Hi !
Mir ist es vorher nicht sehr aufgefallen ich hatte ab und zu mal trojaner auf dem pc und dachte die sind weg nachm löschen bis ab heute dauernd ne virusmeldung kommt und ich hab erneut meinen pc gescanned und fand 52 viren ! Ich möchte dringend hilfe haben da ich nicht weiß inwiefern schädlich diese trojaner sind
avira findet 50+ viren aufm pc
malwarebytes3
ccleaner hab ich auch schon durchlaufen lassen
hier mein HijackThis ich kenn mich nicht so aus und würde mich über hilfe sehr freuen

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:25:49, on 29.01.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\LogMeIn Hamachi\hamachi-2.exe
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\programme\steam\steam.exe
C:\Programme\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\PC Connectivity Solution\ServiceLayer.exe
C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Avira\AntiVir Desktop\avcenter.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = h**p://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h**p://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = No.1 AutoGame in VN - WwW.GiangHo.Tv
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Programme\AskSearch\bin\DefaultSearch.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Cool Memo First Boob] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bleh kind cool memo\up mail.exe
O4 - HKLM\..\Run: [DriveTheLife] "C:\Programme\DriveTheLife\DriveTheLife.exe" /start
O4 - HKLM\..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [obj readme] C:\DOKUME~1\ADMINI~1\ANWEND~1\AXISLO~1\Soft Cash.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Programme\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - http://game.zylom.com/activex/zylomgamesplayer.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programme\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6408 bytes

Hallo und

bitte zuerst diese Anleitung abarbeiten
Klick
poste anschließend alle Logs hierher, dann sehen wir weiter.

MFG

CCleaner:Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Programme\\Ahead\\CoverDesigner\\NeroCoverDesigner_fra.chm"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Programme\\Ahead\\CoverDesigner\\covered-jpn.nls"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Programme\\Ahead\\Nero BackItUp\\NeroBackItUp_Fra.chm"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Programme\\Ahead\\Nero StartSmart\\NeroStartSmart_fra.chm"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Programme\\Ahead\\Nero StartSmart\\NeroStartSmart_jpn.chm"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\Programme\\Ahead\\Nero BackItUp\\BackItUp-Jpn.nls"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\system32\\pxwma.dll"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\System.Windows.Forms.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\System.Windows.Forms.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\mscorlib.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\mscoree.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\System.Drawing.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\System.EnterpriseServices.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\Microsoft.JScript.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\Microsoft.Vsa.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\System.Drawing.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\mscoree.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\System.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\System.EnterpriseServices.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\Microsoft.JScript.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\Microsoft.Vsa.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.1.4322\\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\mscorlib.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\System.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\Microsoft.NET\\Framework\\v1.0.3705\\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb"=dword:00001000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls]
"C:\\WINDOWS\\system32\\FM20ENU.DLL"=dword:00000001

[HKEY_CLASSES_ROOT\.pando]
@="Pando.Document"

[HKEY_CLASSES_ROOT\OISemffile]
@=""

[HKEY_CLASSES_ROOT\OIStiffile]
@=""

[HKEY_CLASSES_ROOT\OISwmffile]
@=""

[HKEY_CLASSES_ROOT\SysmonLogManager.Snapin]

[HKEY_CLASSES_ROOT\WMPCD]

[HKEY_CLASSES_ROOT\{80b8c23c-16e0-4cd8-bbc3-cecec9a78b79}]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abm]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abm\OpenWithList]
"a"="msnmsgr.exe"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.acv]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.acv\OpenWithList]
"a"="msnmsgr.exe"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arp]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arp\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CHT]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CHT\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mdl]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mdl\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nds]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nds\OpenWithList]
"a"="Nintendo DS.EXE"
"MRUList"="a"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.part]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.part\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sfv]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sfv\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.y3d]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.y3d\OpenWithList]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ydc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ydc\OpenWithList]
"a"="firefox.exe"
"MRUList"="a"

[HKEY_CLASSES_ROOT\Azureus\DefaultIcon]
@="C:\\Programme\\Azureus\\Azureus.exe,1"

[HKEY_CLASSES_ROOT\Azureus\shell\open]

[HKEY_CLASSES_ROOT\Azureus\shell\open\command]
@="\"C:\\Programme\\Azureus\\Azureus.exe\" \"%1\""

[HKEY_CLASSES_ROOT\callto\DefaultIcon]
@="\"C:\\Programme\\Skype\\Phone\\Skype.exe\",0"

[HKEY_CLASSES_ROOT\callto\shell\open]

[HKEY_CLASSES_ROOT\callto\shell\open\command]
@="\"C:\\Programme\\Skype\\Phone\\Skype.exe\" \"/callto:\"%l\"\""

[HKEY_CLASSES_ROOT\Connection Manager Profile\DefaultIcon]
@="C:\\WINDOWS\\system32\\CMMGR32.EXE,1"

[HKEY_CLASSES_ROOT\Connection Manager Profile\shell\open]

[HKEY_CLASSES_ROOT\Connection Manager Profile\shell\open\command]
@="C:\\WINDOWS\\system32\\CMMGR32.EXE \"%1\""

[HKEY_CLASSES_ROOT\Connection Manager Profile\shell\Settings...]

[HKEY_CLASSES_ROOT\Connection Manager Profile\shell\Settings...\command]
@="C:\\WINDOWS\\system32\\CMMGR32.EXE /settings \"%1\""

[HKEY_CLASSES_ROOT\dcsfile\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,11"

[HKEY_CLASSES_ROOT\ecsfile\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,10"

[HKEY_CLASSES_ROOT\fcsfile\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,12"

[HKEY_CLASSES_ROOT\ncsfile\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,14"

[HKEY_CLASSES_ROOT\ppifile\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,73,00,\
70,00,70,00,63,00,6e,00,66,00,67,00,2e,00,65,00,78,00,65,00,2c,00,31,00,00,00

[HKEY_CLASSES_ROOT\ppifile\shell\open]

[HKEY_CLASSES_ROOT\ppifile\shell\open\command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,73,00,\
70,00,70,00,63,00,6e,00,66,00,67,00,2e,00,65,00,78,00,65,00,20,00,2f,00,43,\
00,6f,00,6e,00,66,00,69,00,67,00,20,00,25,00,31,00,00,00

[HKEY_CLASSES_ROOT\tcsfile\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,13"

[HKEY_CLASSES_ROOT\urn:content-classes:catalog\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,15"

[HKEY_CLASSES_ROOT\urn:content-classes:catalog-settings\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12471"

[HKEY_CLASSES_ROOT\urn:content-classes:contentclassdef\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-13101"

[HKEY_CLASSES_ROOT\urn:content-classes:exchange55startaddress\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12451"

[HKEY_CLASSES_ROOT\urn:content-classes:exchangestartaddress\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12451"

[HKEY_CLASSES_ROOT\urn:content-classes:filestartaddress\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12453"

[HKEY_CLASSES_ROOT\urn:content-classes:management\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,20"

[HKEY_CLASSES_ROOT\urn:content-classes:notesstartaddress\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12456"

[HKEY_CLASSES_ROOT\urn:content-classes:remoteworkspacestartaddress\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12454"

[HKEY_CLASSES_ROOT\urn:content-classes:webstartaddress\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12450"

[HKEY_CLASSES_ROOT\urn:content-classes:wizard/addcontentclass\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-13100"

[HKEY_CLASSES_ROOT\urn:content-classes:wizard/addsearchcontentlocation\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12461"

[HKEY_CLASSES_ROOT\urn:content-classes:workspace-settings\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12472"

[HKEY_CLASSES_ROOT\urn:content-classes:workspaceconfiguration\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12476"

[HKEY_CLASSES_ROOT\urn:content-classes:workspacestartaddress\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,-12454"

[HKEY_CLASSES_ROOT\wcsfile\DefaultIcon]
@="C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Web Folders\\pkmres.dll,9"

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}]
@="ContentHost Control"

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\Control]
@=""

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32]
@="C:\\Programme\\Skype\\Plugin Manager\\ezPMUtils.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\MiscStatus\1]
@="205201"

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\ProgID]
@="ezPMUtils.ContentHost"

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\TypeLib]
@="{506B4C1F-587D-4CD3-94A3-00354CF6EFEF}"

[HKEY_CLASSES_ROOT\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}]
@="ActiveXPlugin Object"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\Control]

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\Implemented Categories]

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\InprocServer32]
@="C:\\WINDOWS\\system32\\plugin.ocx"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\MiscStatus\1]
@="131473"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\ProgID]
@="Microsoft.ActiveXPlugin.1"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\ToolboxBitmap32]
@="C:\\WINDOWS\\system32\\plugin.ocx, 1"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\TypeLib]
@="{06DD38D0-D187-11CF-A80D-00C04FD74AD8}"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\CLSID\{06DD38D3-D187-11CF-A80D-00C04FD74AD8}\VersionIndependentProgID]
@="Microsoft.ActiveXPlugin"

[HKEY_CLASSES_ROOT\CLSID\{1B02BDDF-F6D2-4B36-ABBA-AD49EBC876A5}]

[HKEY_CLASSES_ROOT\CLSID\{1B02BDDF-F6D2-4B36-ABBA-AD49EBC876A5}\InprocServer32]
@="C:\\PROGRA~1\\MSNMES~1\\MSGSC8~1.DLL"

[HKEY_CLASSES_ROOT\CLSID\{1FF84C3B-1140-4eb6-BE38-4BE618D2E7D6}]
@="ThirdPartyEapDispatcherAuthenticatorConfig"
"AppID"="{1FF84C3B-1140-4EB6-BE38-4BE618D2E7D6}"

[HKEY_CLASSES_ROOT\CLSID\{1FF84C3B-1140-4eb6-BE38-4BE618D2E7D6}\InprocServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,00,61,00,\
70,00,61,00,33,00,68,00,73,00,74,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}]
@="WindowGroup Class"

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\Control]
@=""

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32]
@="C:\\Programme\\Skype\\Plugin Manager\\ezPMUtils.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\MiscStatus\1]
@="205201"

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\ProgID]
@="ezPMUtils.WindowGroup"

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\TypeLib]
@="{506B4C1F-587D-4CD3-94A3-00354CF6EFEF}"

[HKEY_CLASSES_ROOT\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\CLSID\{5A8371A3-0C6D-487b-B3C8-46D785C4C940}]
@="PSFactoryBuffer"

[HKEY_CLASSES_ROOT\CLSID\{5A8371A3-0C6D-487b-B3C8-46D785C4C940}\InProcServer32]
@="C:\\WINDOWS\\system32\\eapahost.dll"
"ThreadingModel"="Both"

[HKEY_CLASSES_ROOT\CLSID\{9DAA7B9D-CE5B-42CE-B942-32BBC284AC44}]
@="PSFactoryBuffer"

[HKEY_CLASSES_ROOT\CLSID\{9DAA7B9D-CE5B-42CE-B942-32BBC284AC44}\InProcServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,00,61,00,\
70,00,61,00,33,00,68,00,73,00,74,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Both"

[HKEY_CLASSES_ROOT\CLSID\{B0E28D63-52F6-4e30-992B-78ECF97268E9}]
@="ThirdPartyEapDispatcherAuthenticatorRuntime"
"AppID"="{B0E28D63-52F6-4E30-992B-78ECF97268E9}"

[HKEY_CLASSES_ROOT\CLSID\{B0E28D63-52F6-4e30-992B-78ECF97268E9}\InprocServer32]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,65,00,61,00,\
70,00,61,00,33,00,68,00,73,00,74,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Free"

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}]
@="PluginWindow Helper"

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\Control]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32]
@="C:\\Programme\\Skype\\Plugin Manager\\ezPMUtils.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\MiscStatus\1]
@="205201"

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\ProgID]
@="spmServices.PluginWindow"

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\TypeLib]
@="{B0A632A5-B0D1-41E8-A84A-A502B3341363}"

[HKEY_CLASSES_ROOT\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}]
@="GameController Class"

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\Control]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32]
@="C:\\Programme\\Skype\\Plugin Manager\\ezPMUtils.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\MiscStatus\1]
@="205201"

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\ProgID]
@="ezPMUtils.GameController"

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\TypeLib]
@="{506B4C1F-587D-4CD3-94A3-00354CF6EFEF}"

[HKEY_CLASSES_ROOT\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}]
@="DRMClient Helper version 2"

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\Control]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32]
@="C:\\Programme\\Skype\\Plugin Manager\\ezPMUtils.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\MiscStatus\1]
@="205201"

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\ProgID]
@="spmServices.DRMClientV2"

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\TypeLib]
@="{B0A632A5-B0D1-41E8-A84A-A502B3341363}"

[HKEY_CLASSES_ROOT\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}]
@="NamedStrings Helper"

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\Control]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32]
@="C:\\Programme\\Skype\\Plugin Manager\\ezPMUtils.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\MiscStatus]
@="0"

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\MiscStatus\1]
@="205201"

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\ProgID]
@="spmServices.NamedStrings"

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\TypeLib]
@="{B0A632A5-B0D1-41E8-A84A-A502B3341363}"

[HKEY_CLASSES_ROOT\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\Version]
@="1.0"

[HKEY_CLASSES_ROOT\Applications\left4dead.exe\shell\open]

[HKEY_CLASSES_ROOT\Applications\left4dead.exe\shell\open\command]
@="\"c:\\programme\\steam\\steamapps\\common\\left 4 dead\\left4dead.exe\" \"%1\""

[HKEY_CLASSES_ROOT\Applications\moviemk.exe]

[HKEY_CLASSES_ROOT\Applications\moviemk.exe\shell]
"FriendlyCache"="Movie Maker"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe]
@="C:\\WINDOWS\\system32\\cmmgr32.exe"
"Path"="C:\\WINDOWS\\system32"
"CmstpExtensionDll"="C:\\WINDOWS\\system32\\cmcfg32.dll"
"CMInternalVersion"="1.2"
"CmNative"=dword:00000001
"ProfilesUpgraded"=dword:00000002

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\HClassicUsbDrv]
"Path"="C:\\Programme\\Hercules\\Video\\Hercules Webcam"
@="C:\\Programme\\Hercules\\Video\\Hercules Webcam\\HClassicUsbDrv"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\mplayer2.exe]
@="\"C:\\Programme\\Windows Media Player\\mplayer2.exe\""
"Path"="\"C:\\Programme\\Windows Media Player\""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\None]
"Path"="C:\\Programme\\802.11 Wireless LAN\\802.11g USB 2.0 WLAN Dongle"
@="C:\\Programme\\802.11 Wireless LAN\\802.11g USB 2.0 WLAN Dongle\\PRODUCT_KEY"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Help]
"nwindcs9.cnt"="C:\\Programme\\Microsoft Office\\OFFICE11\\SAMPLES\\"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Help]
"nwind9.hlp"="C:\\Programme\\Microsoft Office\\OFFICE11\\SAMPLES\\"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Help]
"nwind9.cnt"="C:\\Programme\\Microsoft Office\\OFFICE11\\SAMPLES\\"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Help]
"nwindcs9.hlp"="C:\\Programme\\Microsoft Office\\OFFICE11\\SAMPLES\\"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Help]
"scanpst.hlp"="C:\\Programme\\Gemeinsame Dateien\\SYSTEM\\MSMAPI\\1031\\"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\Programme\\MSN Messenger\\"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\\WINDOWS\\winsxs\\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\\"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"E:\\SlickAu\\abm\\"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"E:\\SlickAu\\"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"E:\\SlickAu\\AUTO UPDATER 1.0\\"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"E:\\SlickAu\\neoncube\\"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders]
"E:\\SlickAu\\SCREENSHOT\\"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Azureus]
"UninstallString"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\
00,6d,00,6d,00,65,00,5c,00,41,00,7a,00,75,00,72,00,65,00,75,00,73,00,5c,00,\
55,00,6e,00,69,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,2e,00,65,00,78,00,65,\
00,00,00
"InstallLocation"=hex(2):43,00,3a,00,5c,00,50,00,72,00,6f,00,67,00,72,00,61,\
00,6d,00,6d,00,65,00,5c,00,41,00,7a,00,75,00,72,00,65,00,75,00,73,00,00,00
"DisplayName"="Azureus"
"DisplayIcon"="C:\\Programme\\Azureus\\Azureus.exe,0"
"DisplayVersion"="2.5.0.4"
"NoModify"=dword:00000001
"NoRepair"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Applied Networking]

[HKEY_LOCAL_MACHINE\Software\RtlWake]

[HKEY_LOCAL_MACHINE\Software\RtWLanP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cool Memo First Boob"="C:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\Bleh kind cool memo\\up mail.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"obj readme"="C:\\DOKUME~1\\ADMINI~1\\ANWEND~1\\AXISLO~1\\Soft Cash.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\AntiVir PersonalEdition Classic]
"Order"=hex:08,00,00,00,02,00,00,00,e4,01,00,00,01,00,00,00,03,00,00,00,84,\
00,00,00,00,00,00,00,76,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,64,00,\
32,00,0c,07,00,00,85,39,54,86,20,00,41,4e,54,49,56,49,7e,31,2e,4c,4e,4b,00,\
00,3a,00,03,00,04,00,ef,be,85,39,54,86,85,39,54,86,14,00,00,00,41,00,6e,00,\
74,00,69,00,56,00,69,00,72,00,20,00,48,00,69,00,6c,00,66,00,65,00,2e,00,6c,\
00,6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,\
00,00,00,00,00,00,ae,00,00,00,01,00,00,00,a0,00,00,00,41,75,67,4d,02,00,00,\
00,01,00,00,00,8e,00,32,00,8a,03,00,00,85,39,54,86,20,00,41,56,49,52,41,41,\
7e,32,2e,4c,4e,4b,00,00,64,00,03,00,04,00,ef,be,85,39,54,86,85,39,54,86,14,\
00,00,00,41,00,76,00,69,00,72,00,61,00,20,00,41,00,6e,00,74,00,69,00,56,00,\
69,00,72,00,20,00,50,00,65,00,72,00,73,00,6f,00,6e,00,61,00,6c,00,20,00,69,\
00,6d,00,20,00,49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,74,00,2e,00,6c,00,\
6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,\
00,00,00,00,00,a6,00,00,00,02,00,00,00,98,00,00,00,41,75,67,4d,02,00,00,00,\
01,00,00,00,86,00,32,00,23,07,00,00,85,39,54,86,20,00,41,56,49,52,41,41,7e,\
31,2e,4c,4e,4b,00,00,5c,00,03,00,04,00,ef,be,85,39,54,86,85,39,54,86,14,00,\
00,00,41,00,76,00,69,00,72,00,61,00,20,00,41,00,6e,00,74,00,69,00,56,00,69,\
00,72,00,20,00,50,00,65,00,72,00,73,00,6f,00,6e,00,61,00,6c,00,20,00,73,00,\
74,00,61,00,72,00,74,00,65,00,6e,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,\
00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Ask Search Assistant]
"Order"=hex:08,00,00,00,02,00,00,00,88,00,00,00,01,00,00,00,01,00,00,00,7c,\
00,00,00,00,00,00,00,6e,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,5c,00,\
32,00,9b,05,00,00,b6,3a,58,7d,20,00,55,4e,49,4e,53,54,7e,31,2e,4c,4e,4b,00,\
00,32,00,03,00,04,00,ef,be,b6,3a,58,7d,18,3b,56,65,14,00,00,00,55,00,6e,00,\
69,00,6e,00,73,00,74,00,61,00,6c,00,6c,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,\
00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Hamachi]
"Order"=hex:08,00,00,00,02,00,00,00,fe,00,00,00,01,00,00,00,02,00,00,00,76,\
00,00,00,00,00,00,00,68,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,56,00,\
32,00,7e,02,00,00,a1,3a,4e,7f,20,00,48,61,6d,61,63,68,69,2e,6c,6e,6b,00,2e,\
00,03,00,04,00,ef,be,a1,3a,4e,7f,5d,3b,45,94,14,00,00,00,48,00,61,00,6d,00,\
61,00,63,00,68,00,69,00,2e,00,6c,00,6e,00,6b,00,00,00,1a,00,0e,00,00,00,0a,\
00,ef,be,00,00,00,00,1a,00,00,00,00,00,00,00,00,00,7c,00,00,00,01,00,00,00,\
6e,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,5c,00,32,00,90,02,00,00,a1,\
3a,4e,7f,20,00,55,4e,49,4e,53,54,7e,31,2e,4c,4e,4b,00,00,32,00,03,00,04,00,\
ef,be,a1,3a,4e,7f,5d,3b,45,94,14,00,00,00,55,00,6e,00,69,00,6e,00,73,00,74,\
00,61,00,6c,00,6c,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,\
ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Nexon\Audition]
"Order"=hex:08,00,00,00,02,00,00,00,86,00,00,00,01,00,00,00,01,00,00,00,7a,\
00,00,00,00,00,00,00,6c,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,5a,00,\
32,00,0d,05,00,00,97,39,ed,84,20,00,41,75,64,69,74,69,6f,6e,2e,6c,6e,6b,00,\
00,30,00,03,00,04,00,ef,be,97,39,ed,84,25,3a,87,9a,14,00,00,00,41,00,75,00,\
64,00,69,00,74,00,69,00,6f,00,6e,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,\
00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Skype]
"Order"=hex:08,00,00,00,02,00,00,00,7c,00,00,00,01,00,00,00,01,00,00,00,70,\
00,00,00,00,00,00,00,62,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,50,00,\
32,00,48,07,00,00,2c,3a,48,75,20,00,53,6b,79,70,65,2e,6c,6e,6b,00,2a,00,03,\
00,04,00,ef,be,2c,3a,48,75,ca,3a,77,53,14,00,00,00,53,00,6b,00,79,00,70,00,\
65,00,2e,00,6c,00,6e,00,6b,00,00,00,18,00,0e,00,00,00,0a,00,ef,be,00,00,00,\
00,18,00,00,00,00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Teamspeak2 RC2]
"Order"=hex:08,00,00,00,02,00,00,00,90,00,00,00,01,00,00,00,01,00,00,00,84,\
00,00,00,00,00,00,00,76,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,64,00,\
32,00,91,02,00,00,9d,39,5a,94,20,00,54,45,41,4d,53,50,7e,31,2e,4c,4e,4b,00,\
00,3a,00,03,00,04,00,ef,be,9d,39,5a,94,46,3b,e0,45,14,00,00,00,54,00,65,00,\
61,00,6d,00,73,00,70,00,65,00,61,00,6b,00,20,00,52,00,43,00,32,00,2e,00,6c,\
00,6e,00,6b,00,00,00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,\
00,00,00,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader_Engine.exe"="NEXON_EU_Downloader_Engine"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\Bleh kind cool memo\\up mail.exe"="up mail"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Dokumente und Einstellungen\\Administrator\\Desktop\\CAE_Downloader.exe"="CAE_Downloader"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Nexon\\NEXON_EU_Downloader\\NEXON_EU_Downloader.exe"="NEXON_EU_Downloader"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\WINDOWS\\SoftwareDistribution\\Download\\353532c428eb23a15c972081863622b7\\update\\update.exe"="Windows Service Pack Setup"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Dokumente und Einstellungen\\Administrator\\Desktop\\CombatArmsSetup.exe"="CombatArmsSetup"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"E:\\Combat Arms\\CombatArms.exe"="Combat Arms Launcher"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"E:\\Combat Arms\\Engine.exe"="Combat Arms"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"E:\\Combat Arms\\EndingBanner.exe"="Combat Arms Launcher"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"E:\\Combat Arms\\CAV.exe"="CAV"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Dokumente und Einstellungen\\Administrator\\Desktop\\SteamAchievementManager52\\SAM.Picker.exe"="Steam Achievement Manager Picker"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Dokumente und Einstellungen\\Administrator\\Desktop\\SteamAchievementManager52\\SAM.Game.exe"="Steam Achievement Manager"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Dokumente und Einstellungen\\Administrator\\Lokale Einstellungen\\Anwendungsdaten\\Mozilla\\Firefox\\Mozilla Firefox\\updates\\0\\updater.exe"="Firefox Software Updater"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\DOKUME~1\\ADMINI~1\\LOKALE~1\\Temp\\Update_becc.exe"="Messenger Plus! Live Setup"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\DOKUME~1\\ADMINI~1\\LOKALE~1\\Temp\\is-9TG07.tmp\\mbam-setup.tmp"="Setup/Uninstall"
das ist was der ccleaner ''gefunden'' hat

Malwarebytes:Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3667
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

29.01.2010 14:02:06
mbam-log-2010-01-29 (14-01-55).txt

Scan-Methode: Vollständiger Scan (C:\|E:\|)
Durchsuchte Objekte: 192179
Laufzeit: 1 hour(s), 5 minute(s), 33 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Programme\DriveTheLife\iodrv.sys (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\cmdow.exe (Malware.Tool) -> No action taken.


das kommt bei RSIT:Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrator at 2010-02-01 11:43:01
Microsoft Windows XP Professional Service Pack 3
System drive C: has 1 GB (4%) free of 35 GB
Total RAM: 3070 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:43:04, on 01.02.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\PC Connectivity Solution\ServiceLayer.exe
C:\Programme\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programme\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\RSIT.exe
C:\Programme\Trend Micro\HijackThis\Administrator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w*w.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = h**p://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h**p://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = No.1 AutoGame in VN - W*W.GiangHo.Tv
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Programme\AskSearch\bin\DefaultSearch.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [DriveTheLife] "C:\Programme\DriveTheLife\DriveTheLife.exe" /start
O4 - HKLM\..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\steam\steam.exe" -silent
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Wireless Configuration Utility HW.14.lnk = C:\Programme\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - http://game.zylom.com/activex/zylomgamesplayer.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programme\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6229 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\A2AB65C991851BED.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Programme\ICQ6Toolbar\ICQToolBar.dll [2009-10-27 1014520]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-10-16 16855552]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2007-10-11 1826816]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"DriveTheLife"=C:\Programme\DriveTheLife\DriveTheLife.exe [2009-07-01 2729528]
"nwiz"=C:\Programme\NVIDIA Corporation\nView\nwiz.exe [2009-08-12 1657376]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-08-17 13877248]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-08-17 86016]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Steam"=c:\programme\steam\steam.exe [2009-10-25 1217808]
"PC Suite Tray"=C:\Programme\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-11-11 1451520]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Wireless Configuration Utility HW.14.lnk - C:\Programme\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265096]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\alaplaya\S4League\S4Client.exe"="C:\Programme\alaplaya\S4League\S4Client.exe:*:Enabled:Project S4 Client.exe"
"C:\Programme\Pando Networks\Media Booster\PMB.exe"="C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster"
"C:\Programme\Valve\Steam\SteamApps\azfald\condition zero deleted scenes\hl.exe"="C:\Programme\Valve\Steam\SteamApps\azfald\condition zero deleted scenes\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Programme\Valve\Steam\SteamApps\azfald\counter-strike\hl.exe"="C:\Programme\Valve\Steam\SteamApps\azfald\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\Programme\Valve\Steam\SteamApps\omerta90\counter-strike source\hl2.exe"="C:\Programme\Valve\Steam\SteamApps\omerta90\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Programme\Valve\Steam\Steam.exe"="C:\Programme\Valve\Steam\Steam.exe:*:Enabled:Steam"
"C:\Programme\Valve\Steam\SteamApps\patesascha\counter-strike source\hl2.exe"="C:\Programme\Valve\Steam\SteamApps\patesascha\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Programme\Valve\Steam\SteamApps\pzyco90\team fortress 2\hl2.exe"="C:\Programme\Valve\Steam\SteamApps\pzyco90\team fortress 2\hl2.exe:*:Enabled:hl2"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Programme\TeamViewer\Version4\TeamViewer.exe"="C:\Programme\TeamViewer\Version4\TeamViewer.exe:*:Enabled:TeamViewer Remote Control Application"
"C:\Dokumente und Einstellungen\Administrator\Desktop\metin2\metin2.bin"="C:\Dokumente und Einstellungen\Administrator\Desktop\metin2\metin2.bin:*:Enabled:metin2"
"C:\Programme\Valve\hl.exe"="C:\Programme\Valve\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Programme\Steam\Steam.exe"="C:\Programme\Steam\Steam.exe:*:Enabled:Steam"
"C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\ICQ\457342415\ReceivedFiles\350159966 _Ka~$aaK_\Kaiba Corp VDS\KCVDS.exe"="C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\ICQ\457342415\ReceivedFiles\350159966 _Ka~$aaK_\Kaiba Corp VDS\KCVDS.exe:*:Enabled:KCVDS"
"C:\Programme\DriveTheLife\DriveTheLife.exe"="C:\Programme\DriveTheLife\DriveTheLife.exe:*:EnabledriveTheLife"
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe"="C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe:*:Enabled:NEXON_EU_Download er_Engine"
"C:\Programme\Steam\SteamApps\pzyco90\counter-strike source\hl2.exe"="C:\Programme\Steam\SteamApps\pzyco90\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonUS\NGM\NGM.exe"="C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager"
"E:\Combat Arms\CombatArms.exe"="E:\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"E:\Combat Arms\Engine.exe"="E:\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Steam\SteamApps\pzyco90\team fortress 2\hl2.exe"="C:\Programme\Steam\SteamApps\pzyco90\team fortress 2\hl2.exe:*:Enabled:hl2"
"C:\Programme\Steam\SteamApps\1a_binenkillah\counter-strike source\hl2.exe"="C:\Programme\Steam\SteamApps\1a_binenkillah\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"E:\Combat Arms\CombatArms.exe"="E:\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe"
"E:\Combat Arms\Engine.exe"="E:\Combat Arms\Engine.exe:*Enabled:Engine.exe"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Windows Live\Messenger\wlcsdk.exe"="C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{58397002-c4bb-11de-be82-0018e74a06fd}]
shell\AutoRun\command - F:\Launcher.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{890b7fc2-dd1b-11de-beb0-0018e74a06fd}]
shell\AutoRun\command - F:\LaunchU3.exe -a


======List of files/folders created in the last 1 months======

2010-01-29 14:03:16 ----D---- C:\rsit
2010-01-29 12:58:41 ----SHD---- C:\Config.Msi
2010-01-29 12:57:41 ----AD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2010-01-29 12:40:01 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2010-01-29 12:39:52 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-01-29 12:39:51 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-01-29 12:39:00 ----D---- C:\Programme\CCleaner
2010-01-29 12:24:28 ----D---- C:\Programme\Trend Micro
2010-01-27 22:30:58 ----HDC---- C:\WINDOWS\$NtUninstallKB961503$
2010-01-27 16:34:00 ----A---- C:\WINDOWS\system32\muweb.dll
2010-01-27 16:34:00 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2010-01-27 16:34:00 ----A---- C:\WINDOWS\system32\mucltui.dll
2010-01-26 18:06:40 ----D---- C:\Programme\Microsoft
2010-01-26 18:06:24 ----D---- C:\Programme\Windows Live SkyDrive
2010-01-26 17:55:14 ----D---- C:\Programme\Gemeinsame Dateien\Windows Live
2010-01-13 22:46:38 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$
2010-01-13 22:46:31 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$

======List of files/folders modified in the last 1 months======

2010-02-01 11:34:47 ----D---- C:\Programme\Mozilla Firefox
2010-02-01 11:34:13 ----D---- C:\Programme\Steam
2010-02-01 11:34:13 ----A---- C:\WINDOWS\RTacDbg.txt
2010-02-01 11:34:05 ----D---- C:\WINDOWS
2010-02-01 11:32:56 ----D---- C:\WINDOWS\system32
2010-02-01 11:32:56 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-01 11:29:10 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-01 11:29:09 ----D---- C:\WINDOWS\Temp
2010-02-01 11:28:39 ----RD---- C:\Programme
2010-02-01 11:28:38 ----D---- C:\Programme\Gemeinsame Dateien
2010-01-31 23:05:09 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-01-29 13:30:53 ----D---- C:\WINDOWS\system32\drivers
2010-01-29 13:30:53 ----D---- C:\WINDOWS\Prefetch
2010-01-29 12:59:12 ----SHD---- C:\WINDOWS\Installer
2010-01-29 12:59:09 ----D---- C:\WINDOWS\WinSxS
2010-01-29 12:58:49 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2010-01-29 12:41:48 ----D---- C:\WINDOWS\Minidump
2010-01-29 12:41:48 ----D---- C:\WINDOWS\Debug
2010-01-29 12:09:00 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\AXISLOCKS
2010-01-27 22:31:08 ----RSD---- C:\WINDOWS\assembly
2010-01-27 22:31:03 ----HD---- C:\WINDOWS\inf
2010-01-27 22:31:00 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-01-27 22:30:39 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2010-01-27 22:29:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bleh kind cool memo
2010-01-27 16:41:01 ----HD---- C:\WINDOWS\$hf_mig$
2010-01-26 18:14:54 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Messenger Plus!
2010-01-26 18:13:56 ----D---- C:\Programme\Messenger Plus! Live
2010-01-26 18:06:35 ----D---- C:\Programme\Windows Live
2010-01-26 18:06:07 ----RSD---- C:\WINDOWS\Fonts
2010-01-22 23:08:35 ----D---- C:\Programme\Internet Explorer
2010-01-22 23:08:29 ----D---- C:\WINDOWS\ie8updates
2010-01-14 14:38:47 ----D---- C:\WINDOWS\AppPatch
2010-01-05 01:17:46 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-07-01 43520]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 BIOS;BIOS; \??\C:\WINDOWS\system32\drivers\BIOS.sys []
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 WmiAcpi;Microsoft Windows-Verwaltungsschnittstelle für ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-12-22 21035]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-08 56816]
R3 Afc;PPdus ASPI Shell; C:\WINDOWS\system32\drivers\Afc.sys [2005-02-23 11776]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-10-16 4615168]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-08-16 7729568]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-07-30 54400]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-07-30 22016]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter; C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-05-04 215040]
R3 SjyPkt;SjyPkt; \??\C:\WINDOWS\System32\Drivers\SjyPkt.sys []
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2009-10-06 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-10-06 22016]
S3 ovt530;Webcam Classic; C:\WINDOWS\System32\Drivers\ov530vid.sys [2005-03-15 161792]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 PortTalk;PortTalk; \??\C:\WINDOWS\system32\Drivers\PortTalk.sys []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-10-06 7936]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-10-06 7936]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2006-10-18 38528]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S3 XDva221;XDva221; \??\C:\WINDOWS\system32\XDva221.sys []
S3 XDva262;XDva262; \??\C:\WINDOWS\system32\XDva262.sys []
S3 XDva297;XDva297; \??\C:\WINDOWS\system32\XDva297.sys []
S3 XDva306;XDva306; \??\C:\WINDOWS\system32\XDva306.sys []
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Programme\LogMeIn Hamachi\hamachi-2.exe [2009-10-29 1074568]
R2 ICQ Service;ICQ Service; C:\Programme\ICQ6Toolbar\ICQ Service.exe [2009-10-27 246520]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-08-17 168004]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 ServiceLayer;ServiceLayer; C:\Programme\PC Connectivity Solution\ServiceLayer.exe [2009-10-27 657408]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

ich hoffe das es endlich alles war wenn noch was fehlt schreibts bitte

Hallo

mach bitte alle versteckten Dateien und Ordner sichtbar, dann lass diese Dateien

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bleh kind cool memo\up mail.exe
C:\DOKUME~1\ADMINI~1\ANWEND~1\AXISLO~1\Soft Cash.exe

hier Virustotal, hier virscan.org
oder hier Jotti überprüfen (kann einige Minuten dauern),
poste die gesamten Ergebnisse mit der Angabe der Größe der hochgeladenen Datei sowie die MD5 und SHA1 Angaben oder verlinke auf die Auswertung,
bitte auch wenn nichts gefunden wurde.

ich hoffe das es endlich alles war wenn noch was fehlt schreibts bitte

Es fehlt die Info.txt
Deinstalliere bitte den Messenger Plus! und die ASK-Toolbar, starte das System neu und berichte bitte.

MFG

messenger plus! ist deinstalliert ask toolbar schon seit langem ka warum das noch angezeigt wird..
ich lade die erste datei nochmal hoch war gradn problem
den ordner von der 2ten datei sehe ich gar nicht obwohl ich alles so gemacht habe wie es mir gesagt wurde alle anderen ordner die versteckt waren seh ich den komischen aber nicht



sooo hier ist das ergebnis

Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.50 2010.02.01 -
AntiVir 7.9.1.154 2010.02.01 -
Antiy-AVL 2.0.3.7 2010.02.01 -
Authentium 5.2.0.5 2010.01.31 -
Avast 4.8.1351.0 2010.02.01 -
AVG 9.0.0.730 2010.02.01 -
BitDefender 7.2 2010.02.01 -
CAT-QuickHeal 10.00 2010.02.01 -
ClamAV 0.96.0.0-git 2010.02.01 -
Comodo 3783 2010.02.01 -
DrWeb 5.0.1.12222 2010.02.01 -
eSafe 7.0.17.0 2010.01.31 -
eTrust-Vet 35.2.7274 2010.02.01 -
F-Prot 4.5.1.85 2010.01.31 -
F-Secure 9.0.15370.0 2010.02.01 -
Fortinet 4.0.14.0 2010.02.01 -
GData 19 2010.02.01 -
Ikarus T3.1.1.80.0 2010.02.01 -
Jiangmin 13.0.900 2010.01.28 -
K7AntiVirus 7.10.960 2010.01.29 -
Kaspersky 7.0.0.125 2010.02.01 -
McAfee 5879 2010.02.01 -
McAfee+Artemis 5879 2010.02.01 -
McAfee-GW-Edition 6.8.5 2010.02.01 -
Microsoft 1.5406 2010.02.01 -
NOD32 4824 2010.02.01 -
Norman 6.04.03 2010.01.31 -
nProtect 2009.1.8.0 2010.02.01 -
Panda 10.0.2.2 2010.02.01 -
PCTools 7.0.3.5 2010.02.01 -
Rising 22.33.00.04 2010.02.01 -
Sophos 4.50.0 2010.02.01 -
Sunbelt 3.2.1858.2 2010.01.31 -
Symantec 20091.2.0.41 2010.02.01 -
TheHacker 6.5.1.0.175 2010.02.01 -
TrendMicro 9.120.0.1004 2010.02.01 -
VBA32 3.12.12.1 2010.02.01 -
ViRobot 2010.2.1.2166 2010.02.01 -
VirusBuster 5.0.21.0 2010.02.01 -
weitere Informationen
File size: 6082396 bytes
MD5...: 222a61ee7451f512bec7f1dae18d5654
SHA1..: fae1971a7b4b0a340222b3d0f48dcd6744a531a7
SHA256: c716f7106ea114465eb26ab8b398663537de89f30f6788e2104beb73e6ad1612
ssdeep: 98304:gL1uOOPNsisXQARL1H2scuh/tMz3dpYfuVhpIGrA4pEPZLo8zY41rd2Gk1
45B:ccOS+lXQu1H2UVU7HDpb8LoeYCQF145B
PEiD..: -
PEInfo: -
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Unknown!
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned



info.txt



Computer Name: HOME-PC
Event Code: 1800
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 5
Source Name: SecurityCenter
Time Written: 20090911213246.000000+120
Event Type: Informationen
User:

Computer Name: HOME-PC
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst WmiApRpl (WmiApRpl) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090911204717.000000+120
Event Type: Informationen
User:

Computer Name: HOME-PC
Event Code: 1001
Message: Die Leistungsindikatoren für den Dienst WmiApRpl (WmiApRpl) wurden entfernt. Die Daten
enthalten die neuen Werte der Registrierungseinträge Last Counter
und Last Help.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090911204716.000000+120
Event Type: Informationen
User:

Computer Name: HOME-PC
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!

Record Number: 2
Source Name: Avira AntiVir
Time Written: 20090911204247.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: HOME-PC
Event Code: 1800
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 1
Source Name: SecurityCenter
Time Written: 20090911204245.000000+120
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Programme\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 127 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=7f01
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------


ich hoffe das war endlich alles

Hallo

hat sich enwas geändert nachdem du den Messenger Plus! deinstalliert hast?
Wenn nein, dann führe dieses Tool aus

Lade dir Lop S&D herunter.

Führe Lop S&D.exe per Doppelklick aus. Win7 und VISTA-User: Rechtsklick => Ausführen als Admin!!
Wähle die Sprache deiner Wahl und anschließend die Option 1.
Warte bis der Scanbericht erstellt wird und poste ihn hier her (Du findest ihn unter C:\lopR.txt, sollte der Bericht nicht erscheinen).

MFG

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : Administrator ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
C:\ (Local Disk) - NTFS - Total:34 Go (Free:0 Go)
D:\ (CD or DVD)
E:\ (Local Disk) - NTFS - Total:114 Go (Free:112 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 01.02.2010|19:53 )

--------------------\\ Ordner Verzeichnis unter ANWEND~1

[22.12.2008|18:43] C:\DOKUME~1\ADMINI~1\ANWEND~1\Adobe
[21.04.2009|18:41] C:\DOKUME~1\ADMINI~1\ANWEND~1\ArcSoft
[29.01.2010|12:09] C:\DOKUME~1\ADMINI~1\ANWEND~1\AXISLOCKS
[24.11.2009|22:21] C:\DOKUME~1\ADMINI~1\ANWEND~1\Hamachi
[26.06.2009|15:33] C:\DOKUME~1\ADMINI~1\ANWEND~1\ICQ
[29.11.2008|17:49] C:\DOKUME~1\ADMINI~1\ANWEND~1\Identities
[29.11.2008|17:51] C:\DOKUME~1\ADMINI~1\ANWEND~1\InstallShield
[22.12.2008|18:43] C:\DOKUME~1\ADMINI~1\ANWEND~1\Macromedia
[29.01.2010|12:40] C:\DOKUME~1\ADMINI~1\ANWEND~1\Malwarebytes
[01.12.2009|17:39] C:\DOKUME~1\ADMINI~1\ANWEND~1\McLoad
[25.10.2009|15:34] C:\DOKUME~1\ADMINI~1\ANWEND~1\Microsoft
[22.12.2008|18:41] C:\DOKUME~1\ADMINI~1\ANWEND~1\Mozilla
[30.10.2009|23:10] C:\DOKUME~1\ADMINI~1\ANWEND~1\Nokia
[29.10.2009|19:55] C:\DOKUME~1\ADMINI~1\ANWEND~1\PC Suite
[01.04.2009|19:33] C:\DOKUME~1\ADMINI~1\ANWEND~1\skypePM
[29.12.2008|19:35] C:\DOKUME~1\ADMINI~1\ANWEND~1\teamspeak2
[30.08.2009|14:00] C:\DOKUME~1\ADMINI~1\ANWEND~1\TeamViewer
[29.11.2009|20:17] C:\DOKUME~1\ADMINI~1\ANWEND~1\U3
[0|Datei(en)] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes
[20|Verzeichnis(se),] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes frei

[15.07.2009|12:06] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Avira
[27.01.2010|22:29] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bleh kind cool memo
[01.12.2009|16:59] C:\DOKUME~1\ALLUSE~1\ANWEND~1\ICQ
[13.12.2009|11:48] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Installations
[22.12.2008|22:17] C:\DOKUME~1\ALLUSE~1\ANWEND~1\InstallShield
[29.01.2010|12:39] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Malwarebytes
[01.02.2010|12:03] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Microsoft
[30.12.2009|00:06] C:\DOKUME~1\ALLUSE~1\ANWEND~1\NexonUS
[29.12.2009|12:41] C:\DOKUME~1\ALLUSE~1\ANWEND~1\NVIDIA Corporation
[29.10.2009|21:48] C:\DOKUME~1\ALLUSE~1\ANWEND~1\PC Suite
[23.12.2008|12:44] C:\DOKUME~1\ALLUSE~1\ANWEND~1\PMB Files
[12.01.2009|15:42] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Skype
[29.01.2010|13:31] C:\DOKUME~1\ALLUSE~1\ANWEND~1\TEMP
[23.04.2009|10:46] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Windows Genuine Advantage
[0|Datei(en)] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes
[16|Verzeichnis(se),] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes frei

[29.11.2008|17:41] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes
[3|Verzeichnis(se),] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes frei

[06.09.2009|15:02] C:\DOKUME~1\LOCALS~1\ANWEND~1\Adobe
[01.01.2010|15:36] C:\DOKUME~1\LOCALS~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes
[4|Verzeichnis(se),] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes frei

[29.11.2008|17:41] C:\DOKUME~1\NETWOR~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes
[3|Verzeichnis(se),] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes frei

--------------------\\ Geplante Aufgaben unter C:\WINDOWS\Tasks

[01.02.2010 19:00][--ah-----] C:\WINDOWS\tasks\A2AB65C991851BED.job
[01.02.2010 11:28][--ah-----] C:\WINDOWS\tasks\SA.DAT
[11.11.2004 11:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

( A2AB65C991851BED.job )=( c:\dokume~1\admini~1\anwend~1\axislo~1\Signheckdash.exe )

--------------------\\ Ordner Verzeichnis unter C:\Programme

[22.12.2008|18:35] C:\Programme\802.11 Wireless LAN
[05.12.2008|17:54] C:\Programme\Ahead
[13.12.2009|19:21] C:\Programme\alaplaya
[03.04.2009|16:14] C:\Programme\AskSearch
[15.07.2009|12:06] C:\Programme\Avira
[19.12.2009|11:59] C:\Programme\AXISLOCKS
[29.01.2010|12:39] C:\Programme\CCleaner
[13.07.2009|13:09] C:\Programme\Circle Development
[29.11.2008|17:39] C:\Programme\ComPlus Applications
[17.04.2009|14:39] C:\Programme\Crcle Developement
[29.10.2009|19:53] C:\Programme\DIFX
[29.12.2009|12:45] C:\Programme\DriveTheLife
[03.04.2009|16:14] C:\Programme\DVDVideoSoft
[01.02.2010|11:28] C:\Programme\Gemeinsame Dateien
[21.04.2009|18:13] C:\Programme\Hercules
[11.03.2009|18:39] C:\Programme\ICQ6.5
[01.12.2009|16:59] C:\Programme\ICQ6Toolbar
[28.11.2009|16:17] C:\Programme\InstallShield Installation Information
[22.01.2010|23:08] C:\Programme\Internet Explorer
[24.11.2009|18:08] C:\Programme\Kaiba Corp VDS
[24.11.2009|22:21] C:\Programme\LogMeIn Hamachi
[29.01.2010|12:40] C:\Programme\Malwarebytes' Anti-Malware
[30.12.2009|21:33] C:\Programme\Messenger
[01.02.2010|16:22] C:\Programme\Messenger Plus! Live
[26.01.2010|18:06] C:\Programme\Microsoft
[29.11.2008|17:42] C:\Programme\microsoft frontpage
[05.12.2008|17:57] C:\Programme\Microsoft Office
[05.12.2008|17:58] C:\Programme\Microsoft.NET
[30.12.2009|00:57] C:\Programme\Movie Maker
[01.02.2010|19:47] C:\Programme\Mozilla Firefox
[29.12.2009|15:22] C:\Programme\MSBuild
[30.12.2009|00:57] C:\Programme\msn
[29.11.2008|17:42] C:\Programme\msn gaming zone
[29.12.2009|15:17] C:\Programme\MSXML 6.0
[30.12.2009|00:55] C:\Programme\NetMeeting
[13.12.2009|11:51] C:\Programme\Nokia
[29.12.2009|12:41] C:\Programme\NVIDIA Corporation
[29.11.2008|17:40] C:\Programme\Online-Dienste
[30.12.2009|01:02] C:\Programme\Outlook Express
[23.12.2008|12:43] C:\Programme\Pando Networks
[13.12.2009|11:50] C:\Programme\PC Connectivity Solution
[29.11.2008|19:04] C:\Programme\Realtek
[29.12.2009|15:22] C:\Programme\Reference Assemblies
[01.02.2010|17:48] C:\Programme\Steam
[17.04.2009|14:44] C:\Programme\TeamViewer
[29.01.2010|12:24] C:\Programme\Trend Micro
[29.11.2008|17:49] C:\Programme\Uninstall Information
[17.12.2008|11:35] C:\Programme\Winamp
[26.01.2010|18:06] C:\Programme\Windows Live
[12.09.2009|14:59] C:\Programme\Windows Live Safety Center
[26.01.2010|18:06] C:\Programme\Windows Live SkyDrive
[29.10.2009|20:03] C:\Programme\Windows Media Connect 2
[29.10.2009|20:03] C:\Programme\Windows Media Player
[30.12.2009|00:55] C:\Programme\Windows NT
[29.11.2008|17:40] C:\Programme\WindowsUpdate
[05.12.2008|17:59] C:\Programme\WinRAR
[29.11.2008|17:42] C:\Programme\xerox
[0|Datei(en)] C:\Programme\Bytes
[59|Verzeichnis(se),] C:\Programme\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Programme\Gemeinsame Dateien

[05.12.2008|17:54] C:\Programme\Gemeinsame Dateien\Ahead
[21.04.2009|18:15] C:\Programme\Gemeinsame Dateien\ArcSoft
[05.12.2008|17:56] C:\Programme\Gemeinsame Dateien\DESIGNER
[29.11.2008|17:40] C:\Programme\Gemeinsame Dateien\Dienste
[28.11.2009|18:04] C:\Programme\Gemeinsame Dateien\DVDVideoSoft
[21.04.2009|18:11] C:\Programme\Gemeinsame Dateien\InstallShield
[29.01.2010|12:58] C:\Programme\Gemeinsame Dateien\Microsoft Shared
[29.11.2008|17:40] C:\Programme\Gemeinsame Dateien\MSSoap
[13.12.2009|11:51] C:\Programme\Gemeinsame Dateien\Nokia
[29.11.2008|17:35] C:\Programme\Gemeinsame Dateien\ODBC
[13.12.2009|11:51] C:\Programme\Gemeinsame Dateien\PCSuite
[29.11.2008|17:35] C:\Programme\Gemeinsame Dateien\SpeechEngines
[30.12.2009|00:55] C:\Programme\Gemeinsame Dateien\System
[26.01.2010|17:55] C:\Programme\Gemeinsame Dateien\Windows Live
[0|Datei(en)] C:\Programme\Gemeinsame Dateien\Bytes
[16|Verzeichnis(se),] C:\Programme\Gemeinsame Dateien\Bytes frei

--------------------\\ Process

( 38 Processes )

... OK !

--------------------\\ Ueberpruefung mit S_Lop

Kein Lop Ordner gefunden !

--------------------\\ Suche nach Lop Dateien - Ordnern

C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bleh kind cool memo
C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bleh kind cool memo\up mail.dat
C:\DOKUME~1\ADMINI~1\ANWEND~1\axislo~1
C:\Programme\axislo~1
C:\WINDOWS\Tasks\A2AB65C991851BED.job

--------------------\\ Suche innerhalb der Registry

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

..... OK !

--------------------\\ Ueberpruefung der Hosts Datei

Hosts Datei SAUBER


--------------------\\ Suche nach verborgenen Dateien mit Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-01 19:54:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 42

--------------------\\ Suche nach anderen Infektionen


Kein anderen Infektionen gefunden !

[F:1203][D:58]-> C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp
[F:21][D:0]-> C:\DOKUME~1\ADMINI~1\Cookies
[F:322][D:5]-> C:\DOKUME~1\ADMINI~1\LOKALE~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 01.02.2010|19:55 - Option : [1]

--------------------\\ Scan beendet um 19:55:08

Hallo

[01.02.2010|16:22] C:\Programme\Messenger Plus! Live

ich dachte der Messenger Plus sei deinstalliert?

Führe Lop S&D mit der Option 2 aus und poste anschließend das neu entstandene Log.

MFG

habs deinstalled o.o
und sogar sämtliche dateien die damit zu tun haben gelöscht... ka was das ist


--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon(tm) 64 Processor 3500+ )
BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
USER : Administrator ( Administrator )
BOOT : Normal boot
Antivirus : AntiVir Desktop 9.0.1.32 (Activated)
C:\ (Local Disk) - NTFS - Total:34 Go (Free:0 Go)
D:\ (CD or DVD)
E:\ (Local Disk) - NTFS - Total:114 Go (Free:112 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 01.02.2010|22:28 )


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ FIX

Geloescht ! - C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bleh kind cool memo\up mail.dat
Geloescht ! - C:\WINDOWS\Tasks\A2AB65C991851BED.job
Geloescht ! - C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bleh kind cool memo
Geloescht ! - C:\DOKUME~1\ADMINI~1\ANWEND~1\axislo~1
Geloescht ! - C:\Programme\axislo~1

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


--------------------\\ Ordner Verzeichnis unter ANWEND~1

[22.12.2008|18:43] C:\DOKUME~1\ADMINI~1\ANWEND~1\Adobe
[21.04.2009|18:41] C:\DOKUME~1\ADMINI~1\ANWEND~1\ArcSoft
[24.11.2009|22:21] C:\DOKUME~1\ADMINI~1\ANWEND~1\Hamachi
[26.06.2009|15:33] C:\DOKUME~1\ADMINI~1\ANWEND~1\ICQ
[29.11.2008|17:49] C:\DOKUME~1\ADMINI~1\ANWEND~1\Identities
[29.11.2008|17:51] C:\DOKUME~1\ADMINI~1\ANWEND~1\InstallShield
[22.12.2008|18:43] C:\DOKUME~1\ADMINI~1\ANWEND~1\Macromedia
[29.01.2010|12:40] C:\DOKUME~1\ADMINI~1\ANWEND~1\Malwarebytes
[01.12.2009|17:39] C:\DOKUME~1\ADMINI~1\ANWEND~1\McLoad
[25.10.2009|15:34] C:\DOKUME~1\ADMINI~1\ANWEND~1\Microsoft
[22.12.2008|18:41] C:\DOKUME~1\ADMINI~1\ANWEND~1\Mozilla
[30.10.2009|23:10] C:\DOKUME~1\ADMINI~1\ANWEND~1\Nokia
[29.10.2009|19:55] C:\DOKUME~1\ADMINI~1\ANWEND~1\PC Suite
[01.04.2009|19:33] C:\DOKUME~1\ADMINI~1\ANWEND~1\skypePM
[29.12.2008|19:35] C:\DOKUME~1\ADMINI~1\ANWEND~1\teamspeak2
[30.08.2009|14:00] C:\DOKUME~1\ADMINI~1\ANWEND~1\TeamViewer
[29.11.2009|20:17] C:\DOKUME~1\ADMINI~1\ANWEND~1\U3
[0|Datei(en)] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes
[19|Verzeichnis(se),] C:\DOKUME~1\ADMINI~1\ANWEND~1\Bytes frei

[15.07.2009|12:06] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Avira
[01.12.2009|16:59] C:\DOKUME~1\ALLUSE~1\ANWEND~1\ICQ
[13.12.2009|11:48] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Installations
[22.12.2008|22:17] C:\DOKUME~1\ALLUSE~1\ANWEND~1\InstallShield
[29.01.2010|12:39] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Malwarebytes
[01.02.2010|12:03] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Microsoft
[30.12.2009|00:06] C:\DOKUME~1\ALLUSE~1\ANWEND~1\NexonUS
[29.12.2009|12:41] C:\DOKUME~1\ALLUSE~1\ANWEND~1\NVIDIA Corporation
[29.10.2009|21:48] C:\DOKUME~1\ALLUSE~1\ANWEND~1\PC Suite
[23.12.2008|12:44] C:\DOKUME~1\ALLUSE~1\ANWEND~1\PMB Files
[12.01.2009|15:42] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Skype
[29.01.2010|13:31] C:\DOKUME~1\ALLUSE~1\ANWEND~1\TEMP
[23.04.2009|10:46] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Windows Genuine Advantage
[0|Datei(en)] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes
[15|Verzeichnis(se),] C:\DOKUME~1\ALLUSE~1\ANWEND~1\Bytes frei

[29.11.2008|17:41] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes
[3|Verzeichnis(se),] C:\DOKUME~1\DEFAUL~1\ANWEND~1\Bytes frei

[06.09.2009|15:02] C:\DOKUME~1\LOCALS~1\ANWEND~1\Adobe
[01.01.2010|15:36] C:\DOKUME~1\LOCALS~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes
[4|Verzeichnis(se),] C:\DOKUME~1\LOCALS~1\ANWEND~1\Bytes frei

[29.11.2008|17:41] C:\DOKUME~1\NETWOR~1\ANWEND~1\Microsoft
[0|Datei(en)] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes
[3|Verzeichnis(se),] C:\DOKUME~1\NETWOR~1\ANWEND~1\Bytes frei

--------------------\\ Geplante Aufgaben unter C:\WINDOWS\Tasks

[01.02.2010 11:28][--ah-----] C:\WINDOWS\tasks\SA.DAT
[11.11.2004 11:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Ordner Verzeichnis unter C:\Programme

[22.12.2008|18:35] C:\Programme\802.11 Wireless LAN
[05.12.2008|17:54] C:\Programme\Ahead
[13.12.2009|19:21] C:\Programme\alaplaya
[03.04.2009|16:14] C:\Programme\AskSearch
[15.07.2009|12:06] C:\Programme\Avira
[29.01.2010|12:39] C:\Programme\CCleaner
[13.07.2009|13:09] C:\Programme\Circle Development
[29.11.2008|17:39] C:\Programme\ComPlus Applications
[17.04.2009|14:39] C:\Programme\Crcle Developement
[29.10.2009|19:53] C:\Programme\DIFX
[29.12.2009|12:45] C:\Programme\DriveTheLife
[03.04.2009|16:14] C:\Programme\DVDVideoSoft
[01.02.2010|11:28] C:\Programme\Gemeinsame Dateien
[21.04.2009|18:13] C:\Programme\Hercules
[11.03.2009|18:39] C:\Programme\ICQ6.5
[01.12.2009|16:59] C:\Programme\ICQ6Toolbar
[28.11.2009|16:17] C:\Programme\InstallShield Installation Information
[22.01.2010|23:08] C:\Programme\Internet Explorer
[24.11.2009|18:08] C:\Programme\Kaiba Corp VDS
[24.11.2009|22:21] C:\Programme\LogMeIn Hamachi
[29.01.2010|12:40] C:\Programme\Malwarebytes' Anti-Malware
[30.12.2009|21:33] C:\Programme\Messenger
[26.01.2010|18:06] C:\Programme\Microsoft
[29.11.2008|17:42] C:\Programme\microsoft frontpage
[05.12.2008|17:57] C:\Programme\Microsoft Office
[05.12.2008|17:58] C:\Programme\Microsoft.NET
[30.12.2009|00:57] C:\Programme\Movie Maker
[01.02.2010|22:20] C:\Programme\Mozilla Firefox
[29.12.2009|15:22] C:\Programme\MSBuild
[30.12.2009|00:57] C:\Programme\msn
[29.11.2008|17:42] C:\Programme\msn gaming zone
[29.12.2009|15:17] C:\Programme\MSXML 6.0
[30.12.2009|00:55] C:\Programme\NetMeeting
[13.12.2009|11:51] C:\Programme\Nokia
[29.12.2009|12:41] C:\Programme\NVIDIA Corporation
[29.11.2008|17:40] C:\Programme\Online-Dienste
[30.12.2009|01:02] C:\Programme\Outlook Express
[23.12.2008|12:43] C:\Programme\Pando Networks
[13.12.2009|11:50] C:\Programme\PC Connectivity Solution
[29.11.2008|19:04] C:\Programme\Realtek
[29.12.2009|15:22] C:\Programme\Reference Assemblies
[01.02.2010|20:17] C:\Programme\Steam
[17.04.2009|14:44] C:\Programme\TeamViewer
[29.01.2010|12:24] C:\Programme\Trend Micro
[29.11.2008|17:49] C:\Programme\Uninstall Information
[17.12.2008|11:35] C:\Programme\Winamp
[26.01.2010|18:06] C:\Programme\Windows Live
[12.09.2009|14:59] C:\Programme\Windows Live Safety Center
[26.01.2010|18:06] C:\Programme\Windows Live SkyDrive
[29.10.2009|20:03] C:\Programme\Windows Media Connect 2
[29.10.2009|20:03] C:\Programme\Windows Media Player
[30.12.2009|00:55] C:\Programme\Windows NT
[29.11.2008|17:40] C:\Programme\WindowsUpdate
[05.12.2008|17:59] C:\Programme\WinRAR
[29.11.2008|17:42] C:\Programme\xerox
[0|Datei(en)] C:\Programme\Bytes
[57|Verzeichnis(se),] C:\Programme\Bytes frei

--------------------\\ Ordner Verzeichnis unter C:\Programme\Gemeinsame Dateien

[05.12.2008|17:54] C:\Programme\Gemeinsame Dateien\Ahead
[21.04.2009|18:15] C:\Programme\Gemeinsame Dateien\ArcSoft
[05.12.2008|17:56] C:\Programme\Gemeinsame Dateien\DESIGNER
[29.11.2008|17:40] C:\Programme\Gemeinsame Dateien\Dienste
[28.11.2009|18:04] C:\Programme\Gemeinsame Dateien\DVDVideoSoft
[21.04.2009|18:11] C:\Programme\Gemeinsame Dateien\InstallShield
[29.01.2010|12:58] C:\Programme\Gemeinsame Dateien\Microsoft Shared
[29.11.2008|17:40] C:\Programme\Gemeinsame Dateien\MSSoap
[13.12.2009|11:51] C:\Programme\Gemeinsame Dateien\Nokia
[29.11.2008|17:35] C:\Programme\Gemeinsame Dateien\ODBC
[13.12.2009|11:51] C:\Programme\Gemeinsame Dateien\PCSuite
[29.11.2008|17:35] C:\Programme\Gemeinsame Dateien\SpeechEngines
[30.12.2009|00:55] C:\Programme\Gemeinsame Dateien\System
[26.01.2010|17:55] C:\Programme\Gemeinsame Dateien\Windows Live
[0|Datei(en)] C:\Programme\Gemeinsame Dateien\Bytes
[16|Verzeichnis(se),] C:\Programme\Gemeinsame Dateien\Bytes frei

--------------------\\ Process

( 38 Processes )

... OK !

--------------------\\ Ueberpruefung mit S_Lop

Kein Lop Ordner gefunden !

--------------------\\ Suche nach Lop Dateien - Ordnern

Kein Lop Ordner gefunden !

--------------------\\ Suche innerhalb der Registry

..... OK !

--------------------\\ Ueberpruefung der Hosts Datei

Hosts Datei SAUBER


--------------------\\ Suche nach verborgenen Dateien mit Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-01 22:29:43
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 42

--------------------\\ Suche nach anderen Infektionen


Kein anderen Infektionen gefunden !

[F:1204][D:58]-> C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp
[F:22][D:0]-> C:\DOKUME~1\ADMINI~1\Cookies
[F:331][D:5]-> C:\DOKUME~1\ADMINI~1\LOKALE~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 01.02.2010|19:55 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 01.02.2010|22:30 - Option : [2]

--------------------\\ Scan beendet um 22:30:36

also ask toolbar als auch messenger plus! hab ich beides deinstalliert keine ahnung warum die da noch stehen

Hallo

kommen noch Popups?

MFG

das hat sich gebessert kommen keine mehr
ich frage mich was ---> C:\DOKUME~1\ADMINI~1\ANWEND~1 für ein ordner ist denn ich sehe den nirgendswo und hab so nen ordner niemals erstellt

Hallo

das hat sich gebessert kommen keine mehr

Gut, deinstalliere/lösche nun bitte Lop S&D.

wenn du dieser Anleitung nachgegangen bist

mach bitte alle versteckten Dateien und Ordner sichtbar
, dann lass diese Dateien....

solltest du den Ordner sehen können, er ist blasser wie die sonst sichtbaren Ordner.

Überprüfe dein System bitte mit Kaspersky AVP-Tool
AVP-Tool
anschließend berichte bitte.

MFG

hab alle ordner sichtbar gemacht sehe alles andere nur den ordner nicht ich denke dieser ordner ist bestimmt die quelle allen übels...
denn den ordner hab ich niemals erstellt und konnt ihn noch nie sehen sogar mit dem sichtbar machen sehe ich den nicht auch wenn ich irgendwie danach suche kommt gar nichts das überprüfen ist im gange