Google Ergebnisse werden umgeleitet zu anderen Seiten

OldCadillac

Hallo liebe Trojaner-Spezialisten,

mich hat es also auch mal erwischt und bitte Euch um Hilfe.

Das Problem : Vorgestern Abend fiel mir zunächst mal auf, daß der PC unheimlich langsam war. Lt. Taskmanager benutzte eine apache.exe dauernd viel CPU Leistung aus, ging weg, kam wieder, jedenfalls war in der Prozessliste ordentlich Bewegung.
Gestern Vormittag das gleiche wieder. Am Nachmittag war aber Schluß damit und ist bis heute nicht wieder aufgetaucht.
Aber... seit gestern Vormittag kann ich mich auch nicht mehr in AOL Webmail einloggen. Beim ersten Versuch kommt die Log In Seite nochmal, Anmeldename steht drin, Passwort nicht. Dann nochmal probiert und dann kommt die Website mit dem hübschen Männchen von AOL und dem Ausspruch "Blerk". Von einem anderem PC aus aber ist es kein Problem.

Und gestern Abend fiel mir auf, daß manchmal die Suchergebnisse von Google.mehrfach umleitet werden z.B. von Chip.

Hier nun die ganzen Logfiles, ich hoffe ich habe alles richtig gemacht und es fehlt nichts :

OTL logfile created on: 09.02.2013 08:44:00 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Test2\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,50 Gb Total Physical Memory | 0,98 Gb Available Physical Memory | 65,30% Memory free
2,85 Gb Paging File | 2,49 Gb Available in Paging File | 87,26% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39,06 Gb Total Space | 10,00 Gb Free Space | 25,61% Space Free | Partition Type: NTFS

Computer Name: HEIMPC | User Name: Test2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.02.09 08:08:44 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Test2\Eigene Dateien\Downloads\OTL.exe
PRC - [2013.01.08 11:27:24 | 000,026,600 | ---- | M] (Uniblue Systems Ltd) -- C:\Programme\Uniblue\SpeedUpMyPC\spmonitor.exe
PRC - [2012.12.03 08:35:28 | 000,946,352 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
PRC - [2012.10.26 19:16:12 | 000,271,808 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\3.0.313\SSScheduler.exe
PRC - [2012.01.18 13:02:04 | 000,508,136 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe
PRC - [2012.01.18 13:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2011.11.17 18:29:26 | 000,901,800 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2010.05.20 23:59:30 | 011,312,128 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin
PRC - [2010.05.20 23:59:28 | 011,318,784 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe
PRC - [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.02.02 17:26:44 | 000,283,136 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\FRITZWLANMini.exe
PRC - [2005.11.11 15:30:32 | 000,270,336 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe
PRC - [2005.11.11 15:29:18 | 000,139,264 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
PRC - [2005.11.11 15:26:24 | 000,118,843 | ---- | M] (NVIDIA) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
PRC - [2005.11.11 15:26:08 | 000,061,503 | ---- | M] (NVIDIA) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
PRC - [2002.01.29 13:33:14 | 000,077,824 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\eEBSvc.exe
PRC - [1998.07.30 13:55:24 | 000,022,528 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Ulead Systems\Ulead PhotoImpact 4.2\ABMTSR.EXE


========== Modules (No Company Name) ==========

MOD - [2010.05.04 15:36:28 | 000,970,752 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll
MOD - [2009.02.27 16:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
MOD - [2008.06.20 17:02:46 | 000,247,296 | ---- | M] () -- \\?\globalroot\systemroot\system32\mswsock.dll
MOD - [2008.06.20 17:02:46 | 000,247,296 | ---- | M] () -- \\.\globalroot\systemroot\system32\mswsock.dll
MOD - [2005.11.11 15:29:18 | 000,139,264 | ---- | M] () -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
MOD - [2002.04.04 23:07:00 | 000,286,720 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\eEBNWDev.dll
MOD - [2002.01.29 13:33:14 | 000,077,824 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\eEBSvc.exe
MOD - [1999.02.12 15:23:52 | 000,045,568 | ---- | M] () -- C:\Program Files\WS_FTP Pro\nsftpch.dll


========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012.12.17 20:33:23 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.10.26 19:15:26 | 000,234,776 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.313\McCHSvc.exe -- (McComponentHostService)
SRV - [2012.04.05 17:03:00 | 003,969,336 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\WINDOWS\system32\GameMon.des -- (npggsvc)
SRV - [2005.11.11 15:29:18 | 000,139,264 | ---- | M] () [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)
SRV - [2005.11.11 15:26:24 | 000,118,843 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe -- (nSvcIp)
SRV - [2005.11.11 15:26:08 | 000,061,503 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe -- (nSvcLog)
SRV - [2005.09.30 18:34:58 | 000,020,543 | ---- | M] (Apache Software Foundation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe -- (ForcewareWebInterface)
SRV - [2002.01.29 13:33:14 | 000,077,824 | ---- | M] () [Auto | Running] -- C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\eEBSvc.exe -- (EpsonBidirectionalService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [File_System | Auto | Stopped] -- -- (StarOpen)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2009.09.28 09:55:38 | 000,052,656 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\OXSDIDRV_x32.sys -- (OXSDIDRV_x32)
DRV - [2007.01.26 01:00:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2007.01.26 01:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avmeject.sys -- (avmeject)
DRV - [2005.11.11 14:19:04 | 000,012,928 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2005.11.11 14:19:02 | 000,034,048 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2005.08.10 20:49:28 | 000,393,088 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)
DRV - [2005.02.11 09:24:24 | 000,079,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750obex.sys -- (k750obex)
DRV - [2005.02.11 09:22:48 | 000,081,728 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt)
DRV - [2005.02.11 09:19:20 | 000,055,216 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus)
DRV - [2005.01.07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D8 19 07 9D 5C 93 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{B942219B-E9A1-4ECC-8191-A67ED598E7D9}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=NY&apn_dtid=YYYYYYYYDE&apn_uid=488E09D6-0857-4EE8-BD5E-1A67896F8747&apn_sauid=94B904BF-02E9-4049-AB07-C304ACA6B50C&
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=15768"
FF - prefs.js..extensions.enabledAddons: ich@maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: stealthyextension@gmail.com:2.4
FF - prefs.js..extensions.enabledAddons: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.13
FF - prefs.js..extensions.enabledAddons: {271A3CF5-5A54-447B-A08F-BE805F0DA60A}:3.3.23.0
FF - prefs.js..network.proxy.http: "proxyus2.stealthy.co"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Programme\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.09.15 06:39:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.05.17 11:37:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2012.12.17 20:33:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins

[2012.08.12 22:21:29 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Mozilla\Extensions
[2013.02.04 19:44:14 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Mozilla\Firefox\Profiles\yedkzo8x.default\extensions
[2013.02.04 19:44:14 | 000,000,000 | ---D | M] (DDBAC Plug-In) -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Mozilla\Firefox\Profiles\yedkzo8x.default\extensions\{271A3CF5-5A54-447B-A08F-BE805F0DA60A}
[2013.01.11 07:30:32 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Mozilla\Firefox\Profiles\yedkzo8x.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.01.30 09:07:58 | 000,000,000 | ---D | M] (Wörterbuch Deutsch (de-DE), Hunspell-unterstützt) -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Mozilla\Firefox\Profiles\yedkzo8x.default\extensions\de_DE@dicts.j3e.de
[2012.10.12 20:37:32 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Mozilla\Firefox\Profiles\yedkzo8x.default\extensions\ich@maltegoetz.de
[2012.10.26 06:29:45 | 000,183,174 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Mozilla\Firefox\Profiles\yedkzo8x.default\extensions\stealthyextension@gmail.com.xpi
[2012.05.17 11:37:22 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.09.15 06:39:16 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.04.24 16:08:07 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.05.17 11:37:14 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.15 06:39:14 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.05.17 11:37:14 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.05.17 11:37:14 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.05.17 11:37:14 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.05.17 11:37:14 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2006.02.28 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.313\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLANMini.exe (AVM Berlin)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [nTrayFw] C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [USSShReg] C:\Programme\Ulead Systems\Ulead PhotoImpact 4.2\SSaver\USSSHREG.EXE ()
O4 - HKCU..\Run: [eType Setup403515.exe] "C:\DOKUME~1\Test2\LOKALE~1\Temp\eType Setup403515.exe" /XML="C:\DOKUME~1\Test2\LOKALE~1\Temp\1E.tmp" /STP=0:1 File not found
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil32_11_4_402_278_Plugin.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Album Fast Start.lnk = C:\Programme\Ulead Systems\Ulead PhotoImpact 4.2\ABMTSR.EXE (Ulead Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\EPSON Status Monitor 3 Environment Check(3).lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE (SEIKO EPSON CORPORATION)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\3.0.313\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Test2\Startmenü\Programme\Autostart\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\nvappfilter.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - mswsock.dll File not found
O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} https://www.olb.de/olb_fb3_1867b/plugin/AXFOAM.CAB (B+S Banksysteme AG DDBAC Plug-In)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{14354AB3-71EA-4FB1-8DA6-54282306736D}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{578986FC-7AAC-4EA5-A02F-94B2C19AE01C}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.11.22 22:26:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013.02.08 19:50:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Uniblue
[2013.02.08 19:50:15 | 000,000,000 | ---D | C] -- C:\Programme\Uniblue
[2013.02.08 19:50:15 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Uniblue
[2013.02.08 18:57:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\vlc
[2013.02.07 16:11:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\WINDOWS
[2013.02.07 14:22:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Nvu
[2013.02.07 12:30:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Sun
[2013.02.07 07:41:21 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia
[2013.02.07 07:40:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe
[2013.02.06 09:49:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Macromedia
[2013.02.06 09:48:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2013.01.31 07:56:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\McAfee Security Scan Plus
[2013.01.29 17:36:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\Lokale Einstellungen\Anwendungsdaten\.elfohilfe
[2013.01.29 14:10:18 | 000,000,000 | ---D | C] -- C:\temp
[2013.01.19 07:52:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\Lokale Einstellungen\Anwendungsdaten\Google
[2013.01.19 07:52:47 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Google
[2013.01.14 19:46:17 | 000,000,000 | ---D | C] -- C:\Programme\PLX Technology
[2013.01.14 19:46:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DRVSTORE
[2013.01.14 19:45:58 | 000,000,000 | ---D | C] -- C:\Programme\Iomega
[2013.01.14 19:45:58 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Iomega
[2013.01.14 19:45:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Test2\Lokale Einstellungen\Anwendungsdaten\Downloaded Installations
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.02.09 08:42:40 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Test2\defogger_reenable
[2013.02.09 08:11:00 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.09 08:10:13 | 000,000,992 | ---- | M] () -- C:\Dokumente und Einstellungen\Test2\Desktop\Verknüpfung mit gmer_2.0.18454.lnk
[2013.02.09 08:10:03 | 000,000,931 | ---- | M] () -- C:\Dokumente und Einstellungen\Test2\Desktop\Verknüpfung mit OTL.lnk
[2013.02.09 08:08:19 | 000,000,962 | ---- | M] () -- C:\Dokumente und Einstellungen\Test2\Desktop\Verknüpfung mit Defogger.lnk
[2013.02.09 08:02:00 | 000,000,222 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2013.02.09 07:39:24 | 000,000,238 | ---- | M] () -- C:\WINDOWS\tasks\SpeedUpMyPC.job
[2013.02.09 07:38:43 | 000,004,458 | ---- | M] () -- C:\WINDOWS\ULEAD32.INI
[2013.02.09 07:38:42 | 000,033,801 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2013.02.09 07:38:41 | 000,001,080 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.09 07:38:37 | 000,000,248 | ---- | M] () -- C:\WINDOWS\tasks\spmonitor.job
[2013.02.09 07:13:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.02.08 23:23:48 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013.02.07 07:32:33 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.02.04 10:29:20 | 000,002,358 | ---- | M] () -- C:\28020050.rdh
[2013.01.31 07:56:36 | 000,001,751 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\McAfee Security Scan Plus.lnk
[2013.01.31 07:56:36 | 000,001,745 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.02.09 08:42:40 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\defogger_reenable
[2013.02.09 08:10:13 | 000,000,992 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\Desktop\Verknüpfung mit gmer_2.0.18454.lnk
[2013.02.09 08:10:03 | 000,000,931 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\Desktop\Verknüpfung mit OTL.lnk
[2013.02.09 08:08:19 | 000,000,962 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\Desktop\Verknüpfung mit Defogger.lnk
[2013.02.08 19:50:24 | 000,000,248 | ---- | C] () -- C:\WINDOWS\tasks\spmonitor.job
[2013.02.08 19:50:22 | 000,000,238 | ---- | C] () -- C:\WINDOWS\tasks\SpeedUpMyPC.job
[2013.01.14 19:45:59 | 000,024,880 | ---- | C] () -- C:\WINDOWS\System32\drivers\OXUDIDRV_x32.sys
[2012.12.01 17:42:09 | 000,006,656 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.29 17:33:30 | 000,073,728 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\0.18307953366374974.exe
[2012.09.29 17:33:30 | 000,000,170 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\rhkxjptiycoxlpw
[2012.09.16 23:10:18 | 000,012,804 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\Tabs Boom boom.odt
[2012.09.03 09:57:01 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Test2\Stenaline
[2012.08.29 09:21:00 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012.08.17 06:32:08 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.07.02 10:02:33 | 000,004,140 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mtbjfghn.xbe
[2012.02.17 15:43:11 | 000,000,022 | ---- | C] () -- C:\WINDOWS\System32\systeminfo3.dll
[2012.02.17 15:37:33 | 000,000,085 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2012.02.15 21:49:20 | 000,000,020 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PKP_DLec.DAT
[2012.01.11 20:24:00 | 000,000,132 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2012.01.07 07:44:55 | 000,112,688 | ---- | C] () -- C:\WINDOWS\System32\shw32.dll
[2012.01.07 07:44:55 | 000,039,095 | ---- | C] () -- C:\WINDOWS\iccsigs.dat
[2012.01.03 15:36:10 | 000,004,458 | ---- | C] () -- C:\WINDOWS\ULEAD32.INI
[2012.01.01 11:09:25 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\EEBAPI.dll
[2012.01.01 11:09:25 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\EEBDSCVR.dll
[2012.01.01 11:09:25 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\EBAPI.dll
[2012.01.01 11:08:56 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT.DAT
[2011.12.31 21:38:43 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI

========== ZeroAccess Check ==========

[2012.01.01 21:07:20 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[2013.02.09 07:13:21 | 000,005,120 | -HS- | M] () -- C:\WINDOWS\assembly\GAC\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
"ThreadingModel" = Both
"" = C:\RECYCLER\S-1-5-21-1214440339-1770027372-725345543-1005\$49f76bafa92d47ed6009822d4aff5802\n. -- File not found

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 06:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\RECYCLER\S-1-5-18\$49f76bafa92d47ed6009822d4aff5802\n. -- File not found
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 06:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2012.02.17 14:38:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ashampoo
[2012.02.17 15:30:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2012.04.24 17:47:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular
[2012.02.15 21:49:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EnterNHelp
[2012.03.17 19:40:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IsolatedStorage
[2012.06.24 09:59:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LogSys
[2012.02.15 21:19:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nikon
[2012.05.19 13:02:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files
[2012.02.15 21:49:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ultima_T15
[2012.01.31 23:46:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WinZip
[2012.08.27 16:16:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Blueberry
[2012.08.13 09:39:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\DataDesign
[2012.08.13 23:04:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\elsterformular
[2012.11.05 08:44:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Foxit Software
[2012.08.27 16:16:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\LogSys
[2012.11.03 21:27:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Nikon
[2013.02.07 14:22:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Nvu
[2012.08.15 08:07:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\OpenOffice.org
[2012.10.04 23:01:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Steganos
[2012.08.12 22:21:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Thunderbird
[2013.02.08 19:50:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\Uniblue
[2013.01.05 16:41:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Test2\Anwendungsdaten\XnView

========== Purity Check ==========



< End of report >


____________________________________-

OTL Extras logfile created on: 09.02.2013 08:44:00 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Test2\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,50 Gb Total Physical Memory | 0,98 Gb Available Physical Memory | 65,30% Memory free
2,85 Gb Paging File | 2,49 Gb Available in Paging File | 87,26% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 39,06 Gb Total Space | 10,00 Gb Free Space | 25,61% Space Free | Partition Type: NTFS

Computer Name: HEIMPC | User Name: Test2 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Betrachten mit XnView] -- "C:\Programme\XnView\xnview.exe" "%1" (XnView, hxxp://www.xnview.com)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{{B221BE73-4FC9-4B6A-AF4C-1AC94233710C}}" = Steganos Online-Banking portable 2011
"{04FCD5DE-1662-4F99-BDA9-C57212113EF2}" = RemoteComms External Disk Access
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F6423DE-7959-4178-80E0-023C7EAA5347}" = NVIDIA ForceWare Network Access Manager
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{33286280-8617-11E1-8FF6-B8AC6F97B88E}" = Google Earth Plug-in
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{76EA55BD-535F-4AB4-AD80-A8CA331F4E6F}" = Windows Messenger 5.1
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}" = WinZip 15.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{DF02A1B9-B4FB-4873-98A4-0793AF76557F}" = PDF Form Filler 2
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = SpeedUpMyPC
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F161B4FF-3976-4917-BD27-CA28C95A13AE}" = DDBAC
"{F803D042-5A46-42E8-86CA-C8A0A5C63518}" = Iomega Encryption
"{F9336255-6BBB-4B38-9F98-E85988BF99CA}" = DDBAC
"{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
"76322c23820ae7473cdebbff3eceb262" = Cars
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ANNO 1602 Königs-Edition" = ANNO 1602 Königs-Edition
"Ashampoo Burning Studio 6 FREE_is1" = Ashampoo Burning Studio 6 FREE v.6.80
"CCleaner" = CCleaner
"Corel Applications" = Corel Applications
"DesktopIconAmazon" = Desktop Icon für Amazon
"ElsterFormular 13.2.0.8623k" = ElsterFormular
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"Foxit Reader_is1" = Foxit Reader 5.1
"ie8" = Windows Internet Explorer 8
"InstallShield_{1F6423DE-7959-4178-80E0-023C7EAA5347}" = NVIDIA ForceWare Network Access Manager
"IrfanView" = IrfanView (remove only)
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
"Mozilla Thunderbird 17.0 (x86 de)" = Mozilla Thunderbird 17.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Nikon FotoShare" = Nikon FotoShare
"NVIDIA Drivers" = NVIDIA Drivers
"Nvu_is1" = Nvu 1.0
"ShotOnline" = ShotOnline
"Ulead PhotoImpact 4.2" = Ulead PhotoImpact 4.2
"VLC media player" = VLC media player 2.0.0
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WS_FTPPro" = Ipswitch WS_FTP Pro Uninstall
"XnView_is1" = XnView 1.99.5
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 07.06.2012 04:41:20 | Computer Name = HEIMPC | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul flash10b.ocx, Version 10.0.22.87, Fehleradresse 0x000a97c8.

Error - 07.06.2012 04:41:30 | Computer Name = HEIMPC | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul flash10b.ocx, Version 10.0.22.87, Fehleradresse 0x000a97c8.

Error - 07.06.2012 04:41:41 | Computer Name = HEIMPC | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung iexplore.exe, Version 8.0.6001.18702, fehlgeschlagenes
Modul flash10b.ocx, Version 10.0.22.87, Fehleradresse 0x000a97c8.

Error - 24.06.2012 04:59:34 | Computer Name = HEIMPC | Source = MsiInstaller | ID = 11931
Description = Product: PDF Form Filler 2 -- Error 1931. The Windows Installer service
cannot update the system file C:\WINDOWS\system32\msiexec.exe because the file
is protected by Windows. You may need to update your operating system for this
program to work correctly. Package version: 3.1.4001.5512, OS Protected version:
3.1.4000.1823

Error - 24.06.2012 04:59:57 | Computer Name = HEIMPC | Source = LogSys.Client | ID = 3
Description =

Error - 24.06.2012 18:33:55 | Computer Name = HEIMPC | Source = MsiInstaller | ID = 11316
Description = Produkt: MSXML 4.0 SP2 (KB954430) -- Fehler 1316. Beim Versuch, die
Datei c:\710bfd96a3b0cdfd7f81\msxml4.msi zu lesen, ist ein Netzwerkfehler aufgetreten.

Error - 21.08.2012 11:07:22 | Computer Name = HEIMPC | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 21.08.2012 11:07:24 | Computer Name = HEIMPC | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 03.09.2012 04:48:50 | Computer Name = HEIMPC | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 14.0.1.4577, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

Error - 12.09.2012 12:12:04 | Computer Name = HEIMPC | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung iexplore.exe, Version 8.0.6001.18702, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.

[ System Events ]
Error - 07.02.2013 02:34:14 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 07.02.2013 02:34:14 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060

Error - 07.02.2013 13:42:27 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7034
Description = Dienst "Forceware Web Interface" wurde unerwartet beendet. Dies ist
bereits 1 Mal passiert.

Error - 08.02.2013 02:21:14 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 08.02.2013 02:21:14 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060

Error - 08.02.2013 02:43:25 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7034
Description = Dienst "Forceware Web Interface" wurde unerwartet beendet. Dies ist
bereits 1 Mal passiert.

Error - 08.02.2013 02:58:44 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 08.02.2013 02:58:44 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060

Error - 09.02.2013 02:14:41 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "StarOpen" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error - 09.02.2013 02:14:41 | Computer Name = HEIMPC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1060


< End of report >


________________

GMER 2.0.18454 - hxxp://www.gmer.net
Rootkit scan 2013-02-09 08:55:41
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e SAMSUNG_HD502HJ rev.1AJ10001 128,00GB
Running: gmer_2.0.18454.exe; Driver: C:\DOKUME~1\Test2\LOKALE~1\Temp\pwtdipob.sys


---- Kernel code sections - GMER 2.0 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB97DA360, 0x200AED, 0xE8000020]
init C:\WINDOWS\system32\drivers\Senfilt.sys entry point in "init" section [0xB6E3AA80]

---- User code sections - GMER 2.0 ----

.text C:\WINDOWS\System32\svchost.exe[2076] USER32.dll!DialogBoxIndirectParamAorW 7E3749D0 5 Bytes JMP 008E000A
.text C:\WINDOWS\System32\svchost.exe[2076] USER32.dll!GetCursorPos 7E37974E 5 Bytes JMP 008D000A
.text C:\WINDOWS\System32\svchost.exe[2076] ole32.dll!CoCreateInstance 774CF1BC 5 Bytes JMP 008C000A
---- Processes - GMER 2.0 ----

Library c:\windows\system32\y (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1060] 0x45670000
Library c:\windows\system32\y (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [2228] 0x45670000

---- Registry - GMER 2.0 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\nvnetbus\SNPU@FwlSocketHandleAdd 3260
Reg HKLM\SYSTEM\CurrentControlSet\Services\nvnetbus\SNPU@FwlSocketProcessIDAdd 1060
Reg HKLM\SYSTEM\CurrentControlSet\Services\nvnetbus\SNPU@FwlSocketRemoteIPAdd 79.49.0.137
Reg HKLM\SYSTEM\CurrentControlSet\Services\nvnetbus\SNPU@FwlSocketRemotePortAdd 16471
Reg HKLM\SYSTEM\CurrentControlSet\Services\nvnetbus\SNPU@FwlSocketLocalPortAdd 1030
Reg HKLM\SYSTEM\CurrentControlSet\Services\nvnetbus\SNPU@FwlSocketProtocolAdd 1

---- EOF - GMER 2.0 ----


Ja, ich denke das war es. Wäre schön, wenn mir jemand helfen könnte.

Grüße und schönes Wochenende

Tom