Hallo zusammen,

in der Hoffnung keine wichtigen/notwendigen Informationen überlesen zu haben, poste ich nachfolgend mein Problem. Auf meinem System hat sich folgendes Problem "CoolWWWSearch.Dnsrelay" eingenistet. Ich hab das Problem durch Spybot Search & Destroy gefunden, welches es allerdings nicht entfernen konnte.

(1)

a)
CCleaner -> Optimierung / Bereinigung durchgeführt

b)
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 4024

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18904

23.04.2010 04:59:15
mbam-log-2010-04-23 (04-59-15).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 107685
Laufzeit: 3 Minute(n), 34 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

c)
C:\rsit\log.txt

Logfile of random's system information tool 1.06 (written by random/random)
Run by *** at 2010-04-23 05:14:26
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 197 GB (59%) free of 335 GB
Total RAM: 4094 MB (64% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:14:42, on 23.04.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
C:\Program Files (x86)\ThreatFire\TFService.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe
C:\Program Files (x86)\DT\Speedport W 102 Stick\UI.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\ThreatFire\TFTray.exe
C:\Program Files (x86)\Steganos Safe CBE\SteganosHotKeyService.exe
C:\Program Files (x86)\Steganos Safe CBE\fredirstarter.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Users\***\Desktop\RSIT.exe
C:\Program Files (x86)\Trend Micro\HijackThis\***.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: CBAbzockschutz.InitToolbarBHO - {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} - mscoree.dll (file missing)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - (no file)
O3 - Toolbar: COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EnergySettings] C:\Program Files (x86)\Fujitsu Siemens Computers\Energy Settings\EnergySettings.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ThreatFire] "C:\Program Files (x86)\ThreatFire\TFTray.exe"
O4 - HKLM\..\Run: [SAFECBE HotKeys] "C:\Program Files (x86)\Steganos Safe CBE\SteganosHotKeyService.exe"
O4 - HKLM\..\Run: [SAFECBE File Redirection Starter] "C:\Program Files (x86)\Steganos Safe CBE\fredirstarter.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Speedport W 102 WLAN Manager.lnk = C:\Program Files (x86)\DT\Speedport W 102 Stick\UI.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - h**p://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6531D99C-0D0E-4293-B3CB-A3E1D0D41847} (AhnASP Control) - h**p://aspglobal.ahnlab.com/asp/cab/AhnASP_vista.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - h**p://download.eset.com/special/eos/OnlineScanner.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files (x86)\Google\Google Desktop

Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe
O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE
O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files (x86)\WinPcap\rpcapd.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Fujitsu Diagnostic Testhandler (TestHandler) - Fujitsu Technology Solutions - C:\Program Files (x86)

\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files (x86)\ThreatFire\TFService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: UPnPService - Magix AG - C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe

(file missing)

--
End of file - 9557 bytes

======Scheduled tasks folder======

C:\Windows\tasks\GlaryInitialize.job
C:\Windows\tasks\Google Software Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2008-06-11 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2e250b90-0e7a-42a3-9d65-e39f9f227fa4}]
CBAbzockschutz.InitToolbarBHO - C:\Windows\system32\mscoree.dll [2008-07-27 282112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll [2009-11-28 761840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-01-22 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll [2008-12-09 958200]
{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}
{353e2a48-6254-4bd3-88f4-3b51a0ca7870} - COMPUTERBILD-Abzockschutz - C:\Windows\system32\mscoree.dll [2008-07-27 282112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"EnergySettings"=C:\Program Files (x86)\Fujitsu Siemens Computers\Energy Settings\EnergySettings.exe [2008-09-19 113664]
"Google Desktop Search"=C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2009-10-28 30192]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"ThreatFire"=C:\Program Files (x86)\ThreatFire\TFTray.exe [2010-01-15 378128]
"SAFECBE HotKeys"=C:\Program Files (x86)\Steganos Safe CBE\SteganosHotKeyService.exe [2008-10-14 25088]
"SAFECBE File Redirection Starter"=C:\Program Files (x86)\Steganos Safe CBE\fredirstarter.exe [2008-09-11 57344]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-01-11 246504]
" Malwarebytes Anti-Malware (reboot)"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe [2010-03-29 1086856]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-21 1555968]
"Picasa Media Detector"=C:\Program Files (x86)\Picasa2\PicasaMediaDetector.exe [2008-02-26 443968]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Speedport W 102 WLAN Manager.lnk - C:\Program Files (x86)\DT\Speedport W 102 Stick\UI.exe

C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 3.1.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files (x86)\xchat\xchat.exe"="C:\Program Files (x86)\xchat\xchat.exe:*:Enabled:XChat IRC Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\SysWOW64\Notepad.exe %1
.js - open - C:\Windows\SysWOW64\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-04-23 05:14:26 ----D---- C:\rsit
2010-04-23 04:21:59 ----D---- C:\Users\***\AppData\Roaming\Malwarebytes
2010-04-23 04:21:12 ----D---- C:\ProgramData\Malwarebytes
2010-04-23 04:21:07 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-04-21 20:57:42 ----D---- C:\Windows\Downloaded Installations
2010-04-20 06:30:43 ----A---- C:\Windows\system32\WinFLsrv.exe
2010-04-14 11:50:50 ----A---- C:\Windows\system32\vbscript.dll
2010-04-14 11:50:13 ----A---- C:\Windows\system32\wintrust.dll
2010-04-14 11:50:05 ----A---- C:\Windows\system32\cabview.dll
2010-04-11 18:55:28 ----D---- C:\Program Files (x86)\mIRC
2010-04-11 18:39:04 ----D---- C:\Users\***\AppData\Roaming\mIRC
2010-04-11 18:26:39 ----D---- C:\Users\***\AppData\Roaming\Bersirc
2010-04-11 18:26:37 ----D---- C:\Program Files (x86)\Bersirc 2.2
2010-04-11 18:15:42 ----D---- C:\Program Files (x86)\X-Chat 2
2010-03-31 14:46:09 ----A---- C:\Windows\system32\mshtml.dll
2010-03-31 14:46:07 ----A---- C:\Windows\system32\iertutil.dll
2010-03-31 14:46:07 ----A---- C:\Windows\system32\ieframe.dll
2010-03-31 14:46:06 ----A---- C:\Windows\system32\wininet.dll
2010-03-31 14:46:06 ----A---- C:\Windows\system32\urlmon.dll
2010-03-31 14:46:05 ----A---- C:\Windows\system32\occache.dll
2010-03-31 14:46:05 ----A---- C:\Windows\system32\mstime.dll
2010-03-31 14:46:05 ----A---- C:\Windows\system32\msfeeds.dll
2010-03-31 14:46:05 ----A---- C:\Windows\system32\ieui.dll
2010-03-31 14:46:05 ----A---- C:\Windows\system32\iedkcs32.dll
2010-03-31 14:46:04 ----A---- C:\Windows\system32\msfeedssync.exe
2010-03-31 14:46:04 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-03-31 14:46:04 ----A---- C:\Windows\system32\jsproxy.dll
2010-03-31 14:46:04 ----A---- C:\Windows\system32\ieUnatt.exe
2010-03-31 14:46:04 ----A---- C:\Windows\system32\iesysprep.dll
2010-03-31 14:46:04 ----A---- C:\Windows\system32\iesetup.dll
2010-03-31 14:46:04 ----A---- C:\Windows\system32\iernonce.dll
2010-03-31 14:46:04 ----A---- C:\Windows\system32\iepeers.dll
2010-03-31 14:46:04 ----A---- C:\Windows\system32\ie4uinit.exe
2010-03-24 18:42:10 ----D---- C:\Users\***\AppData\Roaming\Avira

======List of files/folders modified in the last 1 months======

2010-04-23 05:14:38 ----D---- C:\Windows\Prefetch
2010-04-23 05:14:32 ----D---- C:\Windows\Temp
2010-04-23 05:12:06 ----D---- C:\Windows\System32
2010-04-23 05:12:06 ----D---- C:\Windows\inf
2010-04-23 05:08:33 ----D---- C:\Windows\Tasks
2010-04-23 05:03:34 ----D---- C:\Windows
2010-04-23 05:03:15 ----D---- C:\ProgramData\Spybot - Search & Destroy
2010-04-23 04:52:40 ----D---- C:\Windows\SysWOW64
2010-04-23 04:21:15 ----D---- C:\Windows\system32\drivers
2010-04-23 04:21:12 ----HD---- C:\ProgramData
2010-04-23 04:21:07 ----RD---- C:\Program Files (x86)
2010-04-23 03:30:09 ----D---- C:\Program Files (x86)\phase5
2010-04-23 03:24:32 ----D---- C:\Users\***\AppData\Roaming\vlc
2010-04-22 22:35:00 ----D---- C:\Users\***\AppData\Roaming\X-Chat 2
2010-04-22 18:28:22 ----SHD---- C:\System Volume Information
2010-04-22 07:26:02 ----D---- C:\Program Files (x86)\CCleaner
2010-04-21 21:04:16 ----SHD---- C:\Windows\Installer
2010-04-21 20:34:01 ----D---- C:\Program Files (x86)\Hotspot Shield
2010-04-20 15:39:08 ----D---- C:\Users\***\AppData\Roaming\dvdcss
2010-04-20 06:44:40 ----D---- C:\Users\***\AppData\Roaming\Steganos
2010-04-17 18:24:19 ----D---- C:\Program Files (x86)\Google
2010-04-17 06:05:39 ----D---- C:\Users\***\AppData\Roaming\Macromedia
2010-04-15 15:25:34 ----D---- C:\Windows\winsxs
2010-04-15 15:03:09 ----D---- C:\Windows\Debug
2010-04-15 14:57:15 ----D---- C:\Program Files (x86)\Windows Mail
2010-04-11 18:46:10 ----RD---- C:\Program Files
2010-04-11 18:13:18 ----D---- C:\Program Files (x86)\xchat
2010-04-05 01:39:01 ----D---- C:\Users\***\AppData\Roaming\gtk-2.0
2010-04-03 03:40:46 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-04-01 12:44:42 ----D---- C:\Windows\system32\migration
2010-04-01 12:44:42 ----D---- C:\Program Files (x86)\Internet Explorer
2010-03-31 20:40:23 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2010-03-30 02:24:45 ----D---- C:\Users\***\AppData\Roaming\DivX
2010-03-30 01:14:31 ----RSD---- C:\Windows\assembly
2010-03-28 17:40:36 ----D---- C:\Users\***\AppData\Roaming\Prison Break

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys []
R1 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys []
R1 SLEE_16_DRIVER;Steganos Live Encryption Engine 16 [Driver]; \??\C:\Windows\Sleen1664.sys [2007-10-11 85952]
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys []
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys []
R2 PCASp50a64;PCASp50a64 NDIS Protocol Driver; C:\Windows\System32\Drivers\PCASp50a64.sys [2006-11-28 41280]
R3 GearAspiWDM;GEARAspiWDM; C:\Windows\System32\drivers\GEARAspiWDM.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 netr28ux;Speedport W 102 Stick IEEE 802.11n USB 2.0 Driver for Vista; C:\Windows\system32\DRIVERS\netr28ux.sys []
R3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\Windows\system32\DRIVERS\nvmfdx64.sys []
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []
R3 nvsmu;nvsmu; C:\Windows\system32\DRIVERS\nvsmu.sys []
R3 taphss;Anchorfree HSS Adapter; C:\Windows\system32\DRIVERS\taphss.sys []
R3 TfNetMon;TfNetMon; \??\C:\Windows\system32\drivers\TfNetMon.sys []
R3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys []
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys []
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys []
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys []
S3 NPF;NetGroup Packet Filter Driver; C:\Windows\system32\drivers\npf.sys []
S3 RkPavproc1;RkPavproc1; \??\C:\Windows\system32\drivers\RkPavproc1.sys []
S3 ScreamBAudioSvc;ScreamBee Audio; C:\Windows\system32\drivers\ScreamingBAudio64.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-04-20 267432]
R2 HotspotShieldService;Hotspot Shield Service; C:\Program Files (x86)\Hotspot Shield\bin\openvpnas.exe [2010-04-06 247856]
R2 HssSrv;Hotspot Shield Routing Service; C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe [2010-01-09 331824]
R2 HssWd;Hotspot Shield Monitoring Service; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [2010-04-01 194608]
R2 ICQ Service;ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [2008-10-19 222456]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 TestHandler;Fujitsu Diagnostic Testhandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [2009-02-19 341264]
R2 ThreatFire;ThreatFire; C:\Program Files (x86)\ThreatFire\TFService.exe [2010-01-15 70928]
S2 gupdate;Google Update Service (gupdate); C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-03-23 135664]
S2 gusvc;Google Software Updater; C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-11-28 194032]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-07-27 93184]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
S3 GoogleDesktopManager-093009-130223;Google Desktop Manager 5.9.909.30391; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2009-10-28

30192]
S3 HssTrayService;Hotspot Shield Tray Service; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [2010-04-06 57640]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-21 19968]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files (x86)\WinPcap\rpcapd.exe [2007-11-06 92792]
S3 UPnPService;UPnPService; C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 544768]

-----------------EOF-----------------

C:\rsit\info.txt

info.txt logfile of random's system information tool 1.06 2010-04-23 05:14:44

======Uninstall list======

-->C:\Program Files (x86)\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
-->MsiExec /X{B83FC356-B7C0-441F-8A4D-D71E088E7974}
3ivx MPEG-4 5.0.2 (remove only)-->"C:\Program Files (x86)\3ivx\3ivx MPEG-4 5.0.2\uninstaller.exe"
Aaron's WebVacuum 2-->"C:\Program Files (x86)\SurfWare\Aaron's WebVacuum 2\unins000.exe"
Adobe Flash Player 10 ActiveX-->MsiExec.exe /X{2BD2FA21-B51D-4F01-94A7-AC16737B2163}
Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A90000000001}
Anti-Twin (Installation 26.02.2010)-->"C:\Program Files (x86)\AntiTwin\uninstall.exe" /uninst "UninstallKey=Anti-Twin 2010-02-26 21.18.36"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files (x86)\Avira\AntiVir Desktop\setup.exe /REMOVE
Bersirc 2.2.14-->C:\Program Files (x86)\Bersirc 2.2\uninst.exe
CCleaner-->"C:\Program Files (x86)\CCleaner\uninst.exe"
Clean Virus MSN-->"C:\Program Files (x86)\AxBx\Clean Virus MSN\unins000.exe"
COMPUTERBILD-Abzockschutz-->MsiExec.exe /I{18DC1F9A-15B9-4707-A9CD-C2F66239261E}
DivX Codec-->C:\Program Files (x86)\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files (x86)\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files (x86)\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files (x86)\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Plus Web Player-->C:\Program Files (x86)\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Energy Settings-->MsiExec.exe /I{7613592F-B20C-4E1B-B2DD-67F0784D4373}
Firebird SQL Server - MAGIX Edition-->C:\Program Files (x86)\MAGIX\Common\Database\unwise.exe
Free Audio CD Burner version 1.2-->"C:\Program Files (x86)\DVDVideoSoft\Free Audio CD Burner\unins000.exe"
Free YouTube Download 2.3-->"C:\Program Files (x86)\DVDVideoSoft\Free YouTube Download\unins000.exe"
Free YouTube to MP3 Converter version 3.2-->"C:\Program Files (x86)\DVDVideoSoft\Free YouTube to MP3 Converter\unins000.exe"
GIMP 2.6.8-->"C:\Program Files (x86)\GIMP-2.0\setup\unins000.exe"
Glary Utilities 2.20.0.831-->"C:\Program Files (x86)\Glary Utilities\unins000.exe"
Google Desktop-->C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Earth-->MsiExec.exe /X{08C0729E-3E50-11DF-9D81-005056806466}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Updater-->"C:\Program Files (x86)\Google\Google Updater\GoogleUpdater.exe" -uninstall
HijackThis 2.0.2-->"C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+

REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall

{08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT=""
Hotspot Shield 1.41-->C:\Program Files (x86)\Hotspot Shield\Uninstall.exe
ICQ 6.5 Build #1042 Banner Remover 1.3-->"C:\Program Files (x86)\ICQ-Banner-Remover\unins000.exe"
ICQ Toolbar-->C:\Program Files (x86)\ICQ6Toolbar\ICQUnToolbar.exe
ICQ6.5-->"C:\Program Files (x86)\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
J2SE Runtime Environment 5.0 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150030}
Java(TM) 6 Update 18-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216018FF}
MAGIX Foto Manager 2008 5.0.3.351 (D)-->C:\Program Files (x86)\MAGIX\Foto_Manager_2008\unwise.exe
MAGIX Fotobuch 3.6-->C:\Program Files (x86)\MAGIX\MAGIX Fotobuch\uninstall.exe
MAGIX Media Suite 1.12.0.89 (D)-->C:\Program Files (x86)\MAGIX\MediaSuite2008\unwise.exe
MAGIX Music Manager 2007 8.2.0.76 (D)-->C:\Program Files (x86)\MAGIX\MP3_Maker_12_e-version\unwise.exe
MAGIX Online Druck Service 2.3.2.0 (D)-->C:\Program Files (x86)\MAGIX\Online_Druck_Service\unwise.exe
MAGIX Ringtone Maker SE 3.1.0.4 (D)-->C:\Program Files (x86)\MAGIX\Ringtone_Maker_2007_SE\unwise.exe
Malwarebytes' Anti-Malware-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"
Messenger Plus! Live-->"C:\Program Files (x86)\Messenger Plus! Live\Uninstall.exe"
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Expression Web 3 SP1-->msiexec -qb /package {11C88EEC-23FC-4181-B6E4-22247E2ABD28} /uninstall {752E90AC-3F11-4EA3-88EA-96441047EC31}
Microsoft Expression Web 3-->"C:\Program Files (x86)\Microsoft Expression\Web 3\XSetup.exe" -x -AppLangId:1031 "-manifest:WebManifest.cab" "-source:C:\Program Files (x86)

\Microsoft Expression\Web 3\Setup;"
Microsoft Expression Web 3-->MsiExec.exe /I{11C88EEC-23FC-4181-B6E4-22247E2ABD28}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
mIRC-->"C:\Program Files\mIRC\mirc.exe" -uninstall
Mozilla Firefox (3.6.3)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Mozilla Firefox (3.6b5)-->C:\Program Files (x86)\Mozilla Firefox 3.6 Beta 5\uninstall\helper.exe
Mozilla Thunderbird (3.0.4)-->C:\Program Files (x86)\Mozilla Thunderbird\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
NVIDIA PhysX-->MsiExec.exe /X{B83FC356-B7C0-441F-8A4D-D71E088E7974}
OpenOffice.org 3.1-->MsiExec.exe /I{99E862CC-6F69-4D39-99AA-DBF71BF3B585}
PC SECURITY TEST 2009-->"C:\Program Files (x86)\AxBx\PC Security Test 2009\unins000.exe"
Phase 5 HTML-Editor-->MsiExec.exe /I{20B1B020-DEAE-48D1-9960-D4C3185D758B}
Picasa 3-->"C:\Program Files (x86)\Picasa2\Uninstall.exe"
Prison Break-->"C:\Program Files (x86)\InstallShield Installation Information\{C5A31DDC-157A-4DD7-9B5C-C692A06F61FD}\setup.exe" -runfromtemp -l0x0007 -removeonly
PureSync-->MsiExec.exe /X{AD9D5A83-0528-45CA-909F-2C6DF6DD7387}
Realtek High Definition Audio Driver-->C:\Program Files\Realtek\Audio\HDA\RtlUpd64.exe -r -m -nrg2709
SimpleScreenshot 1.40-->C:\Windows\SSSUn.EXE /UnInst:"C:\Windows\SimpleScreenshot_Uninstall.in"
Speedport W 102 Stick-->C:\Program Files (x86)\InstallShield Installation Information\{5E93BA4E-69A0-46A7-B634-3E762FF9B6F9}\setup.exe -runfromtemp -l0x0407
Spybot - Search & Destroy-->"C:\Program Files (x86)\Spybot - Search & Destroy\unins000.exe"
Steganos Safe CBE-->C:\Program Files (x86)\Steganos Safe CBE\uninstall.exe
SystemDiagnostics-->MsiExec.exe /X{EF59DB7F-7426-426E-B862-7031F83ED304}
ThreatFire-->"C:\Program Files (x86)\ThreatFire\unins000.exe"
Total Commander (Remove or Repair)-->c:\totalcmd\tcuninst.exe
Uninstall 1.0.0.1-->"C:\Program Files (x86)\Common Files\DVDVideoSoft\unins000.exe"
Universal Viewer-->"C:\Program Files (x86)\Universal Viewer\Uninstall.exe"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall

{B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
Visual C++ 8.0 Runtime Setup Package (x64)-->MsiExec.exe /I{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}
VLC media player 1.0.2-->C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe
Watson-->MsiExec.exe /I{9B88DD94-1AAE-41C4-BD95-2D8737D5E9E2}
Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956}
Windows Live Essentials-->C:\Program Files (x86)\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}
Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}
Windows Live OneCare safety scanner-->"C:\Program Files (x86)\Windows Live Safety Center\UnInstall.exe"
Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Vista Demo Screen Saver-->MsiExec.exe /I{9605D5C2-F545-40F2-B39A-0462E4CD3811}
WinPcap 4.0.2-->C:\Program Files (x86)\WinPcap\uninstall.exe
WinRAR-->C:\Program Files (x86)\WinRAR\uninstall.exe
X-Chat 2.8.6-2-->"C:\Program Files (x86)\X-Chat 2\unins000.exe"
XMedia Recode 2.1.8.4-->C:\Program Files (x86)\XMedia Recode\uninst.exe

=====HijackThis Backups=====

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) [2009-11-07]
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (file missing) [2009-11-08]
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) [2009-11-08]
O2 - BHO: CBAbzockschutz.InitToolbarBHO - {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} - mscoree.dll (file missing) [2009-11-08]
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files (x86)\Search Settings\kb128\SearchSettings.dll [2009-12-18]
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2009-12-18]
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files (x86)\Search Settings\SearchSettings.exe [2009-12-18]
R3 - URLSearchHook: (no name) - - (no file) [2009-12-18]
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2009-12-18]
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2009-12-18]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.hotspotshield.com/g/?c=h [2009-12-18]
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file) [2009-12-18]

======Hosts File======

127.0.0.1 localhost
127.0.0.1 im.adtech.de
127.0.0.1 adserver.adtech.de
127.0.0.1 adtech.de
127.0.0.1 ar.atwola.com
127.0.0.1 atwola.com
127.0.0.1 adserver.71i.de
127.0.0.1 adicqserver.71i.de
127.0.0.1 71i.de
127.0.0.1 www.007guard.com

======Security center information======

AS: Spybot - Search and Destroy (disabled)
AS: Windows Defender

======System event log======

Computer Name: ***-PC
Event Code: 10029
Message: DCOM hat den Dienst TrustedInstaller mit den Argumenten "" gestartet, um den Server auszuführen:
{752073A1-23F2-4396-85F0-8FDB879ED0ED}
Record Number: 98759
Source Name: Microsoft-Windows-DistributedCOM
Time Written: 20100423030924.000000-000
Event Type: Informationen
User:

Computer Name: ***-PC
Event Code: 7036
Message: Dienst "Windows Modules Installer" befindet sich jetzt im Status "Ausgeführt".
Record Number: 98760
Source Name: Service Control Manager
Time Written: 20100423030924.000000-000
Event Type: Informationen
User:

Computer Name: ***-PC
Event Code: 7036
Message: Dienst "SSTP-Dienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 98761
Source Name: Service Control Manager
Time Written: 20100423031137.000000-000
Event Type: Informationen
User:

Computer Name: ***-PC
Event Code: 7036
Message: Dienst "Telefonie" befindet sich jetzt im Status "Ausgeführt".
Record Number: 98762
Source Name: Service Control Manager
Time Written: 20100423031137.000000-000
Event Type: Informationen
User:

Computer Name: ***-PC
Event Code: 7036
Message: Dienst "RAS-Verbindungsverwaltung" befindet sich jetzt im Status "Ausgeführt".
Record Number: 98763
Source Name: Service Control Manager
Time Written: 20100423031138.000000-000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: ***-PC
Event Code: 1
Message: Der Zertifikatdiensteclient wurde erfolgreich gestartet.
Record Number: 11599
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20100423030719.720636-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ***-PC
Event Code: 0
Message:
Record Number: 11600
Source Name: gusvc
Time Written: 20100423030823.000000-000
Event Type: Informationen
User:

Computer Name: ***-PC
Event Code: 0
Message:
Record Number: 11601
Source Name: gusvc
Time Written: 20100423030923.000000-000
Event Type: Informationen
User:

Computer Name: ***-PC
Event Code: 1001
Message: Die Leistungsindikatoren für den Dienst WmiApRpl (WmiApRpl) wurden entfernt. Die Daten enthalten die neuen Werte der Registrierungseinträge "Last Counter" und "Last

Help".
Record Number: 11602
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20100423031206.000000-000
Event Type: Informationen
User:

Computer Name: ***-PC
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst WmiApRpl (WmiApRpl) wurden erfolgreich geladen. Die Eintragsdaten im Datenbereich enthalten die neuen Indexwerte, die

diesem Dienst zugeordnet sind.
Record Number: 11603
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20100423031206.000000-000
Event Type: Informationen
User:

=====Security event log=====

Computer Name: ***-PC
Event Code: 4672
Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7

Berechtigungen: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 27991
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100423030611.956436-000
Event Type: Überwachung erfolgreich
User:

Computer Name: ***-PC
Event Code: 5032
Message: Der Windows-Firewalldienst konnte den Benutzer nicht darüber benachrichtigen, dass eine Anwendung blockiert wurde und keine eingehenden Verbindungen im Netzwerk

annehmen kann.

Fehlercode: 2
Record Number: 27992
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100423030627.320636-000
Event Type: Überwachung gescheitert
User:

Computer Name: ***-PC
Event Code: 4648
Message: Anmeldeversuch mit expliziten Anmeldeinformationen.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: ***-PC$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Konto, dessen Anmeldeinformationen verwendet wurden:
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Zielserver:
Zielservername: localhost
Weitere Informationen: localhost

Prozessinformationen:
Prozess-ID: 0x258
Prozessname: C:\Windows\System32\services.exe

Netzwerkinformationen:
Netzwerkadresse: -
Port: -

Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden. Dies ist

normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird.
Record Number: 27993
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100423030924.273836-000
Event Type: Überwachung erfolgreich
User:

Computer Name: ***-PC
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: ***-PC$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7

Anmeldetyp: 5

Neue Anmeldung:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Prozessinformationen:
Prozess-ID: 0x258
Prozessname: C:\Windows\System32\services.exe

Netzwerkinformationen:
Arbeitsstationsname:
Quellnetzwerkadresse: -
Quellport: -

Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: Advapi
Authentifizierungspaket: Negotiate
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler

Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
- Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 27994
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100423030924.273836-000
Event Type: Überwachung erfolgreich
User:

Computer Name: ***-PC
Event Code: 4672
Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7

Berechtigungen: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 27995
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100423030924.273836-000
Event Type: Überwachung erfolgreich
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\Common Files\DivX Shared\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=1707
"NUMBER_OF_PROCESSORS"=4
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat
"DFSTRACINGON"=FALSE
"tvdumpflags"=8

-----------------EOF-----------------


Ich hoffe das mir hier jemand helfen kann und bedanke mich schonmal recht herzlich.

Mit freundlichem Grüßen,
MisterX

Wie es aussieht hab ich das Problem lösen können:
Systemwiederherstellung deaktivieren -> Rechner im abgesicherten Modus starten -> Spybot Search & Destroy laufen lassen -> Probleme beheben -> Neustart

Wäre aber nett wenn trotzdem mal jemand drüberschauen könnte ob noch irgendwas "gefährliches" zu erkennen ist.