Hallo,

vor kurzem habe ich einen alten Laptop "geerbt". Da er teilweise etwas langsam lief und manche Programme nicht ausgefuehrt werden konnten habe ich mal escan laufen lassen. Escan war auch sehr erfolgreich und hat gleich mehrere Eintraege gefunden.

Waer nett wenn mir jemand weiterhelfen koennte, damit ich den Rechner bereinigen kann. Ein kleines Problem am Rande; ich habe nicht mehr die Original XP Software.

Vielen Dank im Voraus


Logfile of HijackThis v1.99.1
Scan saved at 11:57:44, on 02.03.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\COMMON~1\MICROS~1\Msinfo\OFFPROV.EXE
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Laura\Tools\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.1.1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Ohio University
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Alle Bilder von gleichem Server filtern - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: In neuem Avant Browser öffnen - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Open In New Avant Browser - C:\Program Files\Avant Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Zur Werbebanner-Filterliste hinzufügen - C:\Program Files\Avant Browser\AddToADBlackList.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - D:\Player\__CDS2.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe






und hier escan log:

Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows XP [Version 5.1.2600]
Thu Mar 01 13:32:31 2007 => *** File C:\Documents and Settings\Laura\UserData\My Documents\My Music\Mozart - Mozart - Pachabel Cannon In D Minor Perfect Version.mp3 having Size Restriction ***. Filesize 5880 kb
Sun Feb 25 13:22:29 2007 => Virus Database Date: 1/26/2007
Sun Feb 25 14:32:48 2007 => Virus Database Date: 1/26/2007
Thu Mar 01 12:41:26 2007 => Virus Database Date: 1/26/2007
Thu Mar 01 14:12:20 2007 => Virus Database Date: 1/26/2007
Thu Mar 01 14:17:03 2007 => Virus Database Date: 1/26/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sun Feb 25 13:24:13 2007 => System found infected with internet spy Commercial KeyLogger (keylog.txt)! Action taken: No Action Taken.
Sun Feb 25 13:24:18 2007 => System found infected with cws.smartsearch Browser Hijacker (C:\WINDOWS\system32\uninstall.exe)! Action taken: No Action Taken.
Thu Mar 01 12:44:42 2007 => System found infected with internet spy Commercial KeyLogger (keylog.txt)! Action taken: No Action Taken.
Thu Mar 01 12:45:28 2007 => System found infected with cws.smartsearch Browser Hijacker (C:\WINDOWS\system32\uninstall.exe)! Action taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Sun Feb 25 13:47:49 2007 => File C:\pz.exe infected by "Trojan.WinREG.LowZones.a" Virus! Action Taken: No Action Taken.
Thu Mar 01 13:05:02 2007 => File C:\pz.exe infected by "Trojan.WinREG.LowZones.a" Virus! Action Taken: No Action Taken.
Thu Mar 01 13:42:30 2007 => File C:\pz.exe infected by "Trojan.WinREG.LowZones.a" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Sun Feb 25 13:49:18 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\4CF85FCD-486F-40EB-9A24-D00628 tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Sun Feb 25 13:49:18 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\85F0E07B-1494-4958-AC0D-E8D19F tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Sun Feb 25 13:49:18 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\90F70EFE-621C-4F5C-AF85-DCF6BB tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Sun Feb 25 13:49:18 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\41111C5D-8F02-432D-AF5A-4A8876 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Sun Feb 25 13:49:18 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\4A2E7C09-3DA7-491E-8EC7-EC67A7 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Sun Feb 25 13:49:18 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\B5AF1E3C-EEA2-4A57-A0C3-16112C tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Sun Feb 25 13:49:18 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\EAB30F76-37CB-40A8-B11E-646BD9 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Sun Feb 25 13:49:53 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc41\myBar\1.bin\NPMYWAY.DLL tagged as "not-a-virus:AdWare.Win32.MyWay.f". Action Taken: No Action Taken.
Thu Mar 01 13:06:25 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\4CF85FCD-486F-40EB-9A24-D00628 tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Thu Mar 01 13:06:25 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\85F0E07B-1494-4958-AC0D-E8D19F tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Thu Mar 01 13:06:25 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\90F70EFE-621C-4F5C-AF85-DCF6BB tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Thu Mar 01 13:06:25 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\41111C5D-8F02-432D-AF5A-4A8876 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:06:25 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\4A2E7C09-3DA7-491E-8EC7-EC67A7 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:06:25 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\B5AF1E3C-EEA2-4A57-A0C3-16112C tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:06:25 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\EAB30F76-37CB-40A8-B11E-646BD9 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:06:58 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc41\myBar\1.bin\NPMYWAY.DLL tagged as "not-a-virus:AdWare.Win32.MyWay.f". Action Taken: No Action Taken.
Thu Mar 01 13:43:41 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\4CF85FCD-486F-40EB-9A24-D00628 tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Thu Mar 01 13:43:41 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\85F0E07B-1494-4958-AC0D-E8D19F tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Thu Mar 01 13:43:41 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\90F70EFE-621C-4F5C-AF85-DCF6BB tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Thu Mar 01 13:43:41 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\41111C5D-8F02-432D-AF5A-4A8876 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:43:41 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\4A2E7C09-3DA7-491E-8EC7-EC67A7 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:43:41 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\B5AF1E3C-EEA2-4A57-A0C3-16112C tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:43:41 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\EAB30F76-37CB-40A8-B11E-646BD9 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Thu Mar 01 13:44:30 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc41\myBar\1.bin\NPMYWAY.DLL tagged as "not-a-virus:AdWare.Win32.MyWay.f". Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Sun Feb 25 13:24:13 2007 => Offending file found: C:\WINDOWS\system32\keylog.txt
Sun Feb 25 13:24:18 2007 => Offending file found: C:\WINDOWS\system32\uninstall.exe
Thu Mar 01 12:44:42 2007 => Offending file found: C:\WINDOWS\system32\keylog.txt
Thu Mar 01 12:45:28 2007 => Offending file found: C:\WINDOWS\system32\uninstall.exe
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Sun Feb 25 13:23:59 2007 => Offending Key found: HKLM\Software\magnet !!!
Sun Feb 25 13:24:10 2007 => Offending Key found: HKLM\Software\myway !!!
Thu Mar 01 12:43:15 2007 => Offending Key found: HKLM\Software\magnet !!!
Thu Mar 01 12:44:36 2007 => Offending Key found: HKLM\Software\myway !!!

Hallo,

also wenn man einen Rechner erbt wie du sagst,sollte man ihn aufgrund deines Logfiles von escan am besten komplett neu aufsetzen.
Aber nicht nur deswegen,alleine schon weil du nicht weisst was vorher alles für Müll drauf war .
Daher meiner Meinung auf Nummer sicher gehen und neu aufsetzen.

Das habe ich auch erst gedacht als ich das escanlog gesehen habe. Nun hatte ich tags ueber aber nicht viel zu tun und habe mich mit den einzelnen Eintraegen etwas auseinandergesetzt. Ich habe die registry gereinigt (regseeker) sowie cookies, temp. Internetdateien usw geloescht. Dann erneut gescant und siehe da, die Funde waren halbiert. Von nun 13 Funden sind meiner Meinung nach 9 verwaiste registryeintraege --> aol und acrobat; aol hatte ich deinstalliert und acrobat neu raufgezogen. Habe alle Eintraege in der reg gefunden. Kann ich die manuell loeschen?

Des Weiteren findet er in der HKLM 2 Eintraege:
- Magnet! --> gehoert wohl zu limewire, was ich auch deinstalliert habe
- MyWay! --> irgendeine searchbar, die aber scheinbar sehr haeufig vorkommt und nich ganz so schaedlich ist.

Die Frage ist wieder ob ich die manuell aus der reg loeschen kann.

Etwas sorgen macht mir dieser Fund: pz.exe infected by "Trojan.WinREG.LowZones.a"

Die Datei befindet sich auf C:\ Es handelt sich um ein selbstentpackendes archiv.

Kann man da was machen ohne neu aufzusetzen? Die XP Software habe ich leider nicht mitgeerbt... Ausserdem sind da noch ne Menge Daten drauf die nicht verloren gehen duerfen.

Frueher oder spaeter werde ich sowieso XP Prof raufspielen, aber bis dahin waer es toll wenn ich dieses OS noch retten koennte. Was sagst du?

hier ist nochmal das neue escanlog:

Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows XP [Version 5.1.2600]
Fri Mar 02 14:24:56 2007 => *** File C:\Documents and Settings\Laura\UserData\My Documents\My Music\Mozart - Mozart - Pachabel Cannon In D Minor Perfect Version.mp3 having Size Restriction ***. Filesize 5880 kb
Fri Mar 02 14:01:10 2007 => Virus Database Date: 1/26/2007
Fri Mar 02 14:15:24 2007 => Virus Database Date: 3/2/2007
Fri Mar 02 15:03:27 2007 => Virus Database Date: 3/2/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Mar 02 14:18:08 2007 => System found infected with internet spy Commercial KeyLogger (keylog.txt)! Action taken: No Action Taken.
Fri Mar 02 14:18:40 2007 => System found infected with cws.smartsearch Browser Hijacker (C:\WINDOWS\system32\uninstall.exe)! Action taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Fri Mar 02 14:38:42 2007 => File C:\pz.exe infected by "Trojan.WinREG.LowZones.a" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Fri Mar 02 14:40:21 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\4CF85FCD-486F-40EB-9A24-D00628 tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Fri Mar 02 14:40:21 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\85F0E07B-1494-4958-AC0D-E8D19F tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Fri Mar 02 14:40:21 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F06AAF7C-EED3-4035-9F32-40EAB9\90F70EFE-621C-4F5C-AF85-DCF6BB tagged as "not-a-virus:AdWare.Win32.NavExcel.i". Action Taken: No Action Taken.
Fri Mar 02 14:40:21 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\41111C5D-8F02-432D-AF5A-4A8876 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Fri Mar 02 14:40:21 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\4A2E7C09-3DA7-491E-8EC7-EC67A7 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Fri Mar 02 14:40:21 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\B5AF1E3C-EEA2-4A57-A0C3-16112C tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Fri Mar 02 14:40:21 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc31\Quarantine\F6CAC6C6-3451-4A15-A95D-88A5A4\EAB30F76-37CB-40A8-B11E-646BD9 tagged as "not-a-virus:AdWare.Win32.NavExcel.h". Action Taken: No Action Taken.
Fri Mar 02 14:40:57 2007 => File C:\RECYCLER\S-1-5-21-1780737662-1695083492-1532339732-1007\Dc41\myBar\1.bin\NPMYWAY.DLL tagged as "not-a-virus:AdWare.Win32.MyWay.f". Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Fri Mar 02 14:18:08 2007 => Offending file found: C:\WINDOWS\system32\keylog.txt
Fri Mar 02 14:18:40 2007 => Offending file found: C:\WINDOWS\system32\uninstall.exe
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Fri Mar 02 14:17:50 2007 => Offending Key found: HKLM\Software\magnet !!!
Fri Mar 02 14:18:01 2007 => Offending Key found: HKLM\Software\myway !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:



btw: Danke erstmal fuer die Hilfe!!!