Hallo liebes Forum,
ich habe das Problem das mein MSN links verschickt, gut das Thema gibt es hier schon unentlich mal, aber mein Problem ist das ich denke das immer wenn dieser Link kommt:
h**p://ufopyrenees.org/images/?=e-mail@hotmail.de
Öffnet sich bei mir ganz kurz das Fenster des "Opfers"
und schliesst sich direkt wieder...

OTL Extras logfile created on: 29.01.2010 20:41:35 - Run 1
OTL by OldTimer - Version 3.1.27.0     Folder = C:\Users\flo\Desktop
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1.024,00 Mb Total Physical Memory | 217,00 Mb Available Physical Memory | 21,00% Memory free
2,00 Gb Paging File | 0,00 Gb Available in Paging File | 15,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 140,64 Gb Free Space | 60,39% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive K: | 465,76 Gb Total Space | 437,01 Gb Free Space | 93,83% Space Free | Partition Type: NTFS
 
Computer Name: FLO-PC
Current User Name: flo
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 17
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C084BC61-E537-11DE-8616-005056806466}" = Google Earth
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX
"{D765F1CE-5AE5-4C47-B134-AE58AC474740}" = OpenOffice.org 3.1
"{DEDB47A3-C988-4A43-A645-E2CEA571E680}" = Epson Easy Photo Print 2
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{ECCA3728-2753-4C3A-8608-5A41C4AEBDB7}" = Sony Vegas Pro 8.0
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Audiosurf_is1" = Audiosurf Beta
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CD-Labelscan_is1" = CD-Labelscan 2.02
"Cossacks 2 - Battle for Europe" = Cossacks 2 - Battle for Europe
"dlanconf" = devolo dLAN-Konfigurationsassistent
"dslmon" = devolo Informer
"EPSON Scanner" = EPSON Scan
"EPSON Stylus SX100_TX100 Benutzerhandbuch" = EPSON Stylus SX100_TX100 Handbuch
"EPSON SX100 Series" = EPSON SX100 Series Printer Uninstall
"Free Download Manager_is1" = Free Download Manager 3.0
"Free YouTube Download_is1" = Free YouTube Download 2.3
"Freez FLV to MP3 Converter v1.5_is1" = Freez FLV to MP3 Converter
"Game Jackal v4_is1" = Game Jackal v4.0.1.7 (32 bit)
"GameSpy Arcade" = GameSpy Arcade
"Gluman" = Gluman (remove only)
"Google Chrome" = Google Chrome
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Hidden and Dangerous Deluxe" = Hidden and Dangerous Deluxe
"InfraRecorder" = InfraRecorder
"ManyCam" = ManyCam 2.4 (remove only)
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Orb" = Winamp Remote
"Picasa 3" = Picasa 3
"QuickTime" = QuickTime
"Steam App 12910" = Audiosurf Demo
"Switch" = Switch Sound File Converter
"TmNationsForever_is1" = TmNationsForever
"ToXiC" = ToXiC
"Uninstall_is1" = Uninstall 1.0.0.1
"VirtualCloneDrive" = VirtualCloneDrive
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"WinLiveSuite_Wave3" = Windows Live Essentials
"Zulu" = Zulu DJ Software
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Anwendungserkennung
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 14.01.2010 15:41:43 | Computer Name = flo-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.5.7.2810, 
Zeitstempel: 0x4b2f0bcd  Name des fehlerhaften Moduls: ml_bookmarks.dll, Version: 
0.0.0.0, Zeitstempel: 0x4b2f0bd8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000128b
ID
 des fehlerhaften Prozesses: 0xed4  Startzeit der fehlerhaften Anwendung: 0x01ca95519482f534
Pfad
 der fehlerhaften Anwendung: C:\Program Files\Winamp\winamp.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\Winamp\Plugins\ml_bookmarks.dll  Berichtskennung: d7697ab9-0144-11df-b7f0-001485483b4b
 
Error - 14.01.2010 16:02:44 | Computer Name = flo-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.5.7.2810, 
Zeitstempel: 0x4b2f0bcd  Name des fehlerhaften Moduls: ml_bookmarks.dll, Version: 
0.0.0.0, Zeitstempel: 0x4b2f0bd8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000128b
ID
 des fehlerhaften Prozesses: 0x55c  Startzeit der fehlerhaften Anwendung: 0x01ca95547e937652
Pfad
 der fehlerhaften Anwendung: C:\Program Files\Winamp\winamp.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\Winamp\Plugins\ml_bookmarks.dll  Berichtskennung: c6fa4ae1-0147-11df-b7f0-001485483b4b
 
Error - 15.01.2010 09:50:12 | Computer Name = flo-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: engine.exe, Version: 2.0.0.0, Zeitstempel:
 0x447876cb  Name des fehlerhaften Moduls: Upload.dll_unloaded, Version: 0.0.0.0, 
Zeitstempel: 0x41fa0b45  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00378ed1  ID des fehlerhaften
 Prozesses: 0x3fc  Startzeit der fehlerhaften Anwendung: 0x01ca95e9a661eac0  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Cossacks 2 - Battle for Europe\Run\Data\engine.exe
Pfad
 des fehlerhaften Moduls: Upload.dll  Berichtskennung: e6502e6a-01dc-11df-8d9b-001485483b4b
 
Error - 17.01.2010 08:02:19 | Computer Name = flo-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: engine.exe, Version: 2.0.0.0, Zeitstempel:
 0x447876cb  Name des fehlerhaften Moduls: Upload.dll_unloaded, Version: 0.0.0.0, 
Zeitstempel: 0x41fa0b45  Ausnahmecode: 0xc0000005  Fehleroffset: 0x086b8ed1  ID des fehlerhaften
 Prozesses: 0x450  Startzeit der fehlerhaften Anwendung: 0x01ca976ce8344ede  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Cossacks 2 - Battle for Europe\Run\Data\engine.exe
Pfad
 des fehlerhaften Moduls: Upload.dll  Berichtskennung: 28d1a939-0360-11df-a5d3-001485483b4b
 
Error - 19.01.2010 07:34:40 | Computer Name = flo-PC | Source = EventSystem | ID = 4621
Description = 
 
Error - 20.01.2010 10:40:00 | Computer Name = flo-PC | Source = EventSystem | ID = 4622
Description = 
 
Error - 20.01.2010 10:40:01 | Computer Name = flo-PC | Source = EventSystem | ID = 4622
Description = 
 
Error - 21.01.2010 14:18:28 | Computer Name = flo-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.5.7.2810, 
Zeitstempel: 0x4b2f0bcd  Name des fehlerhaften Moduls: ml_bookmarks.dll, Version: 
0.0.0.0, Zeitstempel: 0x4b2f0bd8  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000128b
ID
 des fehlerhaften Prozesses: 0x488  Startzeit der fehlerhaften Anwendung: 0x01ca9ac5f9912b53
Pfad
 der fehlerhaften Anwendung: C:\Program Files\Winamp\winamp.exe  Pfad des fehlerhaften
 Moduls: C:\Program Files\Winamp\Plugins\ml_bookmarks.dll  Berichtskennung: 5ec0c5d4-06b9-11df-803d-001485483b4b
 
Error - 23.01.2010 13:46:37 | Computer Name = flo-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Client.exe, Version: 2.1.5.2028, 
Zeitstempel: 0x4b556b48  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bdadb  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00060cec  ID des fehlerhaften
 Prozesses: 0x268  Startzeit der fehlerhaften Anwendung: 0x01ca9c2c29e3a6d5  Pfad der
 fehlerhaften Anwendung: C:\Users\flo\Desktop\Spiele\Runes of Magic\Client.exe  Pfad
 des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: 40f41a26-0847-11df-8072-001485483b4b
 
Error - 29.01.2010 15:41:11 | Computer Name = flo-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.1.27.0 kann nicht mehr unter Windows ausgeführt
 werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: 1114    Startzeit:
 01caa11ac24ed575    Endzeit: 13    Anwendungspfad: C:\Downloads\Software\OTL.exe    Berichts-ID:
 334cb0dd-0d0e-11df-a4f7-001485483b4b  
 
[ System Events ]
Error - 24.01.2010 08:23:37 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 24.01.2010 10:10:49 | Computer Name = flo-PC | Source = WMPNetworkSvc | ID = 866333
Description = 
 
Error - 24.01.2010 17:01:34 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 25.01.2010 16:45:41 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 26.01.2010 09:21:04 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 26.01.2010 09:52:14 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 26.01.2010 10:05:22 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 26.01.2010 17:10:38 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 27.01.2010 09:51:04 | Computer Name = flo-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 27.01.2010 17:12:38 | Computer Name = flo-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
 
< End of report >
         

Hallo und

Bitte diese Liste beachten und abarbeiten. Beim Scan mit MalwareBytes auch alle externen Speicher (ext. Platten, USB-Sticks, ... mit anklemmen!! )

Wichtig für Benutzer mit Windows Vista und Windows 7: Bitte alle Tools per Rechtsklick => Als Admin ausführen!

Die Logfiles kannst Du zB alle in eine Datei zippen und auf File-Upload.net hochladen und hier verlinken, denn 1. sind manche Logfiles fürs Board nämlich zu groß und 2. kann ich mit einem Klick mir gleich alle auf einmal runterladen.