37 | 000,740,322 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013/01/22 15:32:37 | 000,170,048 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013/01/22 15:32:37 | 000,144,062 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/01/22 14:55:30 | 000,000,298 | ---- | M] () -- C:\Windows\tasks\ROC_REG_JAN_DELETE.job
[2013/01/22 13:56:06 | 000,031,576 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2013/01/20 08:21:50 | 000,002,655 | ---- | M] () -- C:\Users\Markus\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2013/01/16 12:06:04 | 000,020,720 | ---- | M] () -- C:\Users\Markus\Desktop\getgoods.de - günstige Smartphones - Tablet PCs - Haushaltsgeräte, Zubehör und vieles mehr.pdf
[2013/01/14 15:09:53 | 000,000,852 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
[2013/01/14 15:09:53 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spyware Terminator 2012
[2013/01/11 20:38:45 | 000,475,768 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/01/09 13:55:18 | 000,001,056 | ---- | M] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk
[2013/01/09 13:55:18 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
[2013/01/08 11:42:41 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013/01/08 11:42:37 | 000,001,880 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
 
========== Files Created - No Company Name ==========
 
[2013/01/29 14:42:22 | 3050,168,320 | -HS- | C] () -- C:\hiberfil.sys
[2013/01/25 16:37:28 | 000,000,004 | ---- | C] () -- C:\Users\Markus\AppData\Roaming\skype.ini
[2013/01/22 13:51:30 | 000,000,298 | ---- | C] () -- C:\Windows\tasks\ROC_REG_JAN_DELETE.job
[2013/01/16 12:06:03 | 000,020,720 | ---- | C] () -- C:\Users\Markus\Desktop\getgoods.de - günstige Smartphones - Tablet PCs - Haushaltsgeräte, Zubehör und vieles mehr.pdf
[2013/01/14 15:10:56 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2013/01/14 15:09:53 | 000,000,852 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator 2012.lnk
[2013/01/09 13:55:18 | 000,001,056 | ---- | C] () -- C:\Users\Public\Desktop\MyPhoneExplorer.lnk
[2013/01/08 21:08:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013/01/08 21:08:20 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012/11/17 18:41:43 | 000,000,047 | ---- | C] () -- C:\Users\Markus\AppData\Roaming\msconfig.ini
[2012/08/11 17:53:42 | 000,000,051 | ---- | C] () -- C:\ProgramData\amkwnhkkbqwluml
[2012/07/24 16:21:44 | 000,000,051 | ---- | C] () -- C:\ProgramData\vwczkojxvzzgrxe
[2012/03/20 15:06:26 | 000,000,036 | ---- | C] () -- C:\Users\Markus\AppData\Local\housecall.guid.cache
[2012/03/20 15:01:14 | 000,000,680 | ---- | C] () -- C:\Users\Markus\AppData\Local\d3d9caps.dat
[2012/01/10 21:05:32 | 000,070,503 | ---- | C] () -- C:\Users\Markus\AppData\Roaming\msconfig.dat.vir
[2012/01/10 21:05:32 | 000,047,104 | ---- | C] () -- C:\Users\Markus\AppData\Roaming\skype.dat
[2011/11/02 16:19:24 | 000,010,752 | ---- | C] () -- C:\Windows\System32\KOBJ7J_L.DLL
[2011/05/13 14:00:33 | 000,015,872 | R--- | C] () -- C:\Windows\System32\ibfs32.dll
[2011/05/12 10:27:19 | 000,000,000 | ---- | C] () -- C:\Windows\eDrawingOfficeAutomator.INI
[2010/10/14 14:36:08 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/07/09 17:47:21 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010/07/09 17:47:21 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/07/09 17:46:42 | 000,142,337 | ---- | C] () -- C:\Windows\System32\Wait.exe
[2010/07/09 17:24:25 | 000,034,706 | ---- | C] () -- C:\Windows\Irremote.ini
[2010/07/09 17:22:35 | 000,006,456 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2010/04/06 16:42:55 | 000,000,065 | ---- | C] () -- C:\Windows\FISHUI.INI
[2010/04/02 07:18:17 | 000,002,554 | ---- | C] () -- C:\Windows\WAVEMIX.INI
[2010/01/29 11:52:02 | 000,000,116 | ---- | C] () -- C:\Windows\GPM2MICP.INI
[2010/01/27 19:09:54 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/12/18 08:06:41 | 000,212,992 | ---- | C] () -- C:\Windows\System32\WMIMPLEX.dll
[2009/12/18 08:06:41 | 000,031,232 | ---- | C] () -- C:\Windows\System32\maplec.dll
[2009/12/18 08:06:41 | 000,020,480 | ---- | C] () -- C:\Windows\System32\maplecompat.dll
[2009/12/15 11:29:01 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009/12/03 17:42:22 | 000,000,532 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2009/10/31 04:39:20 | 000,000,016 | -H-- | C] () -- C:\ProgramData\mxfilerelatedcache.mxc2
[2009/10/31 04:39:15 | 000,000,016 | -H-- | C] () -- C:\Users\Markus\AppData\Roaming\mxfilerelatedcache.mxc2
[2009/10/31 04:39:15 | 000,000,016 | -H-- | C] () -- C:\Users\Markus\AppData\mxfilerelatedcache.mxc2
[2009/10/31 04:39:15 | 000,000,016 | -H-- | C] () -- C:\Users\Markus\AppData\Local\mxfilerelatedcache.mxc2
[2009/10/22 16:51:58 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/10/22 16:51:57 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/10/22 16:51:01 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/10/14 13:24:46 | 000,059,392 | ---- | C] () -- C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/13 14:01:48 | 000,000,000 | ---- | C] () -- C:\Users\Markus\AppData\Roaming\wklnhst.dat
[2009/05/29 18:37:40 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009/05/29 18:31:52 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/08/06 04:36:52 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2008/08/06 04:04:05 | 000,006,642 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008/08/06 03:48:08 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2008/08/06 03:48:08 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2008/08/06 03:48:08 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2008/08/06 03:48:08 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2008/08/06 03:48:08 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2008/08/06 03:48:08 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2008/08/06 03:30:34 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2008/08/06 03:30:34 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2008/08/06 03:30:34 | 000,009,480 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2008/08/06 03:30:34 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2008/08/06 03:28:15 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008/08/06 03:25:30 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1502.dll
[2008/08/06 03:25:30 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2008/08/06 03:25:29 | 002,192,024 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2008/08/06 03:25:28 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin
[2008/08/06 03:25:27 | 000,492,496 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2008/06/13 08:47:30 | 000,000,244 | ---- | C] () -- C:\Windows\System32\nirpc.ini
[2008/06/13 02:26:08 | 000,003,520 | ---- | C] () -- C:\Windows\System32\nipalpg.dll
[2008/04/17 02:08:56 | 000,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2008/04/07 03:00:00 | 000,004,096 | ---- | C] () -- C:\Windows\System32\drivers\cvintdrv.sys
[2008/01/21 02:15:58 | 000,740,322 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/01/21 02:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/01/21 02:15:58 | 000,170,048 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/01/21 02:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007/12/21 09:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2007/08/21 12:46:34 | 000,059,160 | ---- | C] () -- C:\Windows\System32\zlib.dll
[2007/02/05 12:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2006/11/02 07:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,475,768 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,700,406 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,144,062 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005/07/22 14:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
[2002/05/15 18:38:40 | 000,091,136 | ---- | C] () -- C:\Windows\System32\mp4fil32.dll
[2002/05/04 08:19:00 | 000,049,152 | ---- | C] () -- C:\Windows\System32\avisynthEx.dll
[1999/07/07 10:01:12 | 000,045,056 | ---- | C] () -- C:\Windows\System32\davedec.dll
 
========== LOP Check ==========
 
[2012/03/20 15:23:25 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\AVG2012
[2013/01/09 13:55:03 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Babylon
[2011/02/12 16:02:37 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\BSplayer
[2010/04/28 12:36:55 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\BSplayer Pro
[2010/11/23 13:28:09 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\DAEMON Tools
[2010/11/16 15:47:50 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\DassaultSystemes
[2010/04/06 16:26:49 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\DataCast
[2010/05/05 15:51:05 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Dev-Cpp
[2012/10/31 20:27:15 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\DVDVideoSoft
[2011/06/08 14:34:26 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/06/30 13:32:52 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\DWGeditor
[2010/04/09 07:12:44 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\FileOpen
[2011/10/11 15:00:05 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Haeq
[2011/07/11 17:18:52 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\HTC
[2011/07/11 17:06:18 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2010/05/12 14:36:00 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\ICAClient
[2010/05/20 14:54:31 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\IrfanView
[2011/10/11 18:47:11 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Itsum
[2012/11/09 16:10:31 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\loadtbs
[2010/06/06 15:46:58 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\mathegrafix
[2013/01/09 14:11:27 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\MyPhoneExplorer
[2009/11/15 18:34:48 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\myphotobook
[2010/09/28 15:44:24 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Nokia
[2012/10/31 20:26:17 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\OpenCandy
[2013/01/09 13:43:02 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Outlook
[2009/11/09 16:01:45 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\PC Suite
[2012/08/13 16:08:32 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\pdfforge
[2012/03/16 15:28:24 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Petroglyph
[2012/03/20 15:03:06 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\QuickStoresToolbar
[2009/12/03 17:54:59 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Scan2PDF
[2009/12/03 17:42:29 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\ScanSoft
[2013/01/14 15:10:41 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Spyware Terminator
[2012/10/14 08:33:16 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Thunderbird
[2010/04/16 06:54:36 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Toshiba
[2012/10/31 20:27:53 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\TuneUp Software
[2009/11/07 16:36:43 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\Ulead Systems
[2010/04/09 13:34:18 | 000,000,000 | ---D | M] -- C:\Users\Markus\AppData\Roaming\VistaCodecs
[2009/10/13 13:29:13 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/07/23 12:35:26 | 000,000,000 | ---D | M] -- C:\ProgramData\AVAST Software
[2013/01/22 13:53:01 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG January 2013 Campaign
[2013/01/22 13:56:27 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG Secure Search
[2013/01/22 13:56:28 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG Security Toolbar
[2012/03/20 15:33:02 | 000,000,000 | ---D | M] -- C:\ProgramData\AVG2012
[2013/01/09 13:55:03 | 000,000,000 | ---D | M] -- C:\ProgramData\Babylon
[2013/01/09 13:55:36 | 000,000,000 | ---D | M] -- C:\ProgramData\BrowserProtect
[2009/10/19 16:08:18 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
[2011/02/12 16:04:12 | 000,000,000 | ---D | M] -- C:\ProgramData\Cisco
[2012/01/02 16:27:56 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files
[2010/11/23 15:27:37 | 000,000,000 | ---D | M] -- C:\ProgramData\DassaultSystemes
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2009/10/13 13:29:13 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2009/10/13 13:29:13 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2010/04/09 07:12:43 | 000,000,000 | ---D | M] -- C:\ProgramData\FileOpen
[2011/11/06 11:00:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Firefly Studios
[2009/11/09 15:49:04 | 000,000,000 | ---D | M] -- C:\ProgramData\Installations
[2009/10/16 12:08:38 | 000,000,000 | ---D | M] -- C:\ProgramData\IsolatedStorage
[2009/10/16 15:24:24 | 000,000,000 | ---D | M] -- C:\ProgramData\IVI Foundation
[2010/11/03 16:57:17 | 000,000,000 | ---D | M] -- C:\ProgramData\Linksys
[2012/11/09 16:11:21 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX
[2013/01/26 15:47:58 | 000,000,000 | ---D | M] -- C:\ProgramData\MFAData
[2009/10/17 13:11:39 | 000,000,000 | ---D | M] -- C:\ProgramData\National Instruments
[2011/05/05 13:27:13 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2010/06/25 15:51:03 | 000,000,000 | ---D | M] -- C:\ProgramData\ScanSoft
[2012/09/22 09:31:58 | 000,000,000 | ---D | M] -- C:\ProgramData\segivjlsdiqbsww
[2013/01/21 12:19:56 | 000,000,000 | ---D | M] -- C:\ProgramData\Spyware Terminator
[2009/12/03 17:42:23 | 000,000,000 | ---D | M] -- C:\ProgramData\SSScanAppDataDir
[2009/12/03 17:42:23 | 000,000,000 | ---D | M] -- C:\ProgramData\SSScanWizard
[2006/11/02 08:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2009/10/13 13:29:13 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2006/11/02 08:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2010/11/19 16:13:16 | 000,000,000 | ---D | M] -- C:\ProgramData\tmp
[2009/10/13 12:34:08 | 000,000,000 | ---D | M] -- C:\ProgramData\Toshiba
[2009/10/13 13:34:02 | 000,000,000 | ---D | M] -- C:\ProgramData\ToshibaEurope
[2012/10/31 20:27:54 | 000,000,000 | ---D | M] -- C:\ProgramData\TuneUp Software
[2008/08/06 03:47:21 | 000,000,000 | ---D | M] -- C:\ProgramData\Ulead Systems
[2010/04/09 13:34:17 | 000,000,000 | ---D | M] -- C:\ProgramData\VistaCodecs
[2009/10/13 13:29:13 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2010/04/21 18:54:29 | 000,000,000 | ---D | M] -- C:\ProgramData\WindowsSearch
[2012/09/22 09:36:57 | 000,000,000 | ---D | M] -- C:\ProgramData\zcetocmxdjvkhdz
[2008/08/06 04:00:15 | 000,000,000 | ---D | M] -- C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2012/10/31 20:27:18 | 000,000,000 | -HSD | M] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
[2013/01/22 14:55:30 | 000,000,298 | ---- | M] () -- C:\Windows\Tasks\ROC_REG_JAN_DELETE.job
[2013/01/30 14:52:46 | 000,032,578 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
         

--- --- ---



Könnt ihr mir bitte helfen, den GVU Trojaner zu entfernen.

Danke.

VG

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - Startup: C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1404b2c416da.dat ()
O20 - HKU\Markus_ON_C Winlogon: Shell - (C:\Users\Markus\AppData\Roaming\skype.dat) - C:\Users\Markus\AppData\Roaming\skype.dat ()
 :Files
C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1404b2c416da.dat
:Commands
[EMPTYFLASH] 
[emptytemp]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die + E Taste.

• Öffne dein Systemlaufwerk ( meistens C: )
• Suche nun
  folgenden Ordner: _OTL und öffne diesen.
• Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
• 
  Dies wird eine Movedfiles.zip Datei in _OTL erstellen
• Lade diese bitte in unseren Uploadchannel
  hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus